Vulnerability-Lookup

RHSA-2013_0192

Vulnerability from csaf_redhat - Published: 2013-01-24 18:27 - Updated: 2024-12-15 18:22

Summary

Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update

Severity

Important

Notes

Topic: Updated JBoss Enterprise Application Platform 5.2.0 packages that fix multiple security issues, various bugs, and add several enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. This JBoss Enterprise Application Platform 5.2.0 release serves as a replacement for JBoss Enterprise Application Platform 5.1.2, and includes bug fixes and enhancements. Refer to the JBoss Enterprise Application Platform 5.2.0 Release Notes for information on the most significant of these changes. The Release Notes will be available shortly from https://access.redhat.com/knowledge/docs/

Details: An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. (CVE-2011-1096) JBoss Web Services leaked side-channel data when distributing symmetric keys (for XML encryption), allowing a remote attacker to recover the entire plain text form of a symmetric key. (CVE-2011-2487) Spring framework could possibly evaluate Expression Language (EL) expressions twice, allowing a remote attacker to execute arbitrary code in the context of the application server, or to obtain sensitive information from the server. Manual action is required to apply this fix. Refer to the Solution section. (CVE-2011-2730) Apache CXF checked to ensure XML elements were signed or encrypted by a Supporting Token, but not whether the correct token was used. A remote attacker could transmit confidential information without the appropriate security, and potentially circumvent access controls on web services exposed via Apache CXF. Refer to the Solution section for details. (CVE-2012-2379) When an application used FORM authentication, along with another component that calls request.setUserPrincipal() before the call to FormAuthenticator#authenticate() (such as the Single-Sign-On valve), it was possible to bypass the security constraint checks in the FORM authenticator by appending "/j_security_check" to the end of a URL. (CVE-2012-3546) The JMX Console was vulnerable to CSRF attacks, allowing a remote attacker to hijack the authenticated JMX Console session of an administrator. (CVE-2011-2908) An XSS flaw allowed a remote attacker to perform an XSS attack against victims using the JMX Console. (CVE-2011-4575) SecurityAssociation.getCredential() returned the previous credential if no security context was provided. Depending on the deployed applications, this could possibly allow a remote attacker to hijack the credentials of a previously-authenticated user. (CVE-2012-3370) Configuring the JMX Invoker to restrict access to users with specific roles did not actually restrict access, allowing remote attackers with valid JMX Invoker credentials to perform JMX operations accessible to roles they are not a member of. (CVE-2012-5478) twiddle.sh accepted credentials as command line arguments, allowing local users to view them via a process listing. (CVE-2009-5066) NonManagedConnectionFactory logged the username and password in plain text when an exception was thrown. This could lead to the exposure of authentication credentials if local users had permissions to read the log file. (CVE-2012-0034) The JMXInvokerHAServlet and EJBInvokerHAServlet invoker servlets allow unauthenticated access by default in some profiles. The security interceptor's second layer of authentication prevented direct exploitation of this flaw. If the interceptor was misconfigured or inadvertently disabled, this flaw could lead to arbitrary code execution in the context of the user running the JBoss server. (CVE-2012-0874) The JGroups diagnostics service was enabled with no authentication when a JGroups channel was started, allowing attackers on the adjacent network to read diagnostic information. (CVE-2012-2377) CallerIdentityLoginModule retained the password from the previous call if a null password was provided. In non-default configurations this could possibly lead to a remote attacker hijacking a previously-authenticated user's session. (CVE-2012-3369) Red Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum for reporting CVE-2011-1096 and CVE-2011-2487; the Apache CXF project for reporting CVE-2012-2379; and Tyler Krpata for reporting CVE-2011-4575. CVE-2012-3370 and CVE-2012-3369 were discovered by Carlo de Wolf of Red Hat; CVE-2012-5478 discovered by Derek Horton of Red Hat; CVE-2012-0874 discovered by David Jorm of Red Hat; and CVE-2012-2377 was discovered by Red Hat.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2009-5066

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.

