Authorization

Red Hat JBoss Enterprise Application Platform EAP before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control...

CVE-2012-4572

Red Hat JBoss Enterprise Application Platform EAP before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control...

CVE-2013-2186

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

CVE-2012-4572

Red Hat JBoss Enterprise Application Platform EAP before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control...

CVE-2012-4529

CVE-2012-4529 affects Red Hat JBoss Web 7.1.x and earlier when COOKIE session tracking is used, where org.apache.catalina.connector.Response.encodeURL() may append jsessionid to the first response URL, enabling session hijacking via MITM or log exposure. Connected advisories indicate Red Hat JBos...

CVE-2013-2102

CVE-2013-2102 affects Red Hat JBoss Portal 6.1.0 and earlier: when a JGroups channel starts, the JGroups diagnostics service is enabled by default with no authentication, allowing remote attackers to read diagnostics information. Red Hat released RHSA-2013:1437 with a 6.1.0 update to address this...

CVE-2012-4572

CVE-2012-4572 affects Red Hat JBoss EAP prior to 6.1.0 and JBoss Portal prior to 6.1.0. The issue arises when multiple applications load the same custom authorization module class name; the first loaded implementation may be used for all apps, allowing a local attacker to influence authorization ...

CVE-2012-4529

The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id 1 via a man-in-the-middle attack ...

CVE-2013-2102

The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information diagnostics by accessing the service...

CVE-2013-2186

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

CVE-2013-2186

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

PT-2013-1117 · Red Hat +3 · Red Hat Jboss Brms +5

Name of the Vulnerable Software and Affected Versions: Apache Commons FileUpload versions affected versions not specified Red Hat JBoss BRMS version 5.3.1 Red Hat JBoss Portal versions 4.3 CP07, 5.2.2, and 6.0.0 Red Hat JBoss Web Server version 1.0.2 Description: The issue affects the DiskFileIte...

Symantec Workspace Streaming 7.5.0.493 Rmote Code Execution

Symantec Workspace Streaming version 7.5.0.493 suffers from a SWS streamlet engine invoker servlets remote code execution vulnerability. Proof of concept code included. Symantec Workspace Streaming 7.5.0.493 SWS Streamlet Engine Invoker Servlets Remote Code Execution tested against: Microsoft...

Symantec Workspace Streaming 7.5.0.493 Rmote Code Execution

Symantec Workspace Streaming 7.5.0.493 SWS Streamlet Engine Invoker Servlets Remote Code Execution tested against: Microsoft Windows Server 2008 R2 sp1 download url: http://www.symantec.com/it/it/products-solutions/trialware/ file tested: SymantecWorkspaceStreaming7.5.0.493.zip vulnerability: the...

CVE-2013-4293

The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...

Design/Logic Flaw

The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network JON 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files...

Design/Logic Flaw

The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...

CVE-2013-4373

Red Hat JBoss Operations Network 3.1.2 is affected by CVE-2013-4373. The vulnerability is in JPADriftServerBean.storeFiles, which creates a predictable temporary directory when unpacking a zip file, allowing a local attacker to place their own drift files into the server. Impact is local, enablin...

CVE-2013-4293

The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...

CVE-2013-4293

CVE-2013-4293 affects Red Hat JBoss Operations Network (JON) 3.1.2. The server stores passwords in plaintext in log files, enabling a local attacker with log access to obtain sensitive credentials. This is a local, file-based disclosure vulnerability. The Red Hat advisory RHSA-2013:1448 notes a s...