CVE-2014-3586

The CVE affects Red Hat JBoss Enterprise Application Platform 6.x (and WildFly) where the default CLI history file, .jboss-cli-history, uses weak permissions. This enables a local attacker to read sensitive information from the history file. The issue is addressed in Red Hat security advisories f...

Red Hat JBoss Enterprise Application Platform Role Based Access Control Component Security Bypass Vulnerability

Red Hat JBoss Enterprise Application Platform is an open source, J2EE-based middleware platform for building, deploying, and hosting Java applications and services.JBoss Application Server AS, also known as WildFly is an open source JavaEE-based application server; the JacORB subsystem is a...

Red Hat JBoss Enterprise Application Platform Application Server JacORB Subsystem Information Disclosure Vulnerability

Red Hat JBoss Enterprise Application Platform is an open source, J2EE-based middleware platform for building, deploying, and hosting Java applications and services.JBoss Application Server AS, also known as WildFly is an open source JavaEE-based application server; the JacORB subsystem is a...

Unspecified Vulnerability in Oracle Siebel Core-EAI Component

Oracle Siebel is a customer relationship management software. A security vulnerability in the Integration Business Services subcomponent of the Oracle Siebel Core EAI component allows remote attackers to exploit the vulnerability to affect system availability...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.1 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security impact. A Common...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.1 and fix one security issue, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Low security impact. A Common...

CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3464

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

Design/Logic Flaw

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

Input validation

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3464

CVE-2014-3464 affects Red Hat JBossWS used in JBoss EAP 6.2.0 and 6.3.0. The EJB invocation handler fails to enforce method-level restrictions for outbound messages, allowing remote authenticated users to access restricted JAX-WS handlers via permissions to the EJB class. This stems from an incom...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.0 and fix multiple security issues, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security...

Xxe

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

Third-Party Software Library Risks Scrutinized at Black Hat

Enterprise application developers are under real pressures to push projects out the door quickly and cheaply, and each new version certainly has to be better than the last. This forces them to make decisions that, at a minimum, improve efficiency—and also introduce additional risks. Of particular...

CVE-2014-3481

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform JEAP before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity XXE issue...

RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.2.4 update (Moderate) (RHSA-2014:0798)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0798 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. Apache CXF is an op...

RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 5.2.0 (RHSA-2014:0793)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0793 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.4 and fix multiple security issues, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security...