Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP06 update

Updated JBoss Enterprise Application Platform JBoss EAP 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP06. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

JBoss EAP unprivileged local xml file access

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP04 update

Updated JBoss Enterprise Application Platform JBoss EAP 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

Moderate: Red Hat Security Advisory: Red Hat Application Stack v2.2 security and enhancement update

Red Hat Application Stack v2.2 is now available. This update fixes several security issues and adds various enhancements. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 11th December 2008 This erratum has been updated to correct a typo...

JBoss Enterprise Application Platform类文件信息泄漏漏洞

BUGTRAQ ID: 31300 CVE ID：CVE-2008-3519 CNCVE ID：CNCVE-20083519 JBoss Enterprise Application Platform是一款企业级应用程序平台，用于基于JBoss的应用开发。 JBoss企业级应用平台存在配置错误，远程攻击者可以利用漏洞获得敏感信息。 EAP的JBossAs组件在'production'中设置DownloadServerClasses属性为'true'，而一个产品环境必须默认设置为'false'来防止非EJB类的下载，这可导致信息泄漏。 RedHat JBoss Enterprise...

CVE-2008-3519

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

CVE-2008-3519: Undefined Security Weakness

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

JBoss EAP < 4.2.0.CP04 / 4.3.0.CP02 Status Servlet Information Disclosure

Binary data 4689.prm...

JBossEAP allows download of non-EJB class files

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

Low: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP04 security update

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix various security issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.2.0.CP04. This update has been rated as having low security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

JBossEAP allows download of non-EJB class files

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

Low: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP02 security update

Updated JBoss Enterprise Application Platform JBEAP 4.3 packages that fix various security issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.3.0.CP02. This update has been rated as having low security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

JBossEAP allows download of non-EJB class files

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

Low: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP04 security update

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix various security issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP04. This update has been rated as having low security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

JBoss EAP < 4.2.0.CP03 / 4.3.0.CP01 Status Servlet Information Disclosure

Binary data 4623.prm...

JBoss Enterprise Application Platform (EAP) Status Servlet Request Remote Information Disclosure

The version of JBoss Enterprise Application Platform EAP running on the remote host allows unauthenticated access to a status servlet, which is used to monitor sessions and requests sent to the server. This vulnerability CVE-2008-3273 was fixed in versions 4.2.0.CP03 and 4.3.0.CP01, but was later...

CVE-2008-3273

JBoss Enterprise Application Platform aka JBossEAP or EAP before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string...

CVE-2008-3273

JBoss Enterprise Application Platform aka JBossEAP or EAP before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string...

Input validation

JBoss Enterprise Application Platform aka JBossEAP or EAP before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string...

CVE-2008-3273

JBoss Enterprise Application Platform aka JBossEAP or EAP before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string...