PT-2015-5835

Name of the Vulnerable Software and Affected Versions Citrix Command Center versions prior to 5.1 Build 35.4 Citrix Command Center versions prior to 5.2 Build 42.7 Description The issue is related to improper access restriction to the Advent Java Management Extensions JMX Servlet. This allows...

Citrix Command Center authentication bypass

Advent JMX is accessible...

Citrx Command Center Advent JMX Servlet Accessible

------------------------------------------------------------------------ Advent JMX Servlet of Citrx Command Center is accessible to unauthenticated users ------------------------------------------------------------------------ Han Sahin, August 2014...

HP Universal Configuration Management Database Server Authentication Bypass

The version of HP Universal Configuration Management Database Server running on the remote web server is affected by an authentication bypass vulnerability due to the JMX-Console component performing access control only for GET and POST methods. A remote attacker, using the HTTP HEAD method, can...

HP Universal CMDB JMX Console Authentication Bypass (CVE-2014-7883)

An authentication bypass vulnerability exists in HP Universal CMDB. The vulnerability is in the JMX Console web application. The vulnerability is due to a design weakness in processing HTTP requests that are neither GET nor POST. A remote unauthenticated attacker can exploit this vulnerability by...

Java JMX Server Insecure Configuration Java Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Java JMX Server Insecure Configuration Java Code Execution', 'Description' = %q This module takes advantage a Java JMX interface...

Java JMX Server Insecure Configuration Java Code Execution Exploit

This Metasploit module takes advantage a Java JMX interface insecure configuration, which would allow loading classes from any remote HTTP URL. JMX interfaces with authentication disabled com.sun.management.jmxremote.authenticate=false should be vulnerable, while interfaces with authentication...

Java JMX - Server Insecure Configuration Java Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Java JMX Server Insecure Configuration Java Code Execution', 'Description' = %q This module takes advantage a Java JMX interface...

Hewlett-Packard UCMDB 10.10 JMX-Console Authentication Bypass Vulnerability

Hewlett-Packard Universal CMDB version 10.10 suffers from a jmx-console related authentication bypass vulnerability. Title: Hewlett-Packard UCMDB - JMX-Console Authentication Bypass CVE-ID: CVE-2014-7883 Product: Hewlett-Packard Universal CMDB UCMDB Affected versions: UCMDB 10.10 Other versions...

Hewlett-Packard (HP) UCMDB - JMX-Console Authentication Bypass

Mogwai Security Advisory MSA-2015-02 ---------------------------------------------------------------------- Title: Hewlett-Packard UCMDB - JMX-Console Authentication Bypass CVE-ID: CVE-2014-7883 Product: Hewlett-Packard Universal CMDB UCMDB Affected versions: UCMDB 10.10 Other versions might also...

Hewlett-Packard UCMDB 10.10 JMX-Console Authentication Bypass

Mogwai Security Advisory MSA-2015-02 ---------------------------------------------------------------------- Title: Hewlett-Packard UCMDB - JMX-Console Authentication Bypass CVE-ID: CVE-2014-7883 Product: Hewlett-Packard Universal CMDB UCMDB Affected versions: UCMDB 10.10 Other versions might also...

Hewlett-Packard (HP) UCMDB - JMX-Console Authentication Bypass

Hewlett-Packard HP UCMDB - JMX-Console Authentication Bypass Mogwai Security Advisory MSA-2015-02 ---------------------------------------------------------------------- Title: Hewlett-Packard UCMDB - JMX-Console Authentication Bypass CVE-ID: CVE-2014-7883 Product: Hewlett-Packard Universal CMDB...

Fedora 20 : thermostat-1.0.6-1.fc20 (2014-17415)

Update to latest maintenance release. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. CVE-2014-812...

Fedora 21 : thermostat-1.0.6-1.fc21 (2014-17384)

Update to latest maintenance release. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. CVE-2014-812...

WS-2014-0038

“JMXJSONServlet” in Apache Hadoop versions 2.4.0 to 2.6.5 are vulnerable to XSS by passing a callback parameter in the JMX response...

CVE-2014-8120

The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors...

Design/Logic Flaw

The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors...

CVE-2014-8120

The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors...

CVE-2014-8120

The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors...

CVE-2014-8120

CVE-2014-8120 affects the Thermostat agent for OpenJDK HotSpot JVM. In certain configurations, the agent disclosed JMX management URLs of all local JVMs to any local user, enabling local privilege escalation (exact exploit path not detailed in the provided documents). Public advisories and Nessus...