CVE-2015-5178

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2...

Design/Logic Flaw

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2...

CVE-2015-5178

CVE-2015-5178 affects Red Hat JBoss Enterprise Application Platform (EAP) / WildFly up to version 6.4.3 where the Management Console did not send X-Frame-Options, enabling clickjacking via a crafted page containing a FRAME/IFRAME. Remediation per RHSA-2015:1906 is to upgrade to 6.4.4 (EAP/WildFly...

CVE-2015-5178

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2...

PT-2015-2598 · Red Hat · Red Hat Jboss Enterprise Application Platform +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Application Platform versions prior to 6.4.4 WildFly formerly JBoss Application Server versions prior to 6.4.4 Description: The issue is related to the Management Console in Red Hat Enterprise Application Platform and...

SolarWinds Log and Event Manager < 6.2.0 Multiple Remote Command Execution Vulnerabilities

According to its self-reported version number, the SolarWinds Log and Event Manager installed on the remote host is prior to version 6.2.0. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the messagebroker/nonsecurestreamingamf service when using the traceroute...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

OOME from EAP 6 http management console

It was discovered that sending requests containing large headers to the Web Console produced a Java OutOfMemoryError in the HTTP management interface. An attacker could use this flaw to cause a denial of service...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

The vulnerability of the Avira Management Console allows a hacker to execute arbitrary code.

The vulnerability of the Update Manager service in the Avira Management Console relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Avira Management Console Server HTTP Header Processing Heap Buffer Overflow

A heap buffer overflow vulnerability has been reported in Avira Management Console Server. The vulnerability exists in the way Update Manager Service handles overly long HTTP headers. A remote unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests to the server...

Avira Management Console Memory Misreference Vulnerability

Avira Management Console provides centralized and effective control of Avira security components. A memory misreference vulnerability exists in the Avira Management Console's Update Manager service, which can be exploited by a remote attacker to execute arbitrary code...

CVE-2015-7303

Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header...

CVE-2015-7303

CVE-2015-7303 is a use-after-free in Avira Management Console's Update Manager service. By sending oversized HTTP headers, remote attackers can trigger memory reuse and execute arbitrary code, potentially with SYSTEM privileges; authentication is not required per ZDI-15-445. Multiple entries (NVD...

CVE-2015-5693

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."...

Design/Logic Flaw

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHP scripts in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against...

Design/Logic Flaw

adminmessages.php in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to...