Moderate: Red Hat Security Advisory: resteasy security update

An update for JBoss Enterprise Application Platform 5.1.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which give...

Important: Red Hat Security Advisory: jbossas security update

An update for JBoss Enterprise Application Platform 5.1.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which giv...

Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

The NonManagedConnectionFactory in JBoss Enterprise Application Platform EAP 5.1.2 and 5.2.0, Web Platform EWP 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by readi...

CVE-2011-4314

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

CVE-2011-4314

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

CVE-2011-4314

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

PT-2012-1858

Name of the Vulnerable Software and Affected Versions OpenID4Java versions prior to 0.9.6 final JBoss Enterprise Application Platform versions prior to 5.1.2 Kay Framework versions prior to 1.0.2 Description The issue allows remote attackers to modify potentially sensitive Attribute Exchange AX...

CVE-2011-4608: Undefined Security Weakness

modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from ...

CVE-2011-4314: Improper Input Validation

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

Moderate: Red Hat Security Advisory: jbossweb security update

An update for JBoss Enterprise Application Platform 4.3.0 CP10 that fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

JBoss Enterprise SOA Platform调用程序身份验证绕过漏洞

BUGTRAQ ID: 50720 CVE ID: CVE-2011-4085 JBoss企业应用平台（JBoss Enterprise Application Platform，EAP）是J2EE应用的中间件平台。 JBoss Enterprise Application Platform在调用程序的实现上存在安全漏洞，攻击者可利用此漏洞绕过身份验证机制，非法访问受影响应用程序。 RedHat JBoss EAP 5.x 厂商补丁： RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.jboss.org/...

extension): MITM due to improper validation of AX attribute signatures

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

Low: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.2 update

Updated JBoss Enterprise Application Platform 5.1.2 packages that fix two security issues, various bugs, and add several enhancements are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability...

extension): MITM due to improper validation of AX attribute signatures

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

Omnidocs - Multiple Vulnerabilities

-------------------------------------------------------------------- Exploit Title: Multiple Vulnerability in "Omnidocs" Date: 24 Sep 2011 Author: Sohil Garg Software Link: http://www.newgensoft.com/omnidocs.asp Version: All Tested on: Apache-Coyote/1.1 CVE : CVE-2011-3645 �...

Important: Red Hat Security Advisory: jbossws-common security update

An updated JBoss Enterprise Application Platform 4.3 that fixes one security issue is now available from the Red Hat Customer Portal as JBoss Enterprise Application Platform 4.3.0 Cumulative Patch 10. The Red Hat Security Response Team has rated this update as having important security impact. A...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common.jar file for JBoss Enterprise Application Platform 5.1.1 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

IBM Domino Installed

IBM Domino formerly IBM Lotus Domino, an enterprise application for collaborative messaging, scheduling, directory services, and web services, is installed on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid55818; scriptversion"1.8";...

CVE-2011-1484: Undefined Security Weakness

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language EL statements i...

Important: Red Hat Security Advisory: jboss-seam security update

An updated jboss-seam.jar file for JBoss Enterprise Application Platform 4.3.0.CP09 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...