2.1 ()


                
                  AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

Fixed 227 products

Product	Version	Remediation
Unresolved product id: 5Server-JBEAP-5:aopalliance-0:1.0-5.2.jdk6.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:aopalliance-0:1.0-5.2.jdk6.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:apache-cxf-0:2.2.12-6.1.patch_04.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:apache-cxf-0:2.2.12-6.1.patch_04.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:bsh2-0:2.0-0.b4.15.1.patch01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:bsh2-0:2.0-0.b4.15.1.patch01.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:bsh2-bsf-0:2.0-0.b4.15.1.patch01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:glassfish-jaxb-0:2.1.12-12_patch_03.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:glassfish-jaxb-0:2.1.12-12_patch_03.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:google-guice-0:2.0-3.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:google-guice-0:2.0-3.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-1:3.3.2-1.5.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-1:3.3.2-1.5.GA_CP05.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-annotations-0:3.4.0-3.3.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-annotations-0:3.4.0-3.3.GA_CP05.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-annotations-javadoc-0:3.4.0-3.3.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-entitymanager-0:3.4.0-4.4.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-entitymanager-0:3.4.0-4.4.GA_CP05.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-entitymanager-javadoc-0:3.4.0-4.4.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-javadoc-1:3.3.2-1.5.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-search-0:3.1.1-2.4.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-search-0:3.1.1-2.4.GA_CP05.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hibernate3-search-javadoc-0:3.1.1-2.4.GA_CP05.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hornetq-0:2.2.24-1.EAP.GA.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hornetq-0:2.2.24-1.EAP.GA.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hornetq-native-0:2.2.20-1.EAP.GA.1.ep5.el5.i386	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hornetq-native-0:2.2.20-1.EAP.GA.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:hornetq-native-0:2.2.20-1.EAP.GA.1.ep5.el5.x86_64	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jacorb-jboss-0:2.3.2-2.jboss_1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jacorb-jboss-0:2.3.2-2.jboss_1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:javassist-0:3.12.0-6.SP1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:javassist-0:3.12.0-6.SP1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-aop2-0:2.1.6-5.CP06.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-aop2-0:2.1.6-5.CP06.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-bootstrap-0:1.0.2-1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-bootstrap-0:1.0.2-1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cache-core-0:3.2.11-1.GA.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cache-core-0:3.2.11-1.GA.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cache-pojo-0:3.0.1-1.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cache-pojo-0:3.0.1-1.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cl-0:2.0.11-1.GA.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cl-0:2.0.11-1.GA.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cluster-ha-server-api-0:1.2.1-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-cluster-ha-server-api-0:1.2.1-2.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-common-beans-0:1.0.1-2.1.Final.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-common-beans-0:1.0.1-2.1.Final.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-common-core-0:2.2.21-1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-common-core-0:2.2.21-1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-eap5-native-0:5.2.0-6.ep5.el5.i386	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-eap5-native-0:5.2.0-6.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-eap5-native-0:5.2.0-6.ep5.el5.x86_64	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb-3.0-api-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-cache-0:1.0.0-4.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-cache-0:1.0.0-4.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-core-0:1.3.9-0.4.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-core-0:1.3.9-0.4.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-ext-api-0:1.0.0-4.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-ext-api-0:1.0.0-4.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-ext-api-impl-0:1.0.0-3.7.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-ext-api-impl-0:1.0.0-3.7.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-interceptors-0:1.0.9-0.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-interceptors-0:1.0.9-0.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-metadata-0:1.0.0-3.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-metadata-0:1.0.0-3.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-metrics-deployer-0:1.1.1-0.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-metrics-deployer-0:1.1.1-0.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-security-0:1.0.2-0.5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-security-0:1.0.2-0.5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-timeout-0:0.1.1-0.5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-timeout-0:0.1.1-0.5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-timeout-3.0-api-0:0.1.1-0.5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-timeout-spi-0:0.1.1-0.5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-transactions-0:1.0.2-1.4.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-ejb3-transactions-0:1.0.2-1.4.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jacc-1.1-api-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jad-1.2-api-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jaspi-1.0-api-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-javaee-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-javaee-0:5.0.2-2.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-javaee-poms-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jaxrpc-api_1.1_spec-0:1.0.0-16.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jaxrpc-api_1.1_spec-0:1.0.0-16.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jca-1.5-api-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jms-1.1-api-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jpa-deployers-0:1.0.0-6.1SP2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-jpa-deployers-0:1.0.0-6.1SP2.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-logmanager-0:1.1.2-6.GA_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-logmanager-0:1.1.2-6.GA_patch_01.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-messaging-0:1.4.8-12.SP9.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-messaging-0:1.4.8-12.SP9.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-naming-0:5.0.3-5.1.CP02.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-naming-0:5.0.3-5.1.CP02.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-reflect-0:2.0.4-2.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-reflect-0:2.0.4-2.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-remoting-0:2.5.4-10.SP4.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-remoting-0:2.5.4-10.SP4.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-10.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-10.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-10.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-10.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-10.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-security-negotiation-0:2.1.3-1.GA.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-security-negotiation-0:2.1.3-1.GA.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-security-spi-1:2.0.5-4.SP3_1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-security-spi-1:2.0.5-4.SP3_1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-transaction-1.0.1-api-0:5.0.2-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-vfs2-0:2.2.1-4.GA.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jboss-vfs2-0:2.2.1-4.GA.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-0:5.2.0-14.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-0:5.2.0-14.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-client-0:5.2.0-14.