CVE-2014-6153

CVE-2014-6153 affects IBM WebSphere Service Registry and Repository (WSRR) across multiple releases (6.3.x–6.3.0.5, 7.0.x–7.0.0.5, 7.5.x–7.5.0.4, 8.0.x before 8.0.0.3, 8.5.x before 8.5.0.1). The Web UI does not set the secure flag on cookies in HTTPS sessions, enabling cookie interception. Remedi...

CVE-2014-6155

IBM WebSphere Service Registry and Repository (WSRR) is affected by CVE-2014-6155: path traversal vulnerabilities in the ServiceRegistry UI that could allow remote authenticated users to read arbitrary files. Affected versions include 7.5.x (up to 7.5.0.4), 8.0.x (up to 8.0.0.3), and 8.5.x (up to...

CVE-2014-6132

Cross-site scripting XSS vulnerability in the Web UI in IBM WebSphere Service Registry and Repository WSRR 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via...

CVE-2014-6187

Multiple cross-site request forgery CSRF vulnerabilities in IBM WebSphere Service Registry and Repository WSRR 6.3.x before 6.3.0.5, 7.0.x before 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.2 allow remote authenticated users to hijack the authentication of unspecified victims via unknow...

CVE-2014-6155

Multiple directory traversal vulnerabilities in the ServiceRegistry UI in IBM WebSphere Service Registry and Repository WSRR 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allow remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2014-6181

Summary : IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 is affected. The root cause is missing access-control checks for contained objects, allowing remote authenticated users to obtain sensitive information via unspecified vectors. Impact : information disclosure with...

CVE-2014-6186

IBM WebSphere Service Registry and Repository WSRR 6.3.x before 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.1 allows remote authenticated users to bypass intended object-access restrictions via the datagraph...

CVE-2014-6153

The Web UI in IBM WebSphere Service Registry and Repository WSRR 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture...

CVE-2014-6180

Cross-site scripting XSS vulnerability in the Web UI in IBM WebSphere Service Registry and Repository WSRR 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the HTTP User-Agent header...

CVE-2014-6179

CVE-2014-6179 is a DOM-based XSS in the Web UI of IBM WebSphere Service Registry and Repository (WSRR). Affected are WSRR 7.5.x before 7.5.0.4 and 8.0.x before 8.0.0.2, enabling remote attackers to inject arbitrary web script or HTML via unspecified vectors. Mitigation is to apply fixes: for 7.5,...

CVE-2014-6177

Affected product: IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0.3. Root cause: Access-control checks are not performed for depth-0 retrieve operations. Impact: Remote authenticated users can obtain sensitive information via unspecified vectors. R...

jboss-as-server: Unchecked access to MSC Service Registry under JSM

In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container MSC service registry without any permission checks. This could allow malicious deployments to modify the internal state of the...

jboss-as-server: Unchecked access to MSC Service Registry under JSM

In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container MSC service registry without any permission checks. This could allow malicious deployments to modify the internal state of the...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 update

Red Hat JBoss BPM Suite 6.0.3, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web UI in IBM WebSphere Service Registry and Repository WSRR 6.2, 6.3 before 6.3.0.6, 7.0 before 7.0.0.6, 7.5 before 7.5.0.5, and 8.0 before 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-3010

This CVE (CVE-2014-3010) is an XSS in the IBM WebSphere Service Registry and Repository (WSRR) Web UI. Affected products/versions include WSRR 6.2; 6.3 up to 6.3.0.6; 7.0 up to 7.0.0.6; 7.5 up to 7.5.0.5; and 8.0 up to 8.0.0.3. The root cause is improper handling of user-controllable input in URL...

CVE-2014-3010

Cross-site scripting XSS vulnerability in the Web UI in IBM WebSphere Service Registry and Repository WSRR 6.2, 6.3 before 6.3.0.6, 7.0 before 7.0.0.6, 7.5 before 7.5.0.5, and 8.0 before 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-0018

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container MSC service registry, which allows local users to modify the server via a crafted deployment...

Design/Logic Flaw

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container MSC service registry, which allows local users to modify the server via a crafted deployment...

CVE-2014-0018

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container MSC service registry, which allows local users to modify the server via a crafted deployment...