1400 matches found
Sun JMX RMI-IIOP本地非授权访问漏洞
Java Dynamic Management Kit （Java DMK）提供一组Java 类和工具，便于根据Java管理扩展（JMX）规范和SNMP标准开发安全的监控和管理解决方案。 如果拥有对某些本地数据访问权限的远程用户连接到了本地用户所创建的JMX RMI-IIOP服务器应用程序的话，JMX RMI-IIOP API中的安全漏洞就可能允许能够创建该应用程序的本地用户获取对这些数据的非授权访问。 这个漏洞仅影响包含有通过JMX RMI-IIOP API部署的应用程序的系统。满足了所有以下条件时JMX代理会出现这个漏洞： 1...
CVE-2007-1419
CVE-2007-1419 affects Java Dynamic Management Kit 5.1, where the JMX RMI-IIOP Remote API does not properly enforce java.policy. This allows a local attacker with privileged remote authenticated access to obtain certain MBeans data. The issue is described as a local-privilege/数据访问 risk with a base...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733...
JBoss jmx-console CSRF
Hello! Recent message about JBoss's console made me looking at that interface again and it seems that it is vulnerable for the CRSF attacks. MBean settings may be changed and operations may be invoked on behalf of the authenticated administrator by the hidden submitting form like follows: form...
JBoss Application Server (jbossas) JMX Console DeploymentFileRepository Traversal Arbitrary File Manipulation
The remote web server appears to be a version of JBoss that fails to sanitize user-supplied input to the BaseDir parameter used by the 'DeploymentFileRepository' service of JMX Console before using it to store or delete files. An unauthenticated attacker may be able to exploit this to alter files...
JBoss JMX Console Unrestricted Access
The remote web server appears to be a version of JBoss that allows unauthenticated access to the JMX and/or Web Console servlets used to manage JBoss and its services. A remote attacker can leverage this issue to disclose sensitive information about the affected application or even take control o...
JBoss JMX Console DeploymentFileRepository Directory Traversal File Manipulation
Binary data 3862.prm...
CS-MARS JBoss jmx-console access
Added: 07/26/2006 CVE: CVE-2006-3733 BID: 19075 OSVDB: 27419 Background The Cisco Security Monitoring, Analysis, and Response System CS-MARS recognizes and correlates network attacks. Problem CS-MARS includes the JBoss web application server with insufficient access control to the jmx-console...
CS-MARS JBoss jmx-console access
Added: 07/26/2006 CVE: CVE-2006-3733 BID: 19075 OSVDB: 27419 Background The Cisco Security Monitoring, Analysis, and Response System CS-MARS recognizes and correlates network attacks. Problem CS-MARS includes the JBoss web application server with insufficient access control to the jmx-console...
CS-MARS JBoss jmx-console access
Added: 07/26/2006 CVE: CVE-2006-3733 BID: 19075 OSVDB: 27419 Background The Cisco Security Monitoring, Analysis, and Response System CS-MARS recognizes and correlates network attacks. Problem CS-MARS includes the JBoss web application server with insufficient access control to the jmx-console...
Cisco MARS < 4.2.1 remote compromise
Cisco MARS Monitoring, Analysis and Response System, sometimes referred to as CS-MARS prior to version 4.2.1 ships with an unprotected JBoss installation which ultimately leads to a complete compromise of the device. The caveat here is that, despite much work on Cisco's part, they were not able t...
CVE-2006-3733
jmx-console/HtmlAdaptor in the jmx-console in the JBoss web application server, as shipped with Cisco Security Monitoring, Analysis and Response System CS-MARS before 4.2.1, allows remote attackers to gain privileges as the CS-MARS administrator and execute arbitrary Java code via an invokeOp...
Cisco/Protego CS-MARS < 4.2.1 (JBoss) Remote Code Execution Exploit
Exploit for hardware platform in category remote exploits =================================================================== Cisco/Protego CS-MARS Addressed in CSCse47646 CS-MARS is an event correlation product orginally written by Protego, which is now owned by Cisco. It is built on top of JBos...
CiscoProtego CS-MARS 4.2.1 - JBoss Remote Code Execution
CiscoProtego CS-MARS 4.2.1 - JBoss Remote Code Execution !/usr/bin/perl Cisco/Protego CS-MARS Addressed in CSCse47646 CS-MARS is an event correlation product orginally written by Protego, which is now owned by Cisco. It is built on top of JBoss. Unfortunately, little or no effort was put in to...
Cisco/Protego CS-MARS < 4.2.1 (JBoss) Remote Code Execution Exploit
No description provided by source. !/usr/bin/perl Cisco/Protego CS-MARS 4.2.1 remote command execution, system compromise via insecure JBoss installation. Fully functional POC code by Jon Hart [email protected] Addressed in CSCse47646 CS-MARS is an event correlation product orginally written by...
Cisco/Protego CS-MARS < 4.2.1 - 'JBoss' Remote Code Execution
!/usr/bin/perl Cisco/Protego CS-MARS Addressed in CSCse47646 CS-MARS is an event correlation product orginally written by Protego, which is now owned by Cisco. It is built on top of JBoss. Unfortunately, little or no effort was put in to securing the JBoss installation as per the JBoss community'...
CVE-2006-3733
jmx-console/HtmlAdaptor in the jmx-console in the JBoss web application server, as shipped with Cisco Security Monitoring, Analysis and Response System CS-MARS before 4.2.1, allows remote attackers to gain privileges as the CS-MARS administrator and execute arbitrary Java code via an invokeOp...
Sun Java Management Extensions privilege escalation vulnerability
Overview A vulnerability in the Sun Java Management Extensions API may allow a remote attacker to execute arbitrary code. Description According to Sun Microsystems:Java Management Extensions JMX technology provides the tools for building distributed, Web-based, modular and dynamic solutions for...
CVE-2005-3904
Unspecified vulnerability in Java Management Extensions JMX in Java JDK and JRE 5.0 Update 3, 1.4.2 and later, 1.3.1 and later allows remote attackers to escape the Java sandbox and access arbitrary files or execute arbitrary application via unknown attack vectors...
CVE-2005-3904
CVE-2005-3904 affects Java JMX in Java JDK/JRE 5.0 Update 3 and later (including 1.4.2+/1.3.1+); a remote attacker could escape the Java sandbox to access files or run arbitrary code. Mitigation from connected sources: upgrade to JDK/JRE 5.0 Update 4, and follow guidance to avoid untrusted applet...