JBoss HSQLDB component remote command injection

Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to 1 TCP port 1701 in JBoss 3.2.1, a...

Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform security update

Updated JBoss Enterprise Application Platform packages that fix several security issues and bugs are now available for Red Hat Application Stack v1 and v2. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The updated packages address the followi...

openSUSE 10 Security Update : jboss (jboss-2309)

This update fixes a problem in the JBOSS server where it was possible to potentially execute code if the console manager was enabled. CVE-2006-5750 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

Race condition

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

CVE-2007-1354

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

CVE-2007-1354

CVE-2007-1354 affects JBoss Application Server’s JMX Console (JBoss AS 4.0.2 and 4.0.5 before 20070416). The flaw is in JMXOpsAccessControlFilter, which stores the current user’s roles in a member variable, enabling a race condition where a remote authenticated administrator could log in during a...

CVE-2007-1354

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

Low: Red Hat Security Advisory: JBoss Application Server security update

Updated versions of JBoss Application Server that fix a security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The JBoss Application Server is a powerful J2EE application server. A flaw was found in the JMX Console...

security flaw

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733...

CVE-2007-1157

Cross-site request forgery CSRF vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733...

CVE-2007-1157

Cross-site request forgery CSRF vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733...

CVE-2007-1157

Cross-site request forgery CSRF vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733...

CVE-2007-1157

CVE-2007-1157 covers a CSRF flaw in jmx-console/HtmlAdaptor within the JBoss web container used by CS-MARS, allowing remote attackers to perform privileged administrative actions through certain MBean operations. Affected: jmx-console/HtmlAdaptor in JBoss; Root cause: CSRF enabling privileged act...

JBoss jmx-console CSRF

Hello! Recent message about JBoss's console made me looking at that interface again and it seems that it is vulnerable for the CRSF attacks. MBean settings may be changed and operations may be invoked on behalf of the authenticated administrator by the hidden submitting form like follows: form...

JBoss insecure defaults

Web console and management instruments are available without authentication...

CVE-2007-1036

The default configuration of JBoss does not restrict access to the 1 console and 2 web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests...

Authentication flaw

The default configuration of JBoss does not restrict access to the 1 console and 2 web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests...

CVE-2007-1036

The default configuration of JBoss does not restrict access to the 1 console and 2 web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests...

CVE-2007-1036

CVE-2007-1036 affects JBoss where the default configuration does not restrict access to the console and web management interfaces. This allows an unauthenticated remote attacker to bypass authentication and gain administrative access via direct requests to the JBoss web console, enabling potentia...