CVE-2015-5220

CVE-2015-5220 affects Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.4.4, and WildFly, where the Web Console could cause memory exhaustion (DoS) by processing a large request header. The root cause is improper handling of large HTTP headers in the EAP Web Console. The published ...

CVE-2015-5220: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Web Console in Red Hat Enterprise Application Platform EAP before 6.4.4 and WildFly formerly JBoss Application Server allows remote attackers to cause a denial of service memory consumption via a large request header...

CVE-2015-5188: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

CVE-2015-5178: Undefined Security Weakness

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2...

PT-2015-2598 · Red Hat · Red Hat Jboss Enterprise Application Platform +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Application Platform versions prior to 6.4.4 WildFly formerly JBoss Application Server versions prior to 6.4.4 Description: The issue is related to the Management Console in Red Hat Enterprise Application Platform and...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...

Microsoft repair SharePoint 2 0 1 3 XSS vulnerabilities-the vulnerabilities and early warning-the black bar safety net

SharePoint is the Microsoft Office Suite in a tool for individuals and companies to create a portal page. The vulnerabilityCVE-2 0 1 5-2 5 2 2by FortiNet's FortiGuard Labs security researchers discovered the vulnerability affects SharePoint 2 0 1 3 15.0.4571.1502 early version. SharePoint is a...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

An updated Red Hat JBoss Enterprise Application Platform 6.4.3 package that fixes a security issue, several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss...

EAP: LDAP bind password is being logged with TRACE log level

AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform EAP before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled...

Low: Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update

Update that provide Red Hat JBoss Enterprise Application Platform 6.4.1 and fix several bugs, and add various enhancements are now available. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replaceme...

EAP: LDAP bind password is being logged with TRACE log level

AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform EAP before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled...

Low: Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update on RHEL 7

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.1 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application...

Low: Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update on RHEL 6

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.1 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application...

Low: Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update on RHEL 5

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.1, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server...

EAP: LDAP bind password is being logged with TRACE log level

AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform EAP before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled...

Low: Red Hat Bug Fix Advisory: jboss-ec2-eap enhancement update for EAP 6.4.1

Updated jboss-ec2-eap packages that add an enhancement are now available for Red Hat JBoss Enterprise Application Platform 6.4.1 on Red Hat Enterprise Linux 6. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java EE applications. It is based on JBoss Application Server 7 and...

CVE-2014-3586

The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly formerly JBoss Application Server uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2014-3586

The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly formerly JBoss Application Server uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2014-3586

The CVE affects Red Hat JBoss Enterprise Application Platform 6.x (and WildFly) where the default CLI history file, .jboss-cli-history, uses weak permissions. This enables a local attacker to read sensitive information from the history file. The issue is addressed in Red Hat security advisories f...