CVE-2019-3872

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks...

CVE-2019-3872

CVE-2019-3872 affects Picketlink components shipped with Red Hat/JBoss EAP 7.1.x and 7.2.x. A SAMLRequest containing a script could be processed by Picketlink, enabling cross-site scripting (XSS) and potential unauthorized information disclosure or follow-up attacks. Publicly provided connected d...

CVE-2019-3873

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks...

CVE-2019-3872: Improper Neutralization of Input During Web Page Generation

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks...

CVE-2019-3873: Improper Neutralization of Input During Web Page Generation

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 6 (RHSA-2019:1419)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1419 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 7 (RHSA-2019:1420)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1420 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 8 (RHSA-2019:1421)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1421 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red...

RHEL 7 : OpenShift Container Platform 3.11 atomic-openshift-web-console (RHSA-2019:1422)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1422 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

picketlink: URL injection via xinclude parameter

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks...

picketlink: reflected XSS in SAMLRequest via RelayState parameter

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks...

PT-2019-5650

Name of the Vulnerable Software and Affected Versions Jboss Application Platform versions 7.1.x through 7.2.x Description A security issue was discovered where a SAMLRequest containing a script could be processed, allowing an attacker to send a malicious script and achieve cross-site scripting...

PT-2019-5651

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform version 7.2 Description The issue exists due to inadequate protection of the web page structure in the Picketlink component. This could allow a remote attacker to perform cross-site scripting attacks. An...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.22 (RHSA-2019:1161)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1161 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

CVE-2019-4207

IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks against the system. IBM X-Force ID: 159148...

Information disclosure

IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks against the system. IBM X-Force ID: 159148...

Information disclosure

IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the system. IBM X-Force ID: 155146...

CVE-2018-2008

IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the system. IBM X-Force ID: 155146...

CVE-2019-4207

IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks against the system. IBM X-Force ID: 159148...