EJBQL injection via 'order' parameter

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

Design/Logic Flaw

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

CVE-2007-6433

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

CVE-2007-6433

CVE-2007-6433 affects JBoss Seam 2.x before 2.0.0.CR3. The vulnerability resides in getRenderedEjbql / setOrder in the org.jboss.seam.framework.Query class, where user-supplied order parameters are not properly validated, allowing remote attackers to inject and execute arbitrary EJB QL commands. ...

JBoss Seam order参数远程SQL注入漏洞

BUGTRAQ ID: 26850 JBoss Seam是一个Java EE5框架，把JSF与EJB3.0组件合并在一起，从而为开发基于Web的企业应用程序提供一个最新的模式。 JBoss Seam在处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。 JBoss Seam的org.jboss.seam.framework.Query类中没有正确地验证传送给getRenderedEjbql方式的order参数便将其用于创建EJBQL查询： if getOrder!=null builder.append" order by ".append getOrder ...

Solaris 5.6 (x86) : 112535-03

SEAM 1.0: patch for Solaris 2.6x86. Date this patch was last updated by Sun : Nov/13/03 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security if !...

Solaris 9 (sparc) : 116462-06

SEAM 1.0.2: patch for Solaris 9. Date this patch was last updated by Sun : Apr/03/07 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 5.8 (sparc) : 110060-22

SEAM 1.0.1: patch for Solaris 8. Date this patch was last updated by Sun : Jul/24/07 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Solaris 7 (x86) : 112537-06

SEAM 1.0 Jumbo patch for Solaris 2.7x86. Date this patch was last updated by Sun : Oct/03/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Solaris 6 (sparc) : 112534-03

SEAM 1.0: patch for Solaris 2.6. Date this patch was last updated by Sun : Nov/13/03 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 6 (sparc) : 110057-08

SEAM 1.0: Patch for Solaris 2.6 / 7. Date this patch was last updated by Sun : Jun/10/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

Solaris 5.8 (x86) : 110061-22

SEAM 1.0.1x86: patch for Solaris 8x86. Date this patch was last updated by Sun : Jul/27/07 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security if !...

Solaris 7 (sparc) : 112536-06

SEAM 1.0 Jumbo patch for Solaris 2.7. Date this patch was last updated by Sun : Oct/03/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

[SA16060] Sun Solaris / SEAM Kerberos KDC Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...