Remote Unauthenticated Bug Haunts Cisco ACS Server

There is a critical remotely exploitable vulnerability in Cisco’s Secure Access Control Server which allows a remote attacker to take complete control of a vulnerable server. The bug results from a bad implementation of the EAP-FAST protocol and it affects a number of versions of the Cisco ACS. T...

Cisco Secure Access Control Server Remote Command Execution Vulnerability

A vulnerability in the EAP-FAST authentication module of Cisco Secure Access Control Server ACS versions 4.0 through 4.2.1.15 could allow an unauthenticated, remote attacker to execute arbitrary commands on the Cisco Secure ACS server. This vulnerability is only present when Cisco Secure ACS is...

JBoss Enterprise Application Platform远程EJB调用连接缓存处理验证绕过漏洞

CVE ID:CVE-2013-4213 JBOSS是一个基于J2EE的开放源代码的应用服务器 JBoss Enterprise Application Platform在通过EJB客户端API处理相关远程EJB调用连接的服务器缓存时存在一个缺陷，远程攻击者可利用EJB客户端绕过验证，以其他用户账户上下文登录，并访问数据和执行操作 0 JBoss Enterprise Application Platform 6.1.0 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： http://rhn.redhat.com/errata/RHSA-2013-1151.html...

CVE-2013-4213

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

CVE-2013-4128

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4128

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

Design/Logic Flaw

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

CVE-2013-4213

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

CVE-2013-4128

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4213

Red Hat JBoss EAP 6.1.0 is affected by CVE-2013-4213. The issue is a caching flaw in the EJB client API that prevents proper caching of EJB invocations on the server, allowing remote attackers to hijack user sessions by leveraging an EJB client. This is tied to the Red Hat advisory RHSA-2013:1152...

CVE-2013-4128

Red Hat JBoss EAP 6.1.0 is affected by CVE-2013-4128: remote-naming caching of EJB invocations can allow session hijacking by a remoting client. The issue is that authenticated connections are cached in a way that enables an attacker to reuse a login session without the user’s password. Public ad...

CVE-2013-4213

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

RHEL 5 / 6 : JBoss EAP (RHSA-2013:1151)

Updated Red Hat JBoss Enterprise Application Platform 6.1.0 packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base...

CVE-2011-1483

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterpris...

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBo...

RHEL 5 / 6 : JBoss EAP (RHSA-2013:0873)

Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

An update for JBoss Enterprise Application Platform 5.2.0 which fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

RHEL 6 : JBoss Enterprise Application Platform 6.1.0 update (Important) (RHSA-2013:0834)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0834 advisory. JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a...

RHEL 5 : JBoss EAP (RHSA-2013:0839)

Updated JBoss Enterprise Application Platform 6.1.0 packages that fix three security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...