RHEL 5 / 6 / 7 : Red Hat JBoss Enterprise Application Platform 6.4 (RHSA-2020:1478)

The remote Redhat Enterprise Linux 5 / 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1478 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Denial Of Service (DoS)

jbossweb is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way JBoss Web handled UTF-8 surrogate pair characters. If JBoss Web was hosting an application with UTF-8 character encoding enabled, or that included user-supplied UTF-8 strings in a response, a...

Denial Of Service (DoS)

jbossws-common is vulnerable to denial of service DoS. The vulnerability exists as it was found that JBoss Web Services Native did not properly protect against recursive entity resolution when processing Document Type Definitions DTD. A remote attacker could exploit this flaw by sending a...

Remote Code Execution (RCE)

JBoss Enterprise Application Platform is vulnerable to remtoe code execution RCE. Due to an incomplete fix for CVE-2011-1484, JBoss Seam 2 did not block access to all malicious JBoss Expression Language EL constructs in page exception handling, allowing arbitrary Java methods to be executed. A...

Denial Of Service (DoS)

jboss-remoting is vulnerable to denial of service DoS. The vulnerability exists as the JBoss Enterprise Application Platform 4.3.0.CP09 updates RHSA-2010:0937 and RHSA-2010:0938 did not, unlike the errata texts stated, provide a fix for CVE-2010-3862. A remote attacker could use specially-crafted...

Denial Of Service (DoS)

JBoss Web Server is vulnerable to a denial of service. Due to a flaw in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause JBoss Web Server to hang via a specially-crafted HTTP request...

Cross-site Request Forgery (CSRF)

JBoss is vulnerable to Cross-site request forgery CSRF. flaw was found in the JMX Console. A remote attacker could use this flaw to deploy a WAR file of their choosing on the target server, if they are able to trick a user, who is logged into the JMX Console as the admin user, into visiting a...

Denial Of Service (DoS)

JBoss Remoting is vulnerable to denial of service. A remote attacker could use specially-crafted input to cause the JBoss Remoting listeners to become unresponsive, resulting in a denial of service condition for services communicating via JBoss Remoting sockets...

Remote Code Execution (RCE)

JBoss is vulnerable to remote code execution RCE. The vulnerablitiy exists because it allows the embedding of class files, allowing remote attackers to execute arbitrary code via a crafted static initializer...

Arbitrary Code Execution

jboss-seam2 is vulnerable to arbitrary code execution. The vulnerability exists as an input sanitization flaw was found in the way JBoss Seam processed certain parametrized JBoss Expression Language EL expressions. A remote attacker could use this flaw to execute arbitrary code via a URL,...

Information Disclosure

jboss AS web console is vulnerable to information disclosure. Unauthenticated access to the JBoss Application Server Web Console /web-console is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this fla...

Information Disclosure

jboss EAP is vulnerable to information disclosure. The RHSA-2008:0826 update fixed an issue CVE-2008-3273 where unauthenticated users were able to access the status servlet; however, a bug fix included in the RHSA-2009:0347 update re-introduced the issue. A remote attacker could use this flaw to...

Information Disclosure

jboss is vulnerable to information disclosure. The vulnerability exists as JMX password was logged in plain text to "twiddle.log"...

Cross-site Scripting (XSS)

jboss is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could use these flaws to present misleading data to an authenticated user, or execute arbitrary scripting code in the context of the authenticated user's browser session...

Arbitrary Code Execution

jboss is vulnerable to arbitrary code execution. The vulnerability exists through an XSS flaw was found in the JMX Console. An attacker could use this flaw to present misleading data to an authenticated user, or execute arbitrary scripting code in the context of the authenticated user's browser...

Information Disclosure

JBoss EAP is vulnerable to Information Disclosure. Authenticated users were able to access the status servlet, which could allow remote attackers to acquire details about deployed web contexts...

Information Disclosure

jboss-seam is vulnerable to information disclosure. The vulnerability exists as the property that controls the download of server classes was set to "true" in the "production" configuration. When the class download service is bound to an external interface, a remote attacker was able to download...

Moderate: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update

Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of...