Filtered by vendor Redhat Subscriptions
Filtered by product Jboss Application Server Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2007-1354 2 Jboss, Redhat 2 Jboss Application Server, Jboss Application Server 2024-08-07 N/A
The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode.
CVE-2011-3606 1 Redhat 1 Jboss Application Server 2024-08-06 5.4 Medium
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
CVE-2011-3609 1 Redhat 1 Jboss Application Server 2024-08-06 6.5 Medium
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
CVE-2012-2312 1 Redhat 2 Jboss Application Server, Jboss Enterprise Application Platform 2024-08-06 7.8 High
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.
CVE-2012-1094 1 Redhat 1 Jboss Application Server 2024-08-06 7.5 High
JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
CVE-2013-3734 1 Redhat 1 Jboss Application Server 2024-08-06 N/A
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console