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-hornetq-0:5.2.0-5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-hornetq-0:5.2.0-5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-messaging-0:5.2.0-14.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-tp-licenses-0:5.2.0-7.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-tp-licenses-0:5.2.0-7.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-ws-cxf-0:5.2.0-7.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-ws-cxf-0:5.2.0-7.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossas-ws-native-0:5.2.0-14.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbosssx2-0:2.0.5-8.SP3_1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbosssx2-0:2.0.5-8.SP3_1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossts-1:4.6.1-12.CP13.8.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossts-1:4.6.1-12.CP13.8.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossts-javadoc-1:4.6.1-12.CP13.8.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossweb-0:2.1.13-2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossweb-0:2.1.13-2_patch_01.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossweb-el-1.0-api-0:2.1.13-2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossweb-jsp-2.1-api-0:2.1.13-2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossweb-lib-0:2.1.13-2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossweb-servlet-2.5-api-0:2.1.13-2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-0:3.1.2-13.SP15_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-0:3.1.2-13.SP15_patch_01.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-common-0:1.1.0-9.SP10.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-common-0:1.1.0-9.SP10.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-framework-0:3.1.2-9.SP13.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-framework-0:3.1.2-9.SP13.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-spi-0:1.1.2-6.SP8.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jbossws-spi-0:1.1.2-6.SP8.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jgroups-1:2.6.22-1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jgroups-1:2.6.22-1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-embedded-0:1.3.4-19.SP6.9.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-embedded-0:1.3.4-19.SP6.9.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-hibernate-plugin-0:3.0.0-14.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-hibernate-plugin-0:3.0.0-14.EmbJopr5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-jboss-as-5-plugin-0:3.0.0-14.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-jboss-as-5-plugin-0:3.0.0-14.EmbJopr5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-jboss-cache-v3-plugin-0:3.0.0-15.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:jopr-jboss-cache-v3-plugin-0:3.0.0-15.EmbJopr5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-0:1.0.10-12.2.GA_CP04.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-demo-0:1.0.10-12.2.GA_CP04.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-jbossas-0:1.0.10-12.2.GA_CP04.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-jbossweb2-0:1.0.10-12.2.GA_CP04.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-native-0:1.0.10-10.GA_CP04_patch01.ep5.el5.i386	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-native-0:1.0.10-10.GA_CP04_patch01.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-native-0:1.0.10-10.GA_CP04_patch01.ep5.el5.x86_64	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:mod_cluster-tomcat6-0:1.0.10-12.2.GA_CP04.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:netty-0:3.2.5-6.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:netty-0:3.2.5-6.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:picketlink-federation-0:2.1.5-3.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:picketlink-federation-0:2.1.5-3.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:picketlink-quickstarts-0:2.1.5-1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:picketlink-quickstarts-0:2.1.5-1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:picketlink-quickstarts-idp-0:2.1.5-1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:picketlink-quickstarts-pdp-0:2.1.5-1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:picketlink-quickstarts-sts-0:2.1.5-1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:resteasy-0:1.2.1-18.CP02_patch02.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:resteasy-0:1.2.1-18.CP02_patch02.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:resteasy-examples-0:1.2.1-18.CP02_patch02.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:resteasy-javadoc-0:1.2.1-18.CP02_patch02.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:resteasy-manual-0:1.2.1-18.CP02_patch02.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rh-eap-docs-0:5.2.0-6.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rh-eap-docs-0:5.2.0-6.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rh-eap-docs-examples-0:5.2.0-6.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-0:3.0.0-21.EmbJopr5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-ant-bundle-common-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-common-parent-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-client-api-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-comm-api-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-dbutils-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-domain-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-gui-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-native-system-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-parent-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-plugin-api-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-plugin-container-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-plugindoc-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-core-util-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-filetemplate-bundle-common-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-helpers-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-jboss-as-common-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-jmx-plugin-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-jmx-plugin-0:3.0.0-21.EmbJopr5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-modules-parent-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-parent-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-platform-plugin-0:3.0.0-14.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-platform-plugin-0:3.0.0-14.EmbJopr5.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-plugin-validator-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-pluginAnnotations-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-pluginGen-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-plugins-parent-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:rhq-rtfilter-0:3.0.0-21.EmbJopr5.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-0:2.5.6-9.SEC03.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-0:2.5.6-9.SEC03.1.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-agent-0:2.5.6-9.SEC03.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-all-0:2.5.6-9.SEC03.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-aop-0:2.5.6-9.SEC03.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-beans-0:2.5.6-9.SEC03.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-context-0:2.5.6-9.SEC03.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:spring2-core-0:2.5.6-9.SEC03.1.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:wss4j-0:1.5.12-4.1_patch_02.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:wss4j-0:1.5.12-4.1_patch_02.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xerces-j2-0:2.9.1-10.patch02.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xerces-j2-0:2.9.1-10.patch02.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xerces-j2-scripts-0:2.9.1-10.patch02.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-0:1.3.04-8.2_patch_01.ep5.el5.src	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-jaxp-1.1-apis-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-jaxp-1.2-apis-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-jaxp-1.3-apis-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-resolver10-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-resolver11-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-resolver12-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-which10-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-commons-which11-0:1.3.04-8.2_patch_01.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-security-0:1.5.1-2.ep5.el5.noarch	—	Vendor Fix fix
Unresolved product id: 5Server-JBEAP-5:xml-security-0:1.5.1-2.ep5.el5.src	—	Vendor Fix fix

