CVE-2012-5948

Multiple cross-site scripting XSS vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 WebProcess.srv, 2 the html/en/default/ directory, 3 Widget/resource, 4 birt/frameset, or 5...

CVE-2012-5950

The CVE refers to multiple CSRF vulnerabilities in IBM TRIRIGA Application Platform (2.x and 3.x before 3.3, and 8). The underlying issue enables remote attackers to hijack the authentication of arbitrary users when performing requests that modify data records via two vectors: (1) the html/en/def...

CVE-2012-5948

CVE-2012-5948 covers multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8. The described attack vectors include WebProcess.srv, the html/en/default/ directory, Widget/resource, birt/frameset, and ganttlib/gantt-jws.jnlp. The NVD ent...

CVE-2012-5949

CVE-2012-5949 involves multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform versions 2.x and 3.x before 3.3, and 8. The issues enable remote attackers to inject content and conduct phishing via specific vectors: (1) html/en/default/ directory, (2) birt/frameset,...

PT-2013-1860

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 2.x through 3.x before 3.3 IBM TRIRIGA Application Platform version 8 Description The issue involves multiple cross-site scripting XSS vulnerabilities that allow remote attackers to inject arbitrary we...

CVE-2012-5948: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 WebProcess.srv, 2 the html/en/default/ directory, 3 Widget/resource, 4 birt/frameset, or 5...

CVE-2012-5950: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to hijack the authentication of arbitrary users for requests that modify data records via vectors involving 1 the html/en/default/ directory or 2...

CVE-2012-5949: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to inject content, and conduct phishing attacks, via vectors involving 1 the html/en/default/ directory, 2 birt/frameset, 3 WebProcess.srv, 4...

PT-2013-1861

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 2.x through 3.x before 3.3 IBM TRIRIGA Application Platform version 8 Description The issue allows remote attackers to inject content and conduct phishing attacks via several vectors, including the...

PT-2013-1862

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 2.x through 3.x before 3.3 IBM TRIRIGA Application Platform version 8 Description The issue allows remote attackers to hijack the authentication of arbitrary users for requests that modify data records...

RHEL 5 / 6 : jbossweb (RHSA-2013:0647)

Updated jbossweb packages for JBoss Enterprise Application Platform 6.0.1 that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: apache-cxf security update

An updated apache-cxf package for JBoss Enterprise Application Platform 6.0.1 which fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CV...

Important: Red Hat Security Advisory: apache-cxf security update

An update for the Apache CXF component of JBoss Enterprise Application Platform 6.0.1 which fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring Syste...

CVE-2012-5629

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

CVE-2012-5629

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

CVE-2012-5629: Undefined Security Weakness

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

Moderate: Red Hat Security Advisory: jbossweb security update

An update for JBoss Enterprise Application Platform 5.2.0 which fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, whic...

Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

The NonManagedConnectionFactory in JBoss Enterprise Application Platform EAP 5.1.2 and 5.2.0, Web Platform EWP 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by readi...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0 CP10 security update

An update for the JBoss Web Services component in JBoss Enterprise Application Platform 4.3.0 CP10 which fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

An updated apache-cxf package for JBoss Enterprise Application Platform 5.2.0 that fixes two security issues is now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System...