CVE-2014-4836

Cross-site scripting XSS vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

PT-2014-6157

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2 through 3.3 before 3.3.0.2 IBM TRIRIGA Application Platform versions 3.3.1 before 3.3.1.3 IBM TRIRIGA Application Platform versions 3.3.2 before 3.3.2.2 IBM TRIRIGA Application Platform versions 3....

PT-2014-6154

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2 through 3.3 before 3.3.0.2 IBM TRIRIGA Application Platform version 3.3.1 before 3.3.1.3 IBM TRIRIGA Application Platform version 3.3.2 before 3.3.2.2 IBM TRIRIGA Application Platform version 3.4...

PT-2014-6153

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2 through 3.3 before 3.3.0.2 IBM TRIRIGA Application Platform version 3.3.1 before 3.3.1.3 IBM TRIRIGA Application Platform version 3.3.2 before 3.3.2.2 IBM TRIRIGA Application Platform version 3.4...

PT-2014-6155

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2 through 3.3 before 3.3.0.2 IBM TRIRIGA Application Platform versions 3.3.1 before 3.3.1.3 IBM TRIRIGA Application Platform versions 3.3.2 before 3.3.2.2 IBM TRIRIGA Application Platform versions 3....

CVE-2014-4838: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4837: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4840: Improper Input Validation

IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL...

CVE-2014-4836: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Twiki Perl Code Execution

This is an advisory for TWiki administrators: The debugenableplugins request parameter allows arbitrary Perl code execution. TWiki http://twiki.org is an Open Source Enterprise Wiki and Web Application Platform used by millions of people. Vulnerable Software Version Attack Vectors Impact Severity...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.1 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security impact. A Common...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.1 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.1 and fix one security issue, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Low security impact. A Common...

CVE-2014-3464

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

Input validation

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

Design/Logic Flaw

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3464

CVE-2014-3464 affects Red Hat JBossWS used in JBoss EAP 6.2.0 and 6.3.0. The EJB invocation handler fails to enforce method-level restrictions for outbound messages, allowing remote authenticated users to access restricted JAX-WS handlers via permissions to the EJB class. This stems from an incom...

CVE-2014-3490

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...