Threats

Impact Low

CVE-2011-1096

The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses, aka "character encoding pattern attack."

7.8 ()


                
                  AV:N/AC:L/Au:N/C:C/I:N/A:N

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Important

CVE-2011-2487

A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS#1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks.

7.8 ()


                
                  AV:N/AC:L/Au:N/C:C/I:N/A:N

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Important

CVE-2011-2730

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

6.4 ()


                
                  AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Important

CVE-2011-2908

Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors.

4.6 ()


                
                  AV:N/AC:H/Au:S/C:P/I:P/A:P

CWE-352 - Cross-Site Request Forgery (CSRF)

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Moderate

CVE-2011-4575

It was found that the parameters passed to operation invocations on the JMX console were not properly sanitized. Remote attackers could use this flaw to inject arbitrary web script or HTML into the JMX console.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Moderate

CVE-2012-0034

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.

1.0 ()


                
                  AV:L/AC:H/Au:S/C:P/I:N/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Low

CVE-2012-0874

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Low

CVE-2012-2377

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.

3.3 ()


                
                  AV:A/AC:L/Au:N/C:P/I:N/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Low

CVE-2012-2379

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

5.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Important

CVE-2012-3369

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used.

4.0 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Low

CVE-2012-3370

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users.

5.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Moderate

CVE-2012-3546

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.

5.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Important

CVE-2012-5478

The AuthorizationInterceptor in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 does not properly restrict access, which allows remote authenticated users to bypass intended role restrictions and perform arbitrary JMX operations via unspecified vectors.

4.9 ()


