Home
Bugtraq
Full List
Only Bugs
Only Tricks
Only Exploits
Only Dorks
Only CVE
Only CWE
Fake Notes
Ranking
CVEMAP
Full List
Show Vendors
Show Products
CWE Dictionary
Check CVE Id
Check CWE Id
Search
Bugtraq
CVEMAP
By author
CVE Id
CWE Id
By vendors
By products
RSS
Bugtraq
CVEMAP
CVE Products
Bugs
Exploits
Dorks
More
cIFrex
Facebook
Twitter
Donate
About
Submit
Vulnerabilities for
'Jboss application server'
2020-03-10
CVE-2012-1094
CWE-200
JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
2019-12-18
CVE-2012-2312
CWE-269
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.
2019-11-26
CVE-2011-3609
CWE-352
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
CVE-2011-3606
CWE-79
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
2017-10-24
CVE-2013-3734
CWE-255
** DISPUTED ** The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console.
>>>
Vendor:
Redhat
373
Products
Linux
Enterprise linux
Enterprise linux desktop
Linux powertools
Tmpwatch
Stronghold
Redhat package manager
Docbook stylesheets
Docbook utils
Pre-execution environment
Interchange
Linux advanced workstation
Rhmask
LV
Tcpdump
Analog real-time synthesizer
Kdebase
Kdelibs
Kdelibs devel
Kdelibs sound
Kdelibs sound devel
Wu ftpd
Daredevil skk
Ddskk-xemacs
Up2date
Pam smb
Sendmail
Kernel
Rsync
Bigmem kernel
Kernel doc
Kernel source
Openssl
Sysstat
Gdk pixbuf
LHA
Fedora core
Libpng
Sysreport
Open iscsi
Cluster suite
Network satelite server
Fedora
Conga
Mcstrans
Certificate server
Cairo
Network satellite server
Cygwin
Directory server
Fedora directory server
Nfs utils
Desktop
Enterprise linux desktop workstation
Desktop workstation
Fedora 8
Certificate system
Vsftpd
Adminutil
Enterprise ipa
Freeipa
Jboss enterprise application platform
Initscripts
CMAN
dogtag certificate system
Cluster project
Gfs2-utils
Rgmanager
Dogtag certificate system
Enterprise mrg
Spacewalk-java
Enterprise virtualization
Qspice
KVM
Network satellite
Yum-rhn-plugin
Enterprise virtualization hypervisor
Enterprise virtualization manager
Jboss enterprise service bus
Jboss enterprise soa platform
Evince
Spice-xpi
Spice-activex
LUCI
Icedtea
Jboss enterprise web platform
Jboss remoting
Icedtea-web
Policycoreutils
Libvirt
Jboss seam 2 framework
Policykit
System-config-firewall
System-config-printer
Jboss operations network
Automatic bug reporting tool
SOS
Dtach
Jboss community application server
Mod cluster
See all Products for Vendor
Redhat
Copyright
2024
, cxsecurity.com
Back to Top
Vulnerabilities for 'Jboss application server' 