CVE-2012-5629: Undefined Security Weakness

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

JBoss: allows empty password to authenticate against LDAP

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

Important: Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update

An updated apache-cxf package for JBoss Enterprise Web Platform 5.2.0 that fixes two security issues is now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS ba...

Important: Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update

An update for JBoss Enterprise Web Platform 5.2.0 which fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

JBoss: allows empty password to authenticate against LDAP

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

CVE-2012-3370

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remot...

CVE-2011-4575

Cross-site scripting XSS vulnerability in the JMX console in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-3369

The CallerIdentityLoginModule in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's...

CVE-2013-0218

The GUI installer in JBoss Enterprise Application Platform EAP and Enterprise Web Platform EWP 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file...

Input validation

The NonManagedConnectionFactory in JBoss Enterprise Application Platform EAP 5.1.2 and 5.2.0, Web Platform EWP 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by readi...

CVE-2012-3370

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remot...

CVE-2012-3370

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remot...

CVE-2011-4575

CVE-2011-4575 is an XSS vulnerability in the JMX Console of JBoss products (EAP before 5.2.0, EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1) allowing remote injection of script/HTML via unspecified vectors. Connected sources summarize the same CVE as an XSS flaw in t...

CVE-2012-0034

The CVE affects JBoss components where NonManagedConnectionFactory logs the username and password in cleartext during exception handling, risking local disclosure of credentials for EAP 5.1.2/5.2.0, EWP 5.1.2/5.2.0, and BRMS Platform before 5.3.1. Impact is limited to local confidentiality exposu...

PT-2013-1603

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform EAP versions prior to 5.2.0 JBoss Web Platform EWP versions prior to 5.2.0 BRMS Platform versions prior to 5.3.1 SOA Platform versions prior to 5.3.1 Description The issue allows remote attackers to gain...

PT-2013-1520 · Red Hat · Brms Platform +3

Name of the Vulnerable Software and Affected Versions: JBoss Enterprise Application Platform EAP versions prior to 5.2.0 Web Platform EWP versions prior to 5.2.0 BRMS Platform versions prior to 5.3.1 SOA Platform versions prior to 5.3.1 Description: The issue concerns the JMXInvokerHAServlet and...

PT-2013-2163

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform EAP and Enterprise Web Platform EWP versions 5.1.2 through 5.2.0 Description The issue concerns the GUI installer in JBoss EAP and EWP, which uses world-readable permissions for the auto-install XML file...

PT-2013-1602

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform EAP versions prior to 5.2.0 JBoss Web Platform EWP versions prior to 5.2.0 JBoss BRMS Platform versions prior to 5.3.1 JBoss SOA Platform versions prior to 5.3.1 Description The issue allows remote attacke...

PT-2013-1483

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform EAP versions 5.1.2 through 5.2.0 Web Platform EWP versions 5.1.2 through 5.2.0 BRMS Platform versions prior to 5.3.1 Description The issue allows local users to obtain sensitive information, specifically...

PT-2013-1800

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions prior to 5.2.0 JBoss Web Platform versions prior to 5.2.0 JBoss BRMS Platform versions prior to 5.3.1 JBoss SOA Platform versions prior to 5.3.1 Description The issue concerns improper access...