CVE-2011-3609

CVE-2011-3609 describes a CSRF flaw in JBoss Application Server 7.x prior to 7.1.0 where access to management console information was not properly restricted (e.g., via Access-Control-Allow-Origin). This can enable an unauthorized information leak when an admin user visits a malicious page. The p...

CVE-2011-3609

A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information for example via the "Access-Control-Allow-Origin" HTTP access control flag. This can lead to unauthorized information leak if a user with admin privilege...

CVE-2011-3606

CVE-2011-3606 affects JBoss Application Server 7.x prior to 7.1.0 Beta 1 in its administration console. It is a DOM-based cross-site scripting flaw: a remote attacker can lure a privileged administrator to a crafted page, causing DOM environment modification and arbitrary HTML/script execution. E...

CVE-2011-3606

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

CVE-2011-3606

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

PT-2019-6678 · Red Hat · Jboss Application Server

Name of the Vulnerable Software and Affected Versions: JBoss Application Server versions prior to 7.1.0 Description: A CSRF issue was found in JBoss Application Server, where it did not properly restrict access to the management console information. This can be exploited via the...

CVE-2011-3609: Cross-Site Request Forgery (CSRF)

A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information for example via the "Access-Control-Allow-Origin" HTTP access control flag. This can lead to unauthorized information leak if a user with admin privilege...

CVE-2011-3606: Improper Neutralization of Input During Web Page Generation

A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DO...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 8 (RHSA-2019:1421)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1421 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 6 (RHSA-2019:1419)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1419 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red...

picketlink: URL injection via xinclude parameter

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Access Restriction Bypass

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

Authorization Bypass

JBoss Application Server is the base package for JBoss Enterprise Application Platform, providing the core server components. The Java Naming and Directory Interface JNDI Java API allows Java software clients to locate objects or services in an application server. The Java Authorization Contract...

Important: Red Hat Bug Fix Advisory: Red Hat Virtualization Manager (ovirt-engine) 4.2.8

An update is now available for Red Hat Virtualization Manager. The Red Hat Virtualization Manager is a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities,...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.0 security update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 7.2.0, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scorin...

Information Disclosure

jboss application server is vulnerable to information disclosure. The default configuration for the Command Line Interface created a history file .jboss-cli-history in the user's home directory with insecure file permissions. This allows a malicious local user to gain information otherwise not...

jbossas: Arbitrary code execution via unrestricted deserialization in ReadOnlyAccessFilter of HTTP Invoker.

It was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization. This allows an attacker to execute arbitrary code via crafted serialized data...

jbossas: Arbitrary code execution via unrestricted deserialization in ReadOnlyAccessFilter of HTTP Invoker.

It was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization. This allows an attacker to execute arbitrary code via crafted serialized data...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 on RHEL 6

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...