Project Woodstock 404 Error Page UTF-7 Encoded XSS

The remote web server contains a web application built using Woodstock components, which are user interface components for the web- based on Java Server Faces and AJAX. Woodstock is part of Sun Glassfish Enterprise Server and can also be used with other Java web containers, such as JBoss, Tomcat,...

JBoss directory traversal

Directory traversal in echo/Echo...

CVE-2009-0027

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

CVE-2009-0027

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

Design/Logic Flaw

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

CVE-2009-0027

CVE-2009-0027 affects JBossWS in JBoss EAP/JBEAP 4.2 (before 4.2.0.CP06) and 4.3 (before 4.3.0.CP04). The vulnerability arises from improper validation of the resource path when serving WSDL files for custom web-service endpoints, allowing remote attackers to read arbitrary XML files with the EAP...

CVE-2009-0027

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP04 update

Updated JBoss Enterprise Application Platform JBoss EAP 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

JBoss EAP unprivileged local xml file access

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP06 update

Updated JBoss Enterprise Application Platform JBoss EAP 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.2.0.CP06. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

JBoss EAP unprivileged local xml file access

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP06 update

Updated JBoss Enterprise Application Platform JBoss EAP 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP06. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

JBoss EAP unprivileged local xml file access

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP04 update

Updated JBoss Enterprise Application Platform JBoss EAP 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

Moderate: Red Hat Security Advisory: Red Hat Application Stack v2.2 security and enhancement update

Red Hat Application Stack v2.2 is now available. This update fixes several security issues and adds various enhancements. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 11th December 2008 This erratum has been updated to correct a typo...

JBoss Enterprise Application Platform类文件信息泄漏漏洞

BUGTRAQ ID: 31300 CVE ID：CVE-2008-3519 CNCVE ID：CNCVE-20083519 JBoss Enterprise Application Platform是一款企业级应用程序平台，用于基于JBoss的应用开发。 JBoss企业级应用平台存在配置错误，远程攻击者可以利用漏洞获得敏感信息。 EAP的JBossAs组件在'production'中设置DownloadServerClasses属性为'true'，而一个产品环境必须默认设置为'false'来防止非EJB类的下载，这可导致信息泄漏。 RedHat JBoss Enterprise...

CVE-2008-3519

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

JBoss EAP < 4.2.0.CP04 / 4.3.0.CP02 Status Servlet Information Disclosure

Binary data 4689.prm...

JBossEAP allows download of non-EJB class files

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

Low: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP04 security update

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix various security issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.2.0.CP04. This update has been rated as having low security impact by the Red Hat Security Response Team. JBoss Enterprise Application...