CVE-2018-12533

CVE-2018-12533 affects Red Hat JBoss RichFaces 3.1.0–3.3.4, enabling unauthenticated attackers to inject EL expressions and execute arbitrary Java code via a /DATA/ path substring in a request containing a org.richfaces.renderkit.html.Paint2DResource$ImageData object (RF-14310). Public detail in ...

RichFaces: remote denial of service via memory exhaustion

It was found that certain malformed requests caused RichFaces to leak memory. A remote, unauthenticated attacker could use this flaw to send a large number of malformed requests to a RichFaces application that uses the Atmosphere framework, leading to a denial of service excessive memory...

Important: Red Hat Security Advisory: Red Hat JBoss Portal 6.2.0 update

Red Hat JBoss Portal 6.2.0, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

JBoss RichFaces vulnerable to remote Java code execution

Overview JBoss RichFaces contains a remote Java code execution vulnerability. JBoss RichFaces is an Ajax-enabled component library for JavaServer Faces JSF. JBoss RichFaces contains a flaw in parsing the do parameter, which may result in arbitrary Java code execution. Takeshi Terada of Mitsui...

JVN#56297719: JBoss RichFaces vulnerable to remote Java code execution

JBoss RichFaces is an Ajax-enabled component library for JavaServer Faces JSF. JBoss RichFaces contains a flaw in parsing the do parameter, which may result in arbitrary Java code execution. Impact When a specially crafted input is processed, arbitrary Java code may be executed on the application...

JBoss RichFaces Arbitrary Code Execution Vulnerability

JBoss RichFaces is a Web framework with Ajax and JSF features . JBoss RichFaces handles do parameters with a security vulnerability that allows attackers to inject EL expressions and execute arbitrary java code...

Design/Logic Flaw

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language EL expressions and execute arbitrary Java code via the do parameter...

CVE-2015-0279

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language EL expressions and execute arbitrary Java code via the do parameter...

CVE-2015-0279

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language EL expressions and execute arbitrary Java code via the do parameter...

CVE-2015-0279

CVE-2015-0279 affects JBoss RichFaces prior to 4.5.4. A flaw in parsing the HTTP request parameter named the do parameter allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code on the server. This is described as a reverse-engineered EL injection th...

Important: Red Hat Security Advisory: Red Hat JBoss Web Framework Kit 2.7.0 security update

An update for the RichFaces component of Red Hat JBoss Web Framework Kit 2.7.0 that fixes one security issue is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score...

RichFaces: Remote Command Execution via insufficient EL parameter sanitization

It was found that the 'do' parameter permitted expression language EL injection, which could allow a remote attacker to execute Java methods on an affected server...

Cross site scripting

Cross-site scripting XSS vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which is not properly handled in a CSS file...

CVE-2014-7852

Cross-site scripting XSS vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which is not properly handled in a CSS file...

CVE-2014-7852

The CVE-2014-7852 issue is a cross-site scripting (XSS) vulnerability in JBoss RichFaces used by Red Hat JBoss Portal 6.1.1, where RichFaces accepted arbitrary strings in a URL and returned them unencoded in a CSS file. The Red Hat advisory RHSA-2014:1973 documents that this could enable an attac...

RichFaces: Cross-site scripting due to incomplete URL sanitization

It was found that RichFaces accepted arbitrary strings included in a URL and returned them unencoded in a CSS file. A remote attacker could use this flaw to perform cross-site scripting XSS attacks against a user running a RichFaces application...

Moderate: Red Hat Security Advisory: Red Hat JBoss Portal 6.1.1 security update

An update for the RichFaces component in Red Hat JBoss Portal 6.1.1, which resolves one security issue, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, whic...

RHEL 5 / 6 : richfaces (RHSA-2013:1043)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1043 advisory. RichFaces is an open source framework that adds Ajax capability into existing JavaServer Faces JSF applications. A flaw was found in the way...

CVE-2014-0086

The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service memory consumption and out-of-memory error via a large number of malformed atmosphere push requests...

Design/Logic Flaw

The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service memory consumption and out-of-memory error via a large number of malformed atmosphere push requests...