extension): MITM due to improper validation of AX attribute signatures

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

Moderate: Red Hat Security Advisory: JBoss Enterprise BRMS Platform 5.2.0 update

JBoss Enterprise BRMS Platform 5.2.0 roll up patch 1, which fixes two security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring...

extension): MITM due to improper validation of AX attribute signatures

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

JON: LDAP authentication allows any user access if bind credentials are bad

Red Hat JBoss Operations Network JON 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request...

JON: Unapproved agents can hijack an approved agent's endpoint by using a null security token

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token...

CLI: world-writable root directory

Red Hat JBoss Operations Network JON before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials...

JON: Unapproved agents can connect using the name of an existing approved agent

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name...

Important: Red Hat Security Advisory: JBoss Operations Network 3.0.1 update

JBoss Operations Network 3.0.1, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Important: Red Hat Security Advisory: JBoss Operations Network 2.4.2 security update

An update for JBoss Operations Network 2.4.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

RedHat JBoss File Disclosure

File Disclosure Vulnerability Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Low: Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.2.0 update

JBoss Enterprise SOA Platform 5.2.0 roll up patch 1, which fixes one security issue and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score,...

Moderate: Red Hat Security Advisory: jbossweb security and bug fix update

An update for JBoss Enterprise Portal Platform 4.3 CP07 that fixes one security issue and one bug is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score,...

Important: Red Hat Security Advisory: jbossweb security update

An update for JBoss Enterprise BRMS Platform 5.2.0, JBoss Enterprise Portal Platform 5.2.0, and JBoss Enterprise SOA Platform 5.2.0 that fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important...

JBoss Web remote denial of service when surrogate pair character is placed at buffer boundary

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...

Low: Red Hat Security Advisory: jbosscache security update

An update for JBoss Enterprise Application Platform 5.1.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

JBoss Web 远程拒绝服务漏洞(CVE-2011-4610)

Bugtraq ID: 51829 CVE ID：CVE-2011-4610 JBOSS是一个基于J2EE的开放源代码的应用服务器。 当代理对Surrogate Pairs字符位于内部缓冲区边界时JBoss Web会进入一个无限循环，远程攻击者可以利用此缺陷触发对JBoss Web服务器的拒绝服务攻击。此JBoss Web服务器上的应用程序需使用UTF-8字符编码或在应答中包含用户提供的UTF-8字符串。 0 Red Hat JBoss Enterprise Web Platform 5.1.2 Red Hat JBoss Enterprise Web Platform 5 EL6 Re...

JBoss Operations Network多个安全限制绕过漏洞

BUGTRAQ ID: 51827 CVE ID: CVE-2011-4573,CVE-2012-0052,CVE-2012-0062 JBoss Operations Network是基于Java EE的开源网络管理软件。 JBoss Operations Network在实现上存在多个安全限制绕过漏洞，成功利用后可允许攻击者绕过某些安全限制、获取敏感信息或执行非法操作。 0 RedHat JBoss Operations Network 2.4.1 厂商补丁： RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Important: Red Hat Security Advisory: JBoss Enterprise Portal Platform 4.3 CP07 update

JBoss Enterprise Portal Platform 4.3 CP07, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores,...

JON: Multiple XSS flaws

Multiple cross-site scripting XSS vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network aka JON or JBoss ON before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Important: Red Hat Security Advisory: JBoss Operations Network 2.4.2 update

JBoss Operations Network 2.4.2, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give...