Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 security update

Updated Red Hat JBoss Enterprise Application Platform 6.2.2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base...

CVE-2014-0093

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.2, when using a Java Security Manager JSM, does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access...

Design/Logic Flaw

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.2, when using a Java Security Manager JSM, does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access...

CVE-2014-0093: Undefined Security Weakness

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.2, when using a Java Security Manager JSM, does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access...

PT-2014-3475

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform JBEAP version 6.2.2 Description The issue is related to the improper application of permissions defined by a policy file when using a Java Security Manager JSM. This causes applications to be grant...

PT-2014-3455

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP versions 6.x before 6.2.1 Description The security audit functionality logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files...

CVE-2014-0058: Undefined Security Weakness

The security audit functionality in Red Hat JBoss Enterprise Application Platform EAP 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files...

RHEL 5 / 6 : JBoss EAP (RHSA-2014:0204)

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score,...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score,...

PT-2014-3434

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform JBEAP version 6.2.0 JBoss WildFly Application Server affected versions not specified Description The issue arises when the software is run under a security manager, as it fails to properly restrict...

RHEL 5 : JBoss EAP (RHSA-2014:0170)

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.1 and fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact...

CVE-2014-0018: Undefined Security Weakness

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container MSC service registry, which allows local users to modify the server via a crafted deployment...

CVE-2011-4610

CVE-2011-4610 affects JBoss Web (used in Red Hat JBoss Communications Platform, Enterprise Web Platform, and Enterprise Application Platform) where a crafted UTF-8 surrogate pair at the boundary of an internal buffer can cause a denial of service (infinite loop). Connected advisories note Red Hat...

CVE-2011-4610: Improper Restriction of Operations within the Bounds of a Memory Buffer

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...

CVE-2012-3427

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

CVE-2012-3427: Undefined Security Weakness

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

PT-2014-2269

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform EAP version 5.1.2 Description The issue allows local users to read sensitive information, including Amazon Web Services AWS credentials, by accessing files in the /var/cache/jboss-ec2-eap/ directory due to...

Adobe ColdFusion Unsupported Version Detection

According to its version, the installation of Adobe ColdFusion running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. %NASLMINLEVEL 70300...

Design/Logic Flaw

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar iss...

CVE-2013-2185

CVE-2013-2185 involves DiskFileItem in Apache Commons FileUpload used with Red Hat JBoss EAP 6.1.0 and JBoss Portal 6.0.0. The issue stems from deserialization of a serialized DiskFileItem where a NULL byte in a filename can let a remote attacker write to arbitrary files. The description notes a ...