CVE-2016-7034

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to 1 bypass CSRF protection mechanisms or 2 conduct cross-site request forgery CSRF attacks by...

CVE-2016-7034

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to 1 bypass CSRF protection mechanisms or 2 conduct cross-site request forgery CSRF attacks by...

CVE-2016-7033

Multiple cross-site scripting XSS vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-6344

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-6344

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-6344

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-7034

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to 1 bypass CSRF protection mechanisms or 2 conduct cross-site request forgery CSRF attacks by...

CVE-2016-7033

Multiple cross-site scripting XSS vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7033

CVE-2016-7033 is a stored XSS flaw in dashbuilder within Red Hat JBoss BPM Suite and JBoss BRMS 6.x. The Red Hat advisory RHSA-2017:0249 states the issue is caused by improper sanitization in dashbuilder, enabling remote, authenticated attackers with dashbuilder access (usually admins) to store s...

CVE-2016-7034

CVE-2016-7034 concerns the dashbuilder component of Red Hat JBoss BPM Suite 6.x, where CSRF tokens generated during an active session are included in query strings. The underlying issue allows bypassing CSRF protections or performing CSRF attacks using old tokens. Red Hat advisories RHSA-2017:055...

CVE-2016-6344

CVE-2016-6344 affects Red Hat JBoss BRMS 6 and Red Hat JBoss BPM Suite 6, where HttpOnly flags are not set on session cookies. This exposes cookies to access via client-side scripts (XSS), enabling potential information disclosure. Red Hat RHSA-2017:0248/0249 documents a security update for BRMS/...

Red Hat JBoss BPMS Cross-Site Request Forgery Vulnerability

Red Hat JBoss BPMS is a business process management platform from Red Hat that combines all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation, and business process monitoring. A cross-site request forgery vulnerability exists in Red Hat JBos...

CVE-2016-7034

It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder. Old tokens generated during an active session can be used to bypass CSRF protection. In addition, the tokens are sent in query string so they can be exposed through the browser's history, referrers, web...

CVE-2016-7033

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via dashbuilder. Remote, authenticated attackers that have privileges to access dashbuilder usually admins can store scripts in several editable fields, which are not properly sanitized before showing to other users, including other admi...

Red Hat JBoss Operations Network Remote Elevation of Privilege Vulnerability

Red Hat JBoss Operations Network is a J2EE-based open source application server that deploys, manages, and monitors JBoss enterprise middleware, applications, and services. A remote elevation of privilege vulnerability exists in Red Hat JBoss Operations Network, which could be exploited by an...

Red Hat JBoss BPMS Information Disclosure Vulnerability

Red Hat JBoss BPMS is a business process management platform from Red Hat that combines all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation, and business process monitoring. A remote information disclosure vulnerability exists in Red Hat...

CVE-2016-5422

It was found that JBoss Operations Network allowed regular users to add a new super user by sending a specially crafted request to the web console. This attacks allows escalation of privileges...

JON3: privilege escalation via improper authorization

It was found that JBoss Operations Network allowed regular users to add a new super user by sending a specially crafted request to the web console. This attacks allows escalation of privileges...

Moderate: Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.7 security and bug fix update

An update is now available for Red Hat JBoss Operations Network. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...