CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2015-7501

CVE-2015-7501 involves a deserialization flaw in Apache Commons Collections that affects Red Hat JBoss Middleware stack (A-MQ 6.x; BPMS 6.x; BRMS 5.x/6.x; JDG 6.x/5.x; JDV 6.x/5.x; AEP 6.x; Fuse 6.x; FSW 6.x; JBoss ON 3.x; Portal 6.x; SOA-P 5.x; JWS 3.x; OpenShift/xPaaS 3.x; Subscription Asset Ma...

CVE-2013-2165

CVE-2013-2165 is a deserialization vulnerability in RichFaces implementations (3.x–5.x) across Red Hat JBoss components that does not restrict which classes’ deserialization methods can be invoked, allowing remote attackers to execute arbitrary code via crafted serialized data. Affected products ...

CVE-2020-14340

CVE-2020-14340 affects XNIO prior to the fix in RHSA-2020:4246. A file descriptor leak occurs due to growing NIO Selector handles across garbage collection cycles, enabling a denial-of-service condition. Affected: XNIO 3.6.0.Beta1 through 3.8.1.Final. Root cause: leak in file descriptor managemen...

CVE-2010-0737

CVE-2010-0737 describes an elevation-of-privilege flaw in the Red Hat JBoss Operations Network CLI prior to 2.3.1, where a missing permission check allows JBoss ON users to perform management tasks and configuration changes with administrator privileges. The issue is tied to insufficient authoriz...

CVE-2016-5422

The CVE-2016-5422 issue affects Red Hat JBoss Operations Network (JON) prior to 3.3.7. The web console fails to properly authorize requests to add users with the super user role, enabling remote authenticated users to elevate privileges to admin via a crafted POST. The widely cited Red Hat adviso...

CVE-2014-7853

The CVE-2014-7853 issue affects Red Hat JBoss Enterprise Application Platform 6.x (WildFly) where the JacORB subsystem did not correctly classify socket-binding-ref sensitivity for the security-domain attribute, enabling remote authenticated users to disclose sensitive information. Affects EAP/Wi...

CVE-2013-4374

CVE-2013-4374 describes an insecure temporary file storage vulnerability in the RHQ MongoDB Drift Server up to 2013-09-25, triggered when unpacking zipped files. The flaw causes unpacked files to land in a world-writable directory, which could permit local attackers to modify/tamper with files an...

CVE-2016-3737

The CVE-2016-3737 entry concerns Red Hat JBoss Operations Network (JON) prior to 3.3.6, where remote code execution is possible through a crafted HTTP request due to deserialization issues in the JON server. The issue is tied to message deserialization and is referenced across several feeds (NVD,...

CVE-2019-3834

Technical details for CVE-2019-3834 are not publicly provided in the supplied documents. No affected products, impact, or fixes are explicitly detailed here. Monitor for updates in connected sources.

CVE-2012-5626

The CVE-2012-5626 entry refers to an EJB method in Red Hat products (BRMS 5; JBoss EAP 5; JBoss Operations Network 3.1; JBoss Portal 4/5; JBoss SOA Platform 4.2–5; JBoss Enterprise Web Server 1) that ignores roles specified via the @RunAs annotation. The underlying issue is a role-handling flaw i...

CVE-2012-0062

Red Hat JBoss Operations Network (JBoss ON) is affected by CVE-2012-0062. Versions affected: JON before 2.4.2 and 3.0.x before 3.0.1. Root cause: an agent registration request could be processed without a valid security token. Impact: remote attackers can hijack an approved agent’s session and st...

CVE-2012-0052

CVE-2012-0052 affects Red Hat JBoss Operations Network (JBoss ON) 2.4.2 and 3.0.x before 3.0.1. The issue is failure to validate the JON agent key, allowing remote attackers to spoof arbitrary agents by registering agent name, potentially hijacking sessions and exfiltrating data (e.g., JMX creden...

CVE-2011-3206

The CVE-2011-3206 entry describes multiple XSS vulnerabilities in the RHQ/JBoss ON administration interface (RHQ 4.2.0, used in JBoss Operations Network before 3.0). The root cause is lack of input validation in the administration UI, allowing remote attackers to inject arbitrary script/HTML via ...

CVE-2011-4573

Red Hat JBoss Operations Network (JON) 2.4.1 and earlier versions are affected by CVE-2011-4573. The flaw allows remote authenticated users to bypass modify resource permissions when deleting a plug-in configuration update from the group connection properties history, enabling deletion from the a...

CVE-2013-4452

The CVE-2013-4452 issue affects Red Hat JBoss Operations Network (JON) 3.1.2, where server and agent configuration files were world-readable, allowing local users to read authentication credentials and other sensitive information. The root cause is permissions misconfiguration on the configuratio...

CVE-2016-6330

CVE-2016-6330 affects Red Hat JBoss Operations Network (JON). The issue allows remote code execution via a crafted HTTP request when SSL authentication is not configured for JON server/agent communication, linked to message deserialization. Affected versions are before 3.3.6; the root cause relat...

CVE-2013-4293

CVE-2013-4293 affects Red Hat JBoss Operations Network (JON) 3.1.2. The server stores passwords in plaintext in log files, enabling a local attacker with log access to obtain sensitive credentials. This is a local, file-based disclosure vulnerability. The Red Hat advisory RHSA-2013:1448 notes a s...

CVE-2015-3267

The CVE-2015-3267 entry concerns an XSS vulnerability in the 404 error page of Red Hat JBoss Operations Network prior to version 3.3.3. The underlying issue is insufficient input validation on the error page, enabling remote attackers to inject arbitrary script or HTML via a crafted URL. The vuln...

CVE-2013-4373

Red Hat JBoss Operations Network 3.1.2 is affected by CVE-2013-4373. The vulnerability is in JPADriftServerBean.storeFiles, which creates a predictable temporary directory when unpacking a zip file, allowing a local attacker to place their own drift files into the server. Impact is local, enablin...

CVE-2015-0297

Red Hat JBoss Operations Network 3.3.1 is affected by CVE-2015-0297. The issue arises because the server did not correctly restrict access to certain remote APIs, enabling a remote, unauthenticated attacker to execute arbitrary Java methods via the ServerInvokerServlet or SchedulerService, and po...

CVE-2008-5083

CVE-2008-5083 affects Red Hat JBoss ON (JBoss ON) 2.1.x prior to 2.1.2 SP1. The issue allows an authenticated user to obtain unauthorized security information about private resources managed by JBoss ON, due to an information disclosure vulnerability in the product’s access controls. The provided...

CVE-2012-0032

CVE-2012-0032 affects Red Hat JBoss Operations Network (JON) prior to 3.0.1. The root directory is created with 0777 permissions when installing the remote client, enabling local users to read or modify subdirectories/files and potentially obtain JON credentials. This is a local-privilege-concern...

CVE-2012-1100

CVE-2012-1100 affects Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1 and 2.4.2 and earlier. When LDAP authentication is enabled and the LDAP bind account credentials are invalid, remote attackers can log into LDAP-based accounts by supplying any password in a login request. This is the...