CVE-2014-8893

Multiple cross-site scripting XSS vulnerabilities in 1 mainpage.jsp and 2 GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-8894

IBM TRIRIGA Application Platform contains an open redirect vulnerability (CVE-2014-8894) that affects versions 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1, exploitable through the out parameter to redirect to arbitrary sites. The IBM Security Bulletin recommends upgrading to TRIRIGA 3...

CVE-2014-8894

Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter...

CVE-2014-8895

IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL...

CVE-2014-8894: Undefined Security Weakness

Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter...

CVE-2014-8893: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 mainpage.jsp and 2 GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

PT-2015-4113

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2.1.x through 3.3.2 before 3.3.2.3 IBM TRIRIGA Application Platform version 3.4.1 before 3.4.1.1 Description The issue allows remote authenticated users to redirect users to arbitrary web sites and...

CVE-2014-8895: Undefined Security Weakness

IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL...

PT-2015-4112

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2.1.x through 3.3.2 before 3.3.2.3 IBM TRIRIGA Application Platform versions 3.4.1 before 3.4.1.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the mainpage.jsp...

PT-2015-4114

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2.1.x through 3.3.2 before 3.3.2.3 IBM TRIRIGA Application Platform versions 3.4.1 before 3.4.1.1 Description The issue allows remote attackers to bypass intended access restrictions and read the ima...

TWiki 6.0.0 / 6.0.1 WebSearch Cross Site Scripting

This is an advisory for TWiki Administrators: A specially crafted URL parameter to the WebSearch topic may expose a cross-site scripting vulnerability. TWiki http://twiki.org is an Open Source Enterprise Wiki and Web Application Platform used by millions of people. Vulnerable Software Version...

CVE-2014-0059: Exposure of Sensitive Information to an Unauthorized Actor

JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform EAP before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file...

PT-2014-3456

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP versions prior to 6.2.3 Description The issue allows local users to obtain sensitive information by reading the audit.log file due to world-readable permissions. Recommendations For versions...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

CVE-2014-4839

CVE-2014-4839 describes a cross-site request forgery (CSRF) in the birtviewer.query component of IBM TRIRIGA Application Platform (versions 3.2, 3.3 up to 3.3.0.2; 3.3.1 up to 3.3.1.3; 3.3.2 up to 3.3.2.2; 3.4 up to 3.4.0.1). The vulnerability allows remote authenticated users to hijack the authe...

PT-2014-6156

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2 through 3.3 before 3.3.0.2 IBM TRIRIGA Application Platform versions 3.3.1 before 3.3.1.3 IBM TRIRIGA Application Platform versions 3.3.2 before 3.3.2.2 IBM TRIRIGA Application Platform versions 3....

CVE-2014-4839: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

CVE-2014-4837

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4838

Cross-site scripting XSS vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...