eDeploy: Multiple tmp file race condition flaws

eDeploy has tmp file race condition flaws

eDeploy: Remote code execution due to eval() of untrusted data

eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data

eDeploy: Remote code execution due to cPickle deserialization of untrusted data

eDeploy has RCE via cPickle deserialization of untrusted data

KeyCloak: XSS in login status iframe

JBoss KeyCloak: XSS in login-status-iframe.html

KeyCloak: Soft Token deletion via CSRF

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

KeyCloak: Open redirect vulnerability

JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.

AeroGear: stored XSS via deviceToken

Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input.

AeroGear: reflected XSS via password field of the login page

JBoss AeroGear has reflected XSS via the password field

AeroGear: DDoS via deviceToken

The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached or can slow the server down by purposefully wasting it's time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on.

jersey: XXE via parameter entities

jersey: XXE via parameter entities not disabled by the jersey SAX parser

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did not step outside the appropriate root directory (e.g. the web application root), decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced where the Grails Resource Plugin before 1.2.13 returned the decoded version of the URI rather than the normalized version of the URI after the directory traversal check. This exposed a double decoding vulnerability. To address this issue, the Grails Resource Plugin now repeatedly decodes the URI up to three times or until decoding no longer changes the URI. If the decode limit of 3 is exceeded the URI is rejected. A side-effect of this is that the Grails Resource Plugin is unable to serve a resource that includes a '%' character in the full path to the resource. Not all environments are vulnerable because of the differences in URL resolving in different servlet containers. Applications deployed to Tomcat 8 and Jetty 9 were found not not be vulnerable, however applications deployed to JBoss EAP 6.3 / JBoss AS 7.4 and JBoss AS 7.1 were found to be vulnerable (other JBoss versions weren't tested). In certain cases JBoss returns JBoss specific vfs protocol urls from URL resolution methods (ClassLoader.getResources). The JBoss vfs URL protocol supports resolving any file on the filesystem. This made the directory traversal possible. There may be other containers, in addition to JBoss, on which this vulnerability is exposed.

php: post handler potential illegal efree() vulnerability

Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.

vtldap/ldaptive: Hostname verification susceptible to MITM attack

DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

REST: XXE due to insecure configuration of RestEasy

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy

Origin: XSS in team name

OpenShift Origin: Improperly validated team names could allow stored XSS attacks

libgcrypt: use ciphertext blinding for Elgamal decryption (new side-channel attack)

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

rhn_satellite_6: cross-site request forgery (CSRF) can force logout

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.

redhat-upgrade-tool: does not check GPG signatures on package installation

redhat-upgrade-tool: Does not check GPG signatures when upgrading versions

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.