JBoss Seam privilege escalation caused by EL interpolation in FacesMessages

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language EL statements i...

Google Chrome Multiple Denial of Service Vulnerabilities - February 11(Linux)

The host is running Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultdosvulnfeb11lin.nasl 7015 2017-08-28 11:51:24Z teissa $ Google Chrome Multiple Denial of Service Vulnerabilities - February 11Linux Authors: Madhuri D Copyright: Copyright...

Google Chrome Multiple Denial of Service Vulnerabilities (Feb 2011) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome Multiple Denial of Service Vulnerabilities (Feb 2011) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-0982

Use-after-free vulnerability in Google Chrome before 9.0.597.94 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG font faces...

CVE-2011-0982

Use-after-free vulnerability in Google Chrome before 9.0.597.94 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG font faces...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome before 9.0.597.94 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG font faces...

CVE-2011-0982

CVE-2011-0982 describes a use-after-free vulnerability in Google Chrome prior to 9.0.597.94, exploitable via SVG font face handling that could cause a denial of service and potentially other impacts. Affected product: Google Chrome (before 9.0.597.94). Root cause: use-after-free in the SVG font f...

CVE-2011-0982

Use-after-free vulnerability in Google Chrome before 9.0.597.94 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG font faces...

CVE-2011-0982

Removed by vendor...

Google Chrome < 9.0.597.94 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is earlier than 9.0.597.94. Such versions are reportedly affected by multiple vulnerabilities : - An error exists in the processing of animations events related to stale pointers. Issue 67234 - An error exists in the processing of SVG font...

CGI Generic Padding Oracle

By manipulating the padding on an encrypted string, Nessus was able to generate an error message that indicates a likely 'padding oracle' vulnerability. Such a vulnerability can affect any application or framework that uses encryption improperly, such as some versions of ASP.net, Java Server Face...

Tool Expoits Data Flaws in JavaServer Faces

Researchers have released software that exposes private information and executes arbitrary code on sensitive websites by exploiting weaknesses in the widely used web development technology JavaServer Faces. Read the full article. The Register...

Apache MyFaces ViewState远程跨站脚本漏洞

CVE ID: CVE-2010-2086 Apache MyFaces是JavaServer Faces标准的开源实现。 在没有加密view state的情况下，远程攻击者就可以通过在请求中向Apache MyFaces提供新的或修改的view对象执行跨站脚本或任意EL语句。成功利用这个漏洞要求修改非明文存储的序列化view对象。 Apache Group MyFaces 1.2.8 Apache Group MyFaces 1.1.7 厂商补丁： Apache Group ------------...

Oracle Mojarra ViewState远程跨站脚本漏洞

CVE ID: CVE-2010-2087 Mojarrais是JavaServer Faces标准的开源实现。 在没有加密view state的情况下，远程攻击者就可以通过在请求中向Mojarrais提供新的或修改的view对象执行跨站脚本或任意EL语句。成功利用这个漏洞要求修改非明文存储的序列化view对象。 Oracle Mojarra 2.0.2 Oracle Mojarra 1.214 厂商补丁： Oracle ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.oracle.com...

Project Woodstock 404 Error Page UTF-7 Encoded XSS

The remote web server contains a web application built using Woodstock components, which are user interface components for the web- based on Java Server Faces and AJAX. Woodstock is part of Sun Glassfish Enterprise Server and can also be used with other Java web containers, such as JBoss, Tomcat,...

Sun Glassfish Woodstock Project 4.2 XSS

Digital Security Research Group DSecRG Advisory DSECRG-09-038 Original advisory: http://dsecrg.com/pages/vul/show.php?id=138 Application: Sun Glassfish Woodstock Project part of Glassfish Enterprise Server Versions Affected: 4.2 Vendor URL: https://woodstock.dev.java.net/ Bug: Linked XSS...

JBoss Enterprise Application Platform信息泄漏漏洞

BUGTRAQ ID: 30540 CVE ID:CVE-2008-3273 CVE-2008-1285 CNCVE ID：CNCVE-20083273 CNCVE-20081285 JBoss Enterprise Application Platform是一款企业级应用平台。 JBoss Enterprise Application Platform存在信息泄漏问题，远程攻击者可以利用漏洞获得配置的WEB上下文，或进行跨站脚本攻击。 -JavaServer Faces JSF组件存在多个跨站脚本攻击，可导致注入任意WEB脚本或HTML。...

Cross-site scripting (XSS) vulnerability in Sun Java Server Faces

Cross-site scripting XSS vulnerability in Sun Java Server Faces JSF 1.2 before 1.208 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP01 security update

Updated JBoss Enterprise Application Platform JBoss EAP packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss EAP is a middleware platform for Java 2...