Code injection

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

CVE-2014-0852

The CVE affects IBM WebSphere DataPower SOA Appliances. Affected versions include 4.0.2.15, 5.x up to 5.0.0.17, 6.0.0.x up to 6.0.0.9, and 6.0.1.x up to 6.0.1.5. Root cause: a SSL/TLS side-channel timing vulnerability that can reveal the PreMasterSecret when an attacker on the same LAN sends mill...

Design/Logic Flaw

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform JEAP 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to...

Joomla Component com_virtuemart 1.0 - SQL Injection Vulnerability (product_id)

No description provided by source. Title: Joomla Component comvirtuemart SQL injection vulnerability productid Author: SOA Crew a.k.a Neo-GabrieL [email protected] visit us: http://indonesianhacker.com/ / Software Information Vendor : http://virtuemart.net/ Download : - Version : 1.0...

Moderate: Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update

Red Hat JBoss SOA Platform 5.3.1 2014 roll up patch 1, which fixes one security issue and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

Tilt - Terminal Ip Lookup Tool

Tilt: Terminal ip lookup tool, is an easy and simple open source tool implemented in Python for ip/host passive reconnaissance. It's very handy for first reconnaissance approach and for host data retrieval. Features Host to IP conversion IP to Host conversion DNS to IPs GeoIP Translation Extensiv...

JBoss Overlord Runtime Governance for JBossAS MVEL表达式Java代码执行漏洞

CVE ID:CVE-2013-6469 JBoss Overlord Runtime Governance for JBossAS是一款管理JBoss SOA平台的应用。 JBoss Overlord Runtime Governance for JBossAS处理部分MVEL表达式时存在未明错误，允许攻击者提交特制的表达式执行任意Java代码。 0 JBoss Overlord Runtime Governance for JBossAS 1.0 目前没有详细解决方案： https://www.jboss.org/overlord...

IBM WebSphere Portal跨站脚本漏洞

CVE ID:CVE-2014-0901 IBM WebSphere Portal提供了一个组合应用程序或业务mashup框架，并且提供了一种高级工具来构造灵活的，基于SOA的解决方案。 由于某些关于WCM UI的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 IBM WebSphere Portal 6.x IBM WebSphere Portal 7.x IBM WebSphere Portal 8.x IBM WebSphere Portal 8.0.0.1 CF11版本以修复此漏洞，建议用户下载使用：...

IBM WebSphere Portal Web Content Manager UI 跨站脚本漏洞

CVE ID:CVE-2014-0828 IBM WebSphere Portal提供了一个组合应用程序或业务mashup框架，并且提供了一种高级工具来构造灵活的，基于SOA的解决方案。 由于某些关于社会渲染功能的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 IBM WebSphere Portal 6.x IBM WebSphere Portal 7.x IBM WebSphere Portal 8.x IBM WebSphere Portal 8.0.0.1 CF11版本以修复此漏洞，建议用户下载使用：...

IBM WebSphere Portal 'wcm.path.traversal.security'安全绕过漏洞

Bugtraq ID:65955 CVE ID:CVE-2013-6730 IBM WebSphere Portal提供了一个组合应用程序或业务mashup框架，并且提供了一种高级工具来构造灵活的，基于SOA的解决方案。 当启用了Web Content Manager WCM路径遍历"wcm.path.traversal.security"设置时应用程序不正确限制对搜索结果的访问，允许攻击者利用漏洞绕过限制获取受限内容信息。 0 IBM WebSphere Portal 6.x IBM WebSphere Portal 6.x IBM WebSphere Portal 7.x IBM...

Moderate: Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update

Red Hat JBoss SOA Platform 5.3.1 roll up patch 4, which fixes two security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Design/Logic Flaw

The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service file descriptor consumption via...

CVE-2013-4210

The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service file descriptor consumption via...

Moderate: Red Hat Security Advisory: jboss-remoting security update

An update for the JBoss Remoting component of Red Hat JBoss SOA Platform 5.3.1 GA that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVS...

Important: Red Hat Security Advisory: Fuse Message Broker 5.5.1 security update

An update for the Apache ActiveMQ component of Fuse Message Broker 5.5.1 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

Moderate: Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update

Red Hat JBoss SOA Platform 5.3.1 roll up patch 3, which fixes three security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base score...

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBo...

Important: Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update

Red Hat JBoss SOA Platform 5.3.1 roll up patch 2, which fixes one security issue and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score...

CVE-2013-0499

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...

Cross site scripting

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...