Important: Red Hat Security Advisory: JBoss Enterprise SOA Platform 4.2.0.CP05 and 4.3.0.CP05 update

An update for JBoss Enterprise SOA Platform 4.2.0.CP05 and 4.3.0.CP05 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base scor...

Important: Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.3.0 update

JBoss Enterprise SOA Platform 5.3.0 roll up patch 2, which fixes one security issue and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

CVE-2012-2377

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a...

CVE-2011-4085

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

Input validation

The 1 JNDI service, 2 HA-JNDI service, and 3 HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly...

Authentication flaw

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

Design/Logic Flaw

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a...

CVE-2011-4605

The 1 JNDI service, 2 HA-JNDI service, and 3 HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly...

Input validation

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to...

CVE-2012-2377

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a...

CVE-2012-2377

CVE-2012-2377 affects: JBoss Enterprise Portal Platform <5.2.2, JBoss SOA Platform <5.3.0, and BRMS Platform

CVE-2011-2908

A Cross-site request forgery (CSRF) vulnerability exists in the JMX Console (jmx-console) component of the JBoss Enterprise Portal Platform (before 5.2.2), BRMS Platform (5.3.0 before roll up patch1), and SOA Platform (5.3.0). This flaw allows remote authenticated users to hijack the authenticati...

CVE-2011-4085

The CVE-2011-4085 description specifies an authentication bypass vulnerability in JBoss platforms where the servlets invoked by httpha-invoker (in JBoss EAP before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07) enforce access control only for GE...

CVE-2011-4085

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

CVE-2011-4605

Summary: CVE-2011-4605 affects JBoss/JBossAS JNDI-related services. The vulnerability stems from insufficient access restrictions in the JNDI service, HA-JNDI service, and the HAJNDIFactory invoker servlet, allowing remote attackers to write to the JNDI tree. This could enable adding, deleting, o...

CVE-2011-2908: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the JMX Console jmx-console in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

PT-2012-1801 · Red Hat · Red Hat Jboss Enterprise Application Platform +3

Name of the Vulnerable Software and Affected Versions: JBoss Enterprise Application Platform versions prior to 5.1.2 JBoss SOA Platform versions prior to 5.2.0 JBoss BRMS Platform versions prior to 5.3.0 JBoss Portal Platform versions prior to 4.3 CP07 Description: The issue allows remote attacke...

CVE-2011-4085: Improper Authentication

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

Microsoft .NET Framework远程权限提升漏洞（MS12-074)

BUGTRAQ ID: 56464 CVE ID: CVE-2012-4777 .NET就是微软的用来实现XML，Web Services，SOA（面向服务的体系结构service-oriented architecture）和敏捷性的技术。.NET Framework是微软开发的软件框架，主要运行在Microsoft Windows上。 Microsoft .NET Framework 4、4.5的代码优化功能在反射实现中没有正确执行对象权限，通过特制的XAML浏览器应用或特制的.NET Framework应用，可允许远程攻击者执行任意代码。 0 Microsoft .NET...

Important: Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.3.0 security update

An update for the JBoss Web Services component in JBoss Enterprise SOA Platform 5.3.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring Syste...