Moderate: Red Hat Security Advisory: Red Hat Application Stack v2.1 security and enhancement update

Red Hat Application Stack v2.1 is now available. This update fixes various security issues and adds several enhancements. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Red Hat Application Stack is an integrated open source application...

Moderate: Red Hat Security Advisory: Red Hat Application Stack v1.3 security and enhancement update

Red Hat Application Stack v1.3 is now available. This update fixes a security issue and adds several enhancements. This updated has been rated as having moderate security impact by the Red Hat Security Response Team. The Red Hat Application Stack is an integrated open source application stack, an...

EJBQL injection via 'order' parameter

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP02 security update

Updated JBoss Enterprise Application Platform JBEAP packages that fix several security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application Platform JBEAP is a middleware platform for Java 2...

EJBQL injection via 'order' parameter

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP02 security update

New JBoss Enterprise Application Platform JBEAP packages, comprising the 4.2.0.CP02 release, are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBEAP is a middleware platform for Java 2 Platform,...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform security update

Updated JBoss Enterprise Application Platform packages that fix several security issues and bugs are now available for Red Hat Application Stack v1 and v2. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBEAP is a middleware platform for Java ...

CVE-2007-6433

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

Design/Logic Flaw

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

CVE-2007-6433

CVE-2007-6433 affects JBoss Seam 2.x before 2.0.0.CR3. The vulnerability resides in getRenderedEjbql / setOrder in the org.jboss.seam.framework.Query class, where user-supplied order parameters are not properly validated, allowing remote attackers to inject and execute arbitrary EJB QL commands. ...

JBoss Seam order参数远程SQL注入漏洞

BUGTRAQ ID: 26850 JBoss Seam是一个Java EE5框架，把JSF与EJB3.0组件合并在一起，从而为开发基于Web的企业应用程序提供一个最新的模式。 JBoss Seam在处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。 JBoss Seam的org.jboss.seam.framework.Query类中没有正确地验证传送给getRenderedEjbql方式的order参数便将其用于创建EJBQL查询： if getOrder!=null builder.append" order by ".append getOrder ...

JBoss HSQLDB component remote command injection

Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to 1 TCP port 1701 in JBoss 3.2.1, a...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform security update

Updated JBoss Enterprise Application Platform packages that fix several security issues and bugs are now available for Red Hat Application Stack v1 and v2. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The updated packages address the followi...

openSUSE 10 Security Update : jboss (jboss-2309)

This update fixes a problem in the JBOSS server where it was possible to potentially execute code if the console manager was enabled. CVE-2006-5750 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

CVE-2007-1354

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

Race condition

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

CVE-2007-1354

CVE-2007-1354 affects JBoss Application Server’s JMX Console (JBoss AS 4.0.2 and 4.0.5 before 20070416). The flaw is in JMXOpsAccessControlFilter, which stores the current user’s roles in a member variable, enabling a race condition where a remote authenticated administrator could log in during a...

CVE-2007-1354

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

Low: Red Hat Security Advisory: JBoss Application Server security update

Updated versions of JBoss Application Server that fix a security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The JBoss Application Server is a powerful J2EE application server. A flaw was found in the JMX Console...

security flaw

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...