CVE-2015-6524

CVE-2015-6524 affects Apache ActiveMQ 5.x, where the LDAPLoginModule in JAAS allows wildcard operators in usernames. This enables remote attackers to obtain credentials via brute-forcing usernames. The document set explicitly ties this vulnerability to ActiveMQ 5.x prior to 5.10.1 and notes the i...

CVE-2014-3612

CVE-2014-3612 affects Apache ActiveMQ 5.x (JAAS LDAPLoginModule). The vulnerability lets an attacker authenticate with a valid username and an empty password, causing an unauthenticated bind and bypass of authentication. Remediation: upgrade to ActiveMQ 5.10.1 or later (or apply vendor patch) as ...

JAAS: LDAPLoginModule allows empty password authentication

It was found that if a configured LDAP server supported the unauthenticated authentication mechanism as described by RFC 4513, the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service JAAS, would consider an authentication attempt to be successful for...

AIX Java Advisory : java_jan2014_advisory.asc

The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities : - Vulnerabilities in Oracle Java allow a remote attacker to bypass security features through flaws in XML document parsing. CVE-2013-5878, CVE-2013-5910 - An information disclosure flaw...

CentOS Update for java CESA-2014:0097 centos6

Check for the Version of java OpenVAS Vulnerability Test CentOS Update for java CESA-2014:0097 centos6 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS Update for java CESA-2014:0027 centos5

Check for the Version of java OpenVAS Vulnerability Test CentOS Update for java CESA-2014:0027 centos5 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2014:011)

Multiple vulnerabilities has been discovered and corrected in java-1.7.0-openjdk : An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java applicatio...

RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2014:0030)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0030 advisory. Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes...

CVE-2014-0416

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the...

Deserialization of untrusted data

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the...

java security update

CentOS Errata and Security Advisory CESA-2014:0027 Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring Syst...

CVE-2014-0416

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the...

CVE-2014-0416

CVE-2014-0416 is an Oracle Java/JRE/JDK vulnerability involving JAAS deserialization that could allow remote attackers to affect integrity. The connected IBM advisories confirm IBM products (e.g., Rational Insight, RRDI, Tivoli Monitoring/CAM, and other IBM Java SDK deployments) are affected due ...

KLA10511 Multiple vulnerabilities in Oracle products

An unspecified vulnerabilities were found in Oracle products. By exploiting this vulnerability malicious users can affect integrity, confidentiality and availability. This vulnerability can be exploited remotely via an unknown vectors related to 2D, Beans, CORBA, Deployment, Hotspot, Install, JAA...

CVE-2014-0416

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the...

Oracle Java SE Multiple Vulnerabilities (January 2014 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is earlier than 7 Update 51, 6 Update 71, or 5 Update 61. It is, therefore, potentially affected by security issues in the following components : - 2D - Beans - CORBA - Deployment - Hotspot - Install - JA...

CVE-2008-7274

IBM WebSphere Application Server WAS 6.1.0.9, when the JAAS Login functionality is enabled, allows attackers to perform an internal application hashtable login by 1 not providing a password or 2 providing an empty password...

Default credentials

IBM WebSphere Application Server WAS 6.1.0.9, when the JAAS Login functionality is enabled, allows attackers to perform an internal application hashtable login by 1 not providing a password or 2 providing an empty password...

CVE-2008-7274

IBM WebSphere Application Server WAS 6.1.0.9, when the JAAS Login functionality is enabled, allows attackers to perform an internal application hashtable login by 1 not providing a password or 2 providing an empty password...

CVE-2008-7274

CVE-2008-7274 affects IBM WebSphere Application Server 6.1.0.9 when JAAS Login is enabled, allowing an internal hashtable login if a password is omitted or left empty. Impact per sources: authentication bypass with I (partial) integrity impact, network vector, no confidentiality/a‑vailable impact...