Design/Logic Flaw

Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running...

CVE-2021-40684

CVE-2021-40684 affects Talend ESB Runtime across versions 5.1–7.3.1-R2021-09, 7.2.1-R2021-09, and 7.1.1-R2021-09, due to an unauthenticated Jolokia HTTP endpoint that exposes the container’s JMX. This endpoint enables remote read/write access to the runtime/container and could allow an attacker t...

CVE-2021-40684

Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running...

Talend ESB 授权问题漏洞

Talend ESB is a reliable and scalable Enterprise Service Bus ESB from Talend, Inc. that enables development teams to manage integration projects in a holistic manner, combining application and data management integration in complex heterogeneous computing environments. A security vulnerability...

ALEA-2020:1718 jolokia-jvm-agent bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

jolokia-jvm-agent bug fix and enhancement update

An update is available for jolokia-jvm-agent. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

jolokia-jvm-agent bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

CVE-2019-12124

An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arbitrary file. All APPC setups are affected...

Design/Logic Flaw

An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arbitrary file. All APPC setups are affected...

CVE-2019-12124

ONAP APPC (pre-Dublin) is affected by CVE-2019-12124. An exposed unprotected Jolokia interface allows an unauthenticated attacker to read or overwrite an arbitrary file, affecting all APPC deployments. The connected sources confirm the root cause as an exposed Jolokia interface without authentica...

CVE-2018-10899

A flaw was found in Jolokia, versions 1.2 through 1.6.0, where Jolokia did not correctly handle checking for origin and referrer headers when strict checking was enabled. An attacker could use this vulnerability to conduct cross-site request forgery or further attacks...

Mail.ru: JMX RMI command injection on 195.211.131.82(Mail.ru Gaming)

Externally available Jolokia interface in Mail.Ru Gaming network allowed JMX RMI commands injection Сommand injection in Jolokia JMX. Reading the docs helps. A lot. Also, having good friends who can help you when you need it:...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R13 security and bug fix update

An update is now available for Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

jolokia: system-wide CSRF that could lead to Remote Code Execution

A flaw was found in Jolokia, versions 1.2 through 1.6.0, where Jolokia did not correctly handle checking for origin and referrer headers when strict checking was enabled. An attacker could use this vulnerability to conduct cross-site request forgery or further attacks...

jolokia: system-wide CSRF that could lead to Remote Code Execution

A flaw was found in Jolokia, versions 1.2 through 1.6.0, where Jolokia did not correctly handle checking for origin and referrer headers when strict checking was enabled. An attacker could use this vulnerability to conduct cross-site request forgery or further attacks...

Important: Red Hat Security Advisory: Red Hat Fuse 7.4.0 security update

A minor version update from 7.3 to 7.4 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

Jolokia Cross-Site Request Forgery Vulnerability (CNVD-2019-26164)

Jolokia is a use of JSON via Http to achieve JMX remote management of open source projects , it provides JMX batch operation , security policies and so on. A cross-site request forgery vulnerability exists in Jolokia versions 1.2.0 through 1.6.0. The vulnerability stems from a WEB application tha...

Cross-site Request Forgery (CSRF)

jolokia is vulnerable to cross-site request forgery CSRF. The backend manager does not properly handle the strict checking for origin and referrer header, causing a system-wide CSRF which subsequently allows a remote code execution...

CVE-2018-10899

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack...

CVE-2018-10899

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack...