CVE-2010-0738

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET...

CVE-2010-1428

The Web Console aka web-console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an...

CVE-2010-0738

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET...

CVE-2010-1428

CVE-2010-1428 affects Red Hat JBoss Enterprise Application Platform (JBEAP) Web Console, where access control was enforced only for GET/POST; other methods allowed unauthorized access to sensitive information. Affected versions are JBEAP 4.2 up to 4.2.0.CP08/4.3 up to 4.3.0.CP07 (per initial desc...

CVE-2010-1429

Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is affected by an information disclosure vulnerability (CVE-2010-1429) in the status servlet that allows remote attackers to obtain details about deployed web contexts, via a full=true query ...

CVE-2010-0738

CVE-2010-0738 affects JBoss AS/JBoss EAP 4.2.x before 4.2.0.CP09 and 4.3.x before 4.3.0.CP08. The JMX-Console performs access control only for GET/POST, allowing remote attackers to send requests via a different method to reach the GET handler. Impact described as an authentication/authorization ...

CVE-2010-1428

The Web Console aka web-console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an...

CVE-2009-1380

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

CVE-2009-3554

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

Design/Logic Flaw

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

Cross site scripting

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

CVE-2009-1380

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

CVE-2009-2405

Multiple cross-site scripting XSS vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML...

CVE-2009-1380

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

CVE-2009-2405

CVE-2009-2405 affects Red Hat JBoss Enterprise Application Platform (JBEAP) Web Console. The vulnerability is an XSS in the Web Console that allows remote attackers to inject arbitrary script/HTML via parameters to createSnapshot.jsp (monitorName, objectName, attribute, period) or createThreshold...

CVE-2009-1380

CVE-2009-1380 is an XSS in JBoss JMX-Console (JBoss EAP/JBEAP). Affected: JBoss EAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07. Root cause: improper handling of the filter parameter (quotes/colon) in the JMX Console, enabling injection of arbitrary script/HTML. Impact: remote attacker could ...

CVE-2009-2405

Multiple cross-site scripting XSS vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML...

JBoss EAP Twiddle logs the JMX password

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

Red Hat JBoss Multiple Products Detection (HTTP)

HTTP based detection of multiple Red Hat JBoss products. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JBoss EAP Twiddle logs the JMX password

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...