XML External Entity (XXE)

picketlink-federation is vulnerable to XML External Entity XXE attacks. The vulnerability exists as the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references...

RHEL 5 / 6 : JBoss Enterprise Application Platform 5.2.0 (RHSA-2018:3517)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3517 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch ...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.5 on RHEL 6 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Security Bulletin: IBM TRIRIGA Application Platform Apache CXF Vulnerability (CVE-2018-8039)

Summary IBM TRIRIGA has addressed the following vulnerability. Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly with com.sun.net.ssl interface. An attacker could exploit this vulnerability to launch a...

CVE-2016-7066

The body of evidence links CVE-2016-7066 to Red Hat JBoss EAP 7.x before 7.1.0, where improper default permissions on /tmp/auth enable any local user to connect to the CLI and perform arbitrary operations. The issue stems from insecure /tmp/auth permissions, allowing local privilege escalation vi...

PT-2018-4972

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions prior to 7.1.0 Description The issue arises from improper default permissions on the /tmp/auth directory, allowing any local user to connect to the CLI and execute arbitrary operations...

CVE-2016-7066: Incorrect Privilege Assignment

It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to connect to CLI and allow the user to execute any arbitrary operations...

CVE-2016-7061

An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information...

Information disclosure

An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information...

CVE-2016-7061: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information...

PT-2018-4971

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions prior to 7.0.4 Description An information disclosure issue was discovered in the configuration of RBAC, where users with a Monitor role can view sensitive information marked as such. Recommendatio...

RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2017:1412)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1412 advisory. The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services AWS...

RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2016:1840)

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 and Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.3 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Security Bulletin: IBM TRIRIGA Application Platform Reports Privilege Escalation (CVE-2017-1373)

Summary IBM TRIRIGA Application Platform Reports are vulnerable to a privilege escalation attack. Vulnerability Details CVEID: CVE-2017-1373 DESCRIPTION: Reports executed in the IBM TRIRIGA Application platform contains a vulnerability that could allow an authenticated user to execute a report th...

Security Bulletin: IBM TRIRIGA Document Manager Privilege Escalation (CVE-2017-1180)

Summary IBM TRIRIGA Document Manager is vulnerable to a privilege escalation attack. Vulnerability Details CVEID: CVE-2017-1180 DESCRIPTION: The IBM TRIRIGA Document Manager contains a vulnerability that could allow an authenticated user to execute actions they did not have access to. CVSS Base...

Security Bulletin: IBM TRIRIGA Application Platform Cross Site Scripting Vulnerability (CVE-2016-0344)

Summary The IBM TRIRIGA Application Platform is vulnerable to a cross site scripting attack within My Reports. Vulnerability Details CVEID: CVE-2016-0344 CVSS Base Score: 5.4 CVSS Temporal Score: See for the current score CVSS Environmental Score: Undefined CVSS Vector:...

Security Bulletin: IBM TRIRIGA Application Platform Information disclosure (CVE-2016-0345)

Summary The IBM TRIRIGA Application Platform no longer discloses server file path information when Birt reports are rendered. Vulnerability Details CVEID: CVE-2016-0345 CVSS Base Score: 4.3 CVSS Temporal Score: See for the current score CVSS Environmental Score: Undefined CVSS Vector:...

Security Bulletin: IBM TRIRIGA Application Platform Information Disclosure (CVE-2016-0343)

Summary IBM TRIRIGA could allow an authenticated user to obtain sensitive information displayed in error messages. Vulnerability Details CVEID: CVE-2016-0343 DESCRIPTION: IBM TRIRIGA could allow an authenticated user to obtain sensitive information displayed in error messages. CVSS Base Score: 4....

Security Bulletin: Improper Input Validation in IBM TRIRIGA Application Platform (CVE-2016-0300)

Summary The IBM TRIRIGA Application Platform has a security flaw that could grant unauthenticated access into all JSP pages within the application structure under certain circumstances with the right criteria, which may allow for subsequent probing and exploitation. Vulnerability Details CVEID:...