CVE-2026-53682: Exposure of Sensitive System Information to an Unauthorized Control Sphere

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles security domain topology and participating subsystems, without requiring a principal, client certificate, or...

EUVD-2020-6451

Malware in sbrugna...

CVE-2020-14299

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user...

CVE-2020-14299

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user...

Authentication flaw

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user...

CVE-2020-14299

CVE-2020-14299 affects Red Hat JBoss Enterprise Application Platform (EAP). The flaw stems from using a legacy SecurityRealm delegating to a legacy PicketBox SecurityDomain and reloading to admin-only mode, enabling complete authentication bypass with an arbitrary user/password. The impact is des...

PT-2020-13965

Name of the Vulnerable Software and Affected Versions JBoss EAP affected versions not specified Description A flaw in JBoss EAP allows an attacker to perform a complete authentication bypass by using an arbitrary user and password when the authentication configuration is set-up using a legacy...

CVE-2020-14299: Improper Authentication

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user...

Vimeo: XSS on any site that includes the moogaloop flash player | deprecated embed code

The moogaloop flash player includes in most cases http://f.vimeocdn.com/p/flash/moogaloop/6.0.30/controllers/videoControllerProgressive.swf. In that flash file we can find functionality that looks into the SharedObject "com.conviva.livePass" for recently loaded swf-URLs under the key "lastSwfUrls...