CVE-2010-0738

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET...

CVE-2010-1429

Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is affected by an information disclosure vulnerability (CVE-2010-1429) in the status servlet that allows remote attackers to obtain details about deployed web contexts, via a full=true query ...

CVE-2010-1428

CVE-2010-1428 affects Red Hat JBoss Enterprise Application Platform (JBEAP) Web Console, where access control was enforced only for GET/POST; other methods allowed unauthorized access to sensitive information. Affected versions are JBEAP 4.2 up to 4.2.0.CP08/4.3 up to 4.3.0.CP07 (per initial desc...

CVE-2010-0738

CVE-2010-0738 affects JBoss AS/JBoss EAP 4.2.x before 4.2.0.CP09 and 4.3.x before 4.3.0.CP08. The JMX-Console performs access control only for GET/POST, allowing remote attackers to send requests via a different method to reach the GET handler. Impact described as an authentication/authorization ...

CVE-2010-1428

The Web Console aka web-console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an...

Default configuration

The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message...

CVE-2010-0524

The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message...

CVE-2010-0524

CVE-2010-0524 affects the FreeRADIUS server in Apple Mac OS X Server prior to 10.6.3. The default configuration permits EAP-TLS authenticated connections based on an arbitrary client certificate, enabling a remote attacker to obtain network connectivity via a crafted RADIUS Access Request. Remedi...

CVE-2010-0524: Undefined Security Weakness

The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message...

CVE-2009-3554

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

CVE-2009-1380

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

Cross site scripting

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

CVE-2009-3554

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

Design/Logic Flaw

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

CVE-2009-2405

Multiple cross-site scripting XSS vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML...

CVE-2009-1380

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

CVE-2009-1380

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

CVE-2009-3554

CVE-2009-3554 affects Red Hat JBoss Enterprise Application Platform (JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07. The flaw arises in the twiddle tool where the JMX password and other command-line arguments are written to twiddle.log, enabling local users to read sensitive information. ...

CVE-2009-1380

CVE-2009-1380 is an XSS in JBoss JMX-Console (JBoss EAP/JBEAP). Affected: JBoss EAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07. Root cause: improper handling of the filter parameter (quotes/colon) in the JMX Console, enabling injection of arbitrary script/HTML. Impact: remote attacker could ...

CVE-2009-2405

CVE-2009-2405 affects Red Hat JBoss Enterprise Application Platform (JBEAP) Web Console. The vulnerability is an XSS in the Web Console that allows remote attackers to inject arbitrary script/HTML via parameters to createSnapshot.jsp (monitorName, objectName, attribute, period) or createThreshold...