Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server shipped with Tivoli Integrated Portal

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0. Vulnerability Details CVEID: Not Applicable DESCRIPTION:...

Programmers Who Don't Understand Security Are Poor at Security

A university study confirmed the obvious: if you pay a random bunch of freelance programmers a small amount of money to write security software, they're not going to do a very good job at it. In an experiment that involved 43 programmers hired via the Freelancer.com platform, University of Bonn...

Nuxeo Authentication Bypass and RCE Vulnerabilities

Nuxeo Platform is a cross-platform open source enterprise-class content management system CMS. An authentication bypass and RCE vulnerability exists in Nuxeo. The vulnerability is due to improper handling of facelet templates by the nuxeo-jsf-ui component, when accessing a facelet template does n...

org.esigate:esigate-cas (3.1), org.esigate:esigate-jsf (3.1) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.1)

org.esigate:esigate-core MAVEN version 3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.1 - org.esigate:esigate-jsf 3.1 - org.esigate:esigate-oscache 3.1 -...

org.esigate:esigate-cas (3.2), org.esigate:esigate-jsf (3.2) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.2)

org.esigate:esigate-core MAVEN version 3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.2 - org.esigate:esigate-jsf 3.2 - org.esigate:esigate-oscache 3.2 -...

org.esigate:esigate-cas (3.3), org.esigate:esigate-jsf (3.3) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.3)

org.esigate:esigate-core MAVEN version 3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.3 - org.esigate:esigate-jsf 3.3 - org.esigate:esigate-oscache 3.3 -...

org.esigate:esigate-cas (3.4), org.esigate:esigate-jsf (3.4) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.4)

org.esigate:esigate-core MAVEN version 3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.4 - org.esigate:esigate-jsf 3.4 - org.esigate:esigate-taglib 3.4 -...

org.esigate:esigate-cas (3.4.1), org.esigate:esigate-jsf (3.4.1) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.4.1)

org.esigate:esigate-core MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.4.1 - org.esigate:esigate-jsf 3.4.1 - org.esigate:esigate-taglib 3.4.1 -...

org.esigate:esigate-cas (4.0-beta-1), org.esigate:esigate-jsf (4.0-beta-1) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.0-beta-1)

org.esigate:esigate-core MAVEN version 4.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.0-beta-1 - org.esigate:esigate-jsf 4.0-beta-1 - org.esigate:esigate-taglib...

org.esigate:esigate-cas (4.0-beta-2), org.esigate:esigate-jsf (4.0-beta-2) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.0-beta-2)

org.esigate:esigate-core MAVEN version 4.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.0-beta-2 - org.esigate:esigate-jsf 4.0-beta-2 - org.esigate:esigate-taglib...

org.esigate:esigate-cas (4.0), org.esigate:esigate-distribution (4.0) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.0)

org.esigate:esigate-core MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.0 - org.esigate:esigate-distribution 4.0 - org.esigate:esigate-jsf 4.0 -...

org.esigate:esigate-cas (4.2), org.esigate:esigate-distribution (4.2) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.2)

org.esigate:esigate-core MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.2 - org.esigate:esigate-distribution 4.2 - org.esigate:esigate-jsf 4.2 -...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), org.esigate:esigate-cas (4.4) +5 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.4)

org.esigate:esigate-core MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - de.cezaryrk.olingo:odata-fit 5.0.1-renamed - org.esigate:esigate-cas 4.4 - org.esigate:esigate-distribution 4.4 -...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), org.apache.olingo:odata-fit (>=4.0.0-beta-01-rc01, <=4.0.0-beta-02) +8 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=3.1, <=5.2)

org.esigate:esigate-core MAVEN version =3.1, =4.0.0-beta-01-rc01, =3.1, =4.0, =3.1, =3.1, =5.0-beta-1, =3.1, =4.0-beta-2, =3.1, =4.4 Source cves: CVE-2018-1000854 Source advisory: MEND:CVE-2018-1000854...

Security Bulletin: Code execution vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary The JavaServer Faces JSF application functionality in IBM WebSphere Application Server does not properly handle requests, which allows remote attackers to execute code. IBM WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Informati...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server shipped with Jazz for Service Management

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0, other versions it is not the default. Vulnerability Detail...

Cross-site Scripting (XSS)

webui-jsf is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on request.getRequestURI, allowing arbitrary scripts to be added into the URI and subsequently executed...

net.sourceforge.jsf-comp:acegi-jsf (1.1.3), net.sourceforge.openutils:openutils-usermanagement-dataobjects (2.0) +39 more potentially affected by CVE-2018-1271 via org.springframework:spring-core (1.2.9)

org.springframework:spring-core MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sourceforge.jsf-comp:acegi-jsf 1.1.3 -...

Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Security vulnerabilities have been identified in the WebSphere Application Server where the RAM is deployed

Summary The JavaServer Faces JSF application functionality in IBM WebSphere Application Server does not properly handle requests, which allows remote attackers to execute code. Repeated attacks due to this vulnerability can result in exploiting the WebSphere Application Server. Vulnerability...