                
                  AV:N/AC:M/Au:S/C:P/I:P/A:N

Affected products

Fixed 227 products, the same list as for CVE-2009-5066

Threats

Impact Moderate

References

77 references

URL	Category
https://access.redhat.com/errata/RHSA-2013:0192	self
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/knowledge/docs/	external
https://bugzilla.redhat.com/show_bug.cgi?id=681916	external
https://bugzilla.redhat.com/show_bug.cgi?id=713539	external
https://bugzilla.redhat.com/show_bug.cgi?id=730176	external
https://bugzilla.redhat.com/show_bug.cgi?id=737608	external
https://bugzilla.redhat.com/show_bug.cgi?id=760387	external
https://bugzilla.redhat.com/show_bug.cgi?id=772835	external
https://bugzilla.redhat.com/show_bug.cgi?id=795645	external
https://bugzilla.redhat.com/show_bug.cgi?id=823392	external
https://bugzilla.redhat.com/show_bug.cgi?id=826534	external
https://bugzilla.redhat.com/show_bug.cgi?id=836451	external
https://bugzilla.redhat.com/show_bug.cgi?id=836456	external
https://bugzilla.redhat.com/show_bug.cgi?id=842477	external
https://bugzilla.redhat.com/show_bug.cgi?id=848623	external
https://bugzilla.redhat.com/show_bug.cgi?id=874349	external
https://bugzilla.redhat.com/show_bug.cgi?id=883634	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2009-5066	self
https://bugzilla.redhat.com/show_bug.cgi?id=842477	external
https://www.cve.org/CVERecord?id=CVE-2009-5066	external
https://nvd.nist.gov/vuln/detail/CVE-2009-5066	external
https://access.redhat.com/security/cve/CVE-2011-1096	self
https://bugzilla.redhat.com/show_bug.cgi?id=681916	external
https://www.cve.org/CVERecord?id=CVE-2011-1096	external
https://nvd.nist.gov/vuln/detail/CVE-2011-1096	external
https://access.redhat.com/security/cve/CVE-2011-2487	self
https://bugzilla.redhat.com/show_bug.cgi?id=713539	external
https://www.cve.org/CVERecord?id=CVE-2011-2487	external
https://nvd.nist.gov/vuln/detail/CVE-2011-2487	external
https://www.nds.ruhr-uni-bochum.de/research/publi…	external
https://access.redhat.com/security/cve/CVE-2011-2730	self
https://bugzilla.redhat.com/show_bug.cgi?id=737608	external
https://www.cve.org/CVERecord?id=CVE-2011-2730	external
https://nvd.nist.gov/vuln/detail/CVE-2011-2730	external
https://access.redhat.com/security/cve/CVE-2011-2908	self
https://bugzilla.redhat.com/show_bug.cgi?id=730176	external
https://www.cve.org/CVERecord?id=CVE-2011-2908	external
https://nvd.nist.gov/vuln/detail/CVE-2011-2908	external
https://access.redhat.com/security/cve/CVE-2011-4575	self
https://bugzilla.redhat.com/show_bug.cgi?id=760387	external
https://www.cve.org/CVERecord?id=CVE-2011-4575	external
https://nvd.nist.gov/vuln/detail/CVE-2011-4575	external
https://access.redhat.com/security/cve/CVE-2012-0034	self
https://bugzilla.redhat.com/show_bug.cgi?id=772835	external
https://www.cve.org/CVERecord?id=CVE-2012-0034	external
https://nvd.nist.gov/vuln/detail/CVE-2012-0034	external
https://access.redhat.com/security/cve/CVE-2012-0874	self
https://bugzilla.redhat.com/show_bug.cgi?id=795645	external
https://www.cve.org/CVERecord?id=CVE-2012-0874	external
https://nvd.nist.gov/vuln/detail/CVE-2012-0874	external
https://access.redhat.com/security/cve/CVE-2012-2377	self
https://bugzilla.redhat.com/show_bug.cgi?id=823392	external
https://www.cve.org/CVERecord?id=CVE-2012-2377	external
https://nvd.nist.gov/vuln/detail/CVE-2012-2377	external
https://access.redhat.com/security/cve/CVE-2012-2379	self
https://bugzilla.redhat.com/show_bug.cgi?id=826534	external
https://www.cve.org/CVERecord?id=CVE-2012-2379	external
https://nvd.nist.gov/vuln/detail/CVE-2012-2379	external
http://cxf.apache.org/cve-2012-2379.html	external
https://access.redhat.com/security/cve/CVE-2012-3369	self
https://bugzilla.redhat.com/show_bug.cgi?id=836451	external
https://www.cve.org/CVERecord?id=CVE-2012-3369	external
https://nvd.nist.gov/vuln/detail/CVE-2012-3369	external
https://access.redhat.com/security/cve/CVE-2012-3370	self
https://bugzilla.redhat.com/show_bug.cgi?id=836456	external
https://www.cve.org/CVERecord?id=CVE-2012-3370	external
https://nvd.nist.gov/vuln/detail/CVE-2012-3370	external
https://access.redhat.com/security/cve/CVE-2012-3546	self
https://bugzilla.redhat.com/show_bug.cgi?id=883634	external
https://www.cve.org/CVERecord?id=CVE-2012-3546	external
https://nvd.nist.gov/vuln/detail/CVE-2012-3546	external
https://access.redhat.com/security/cve/CVE-2012-5478	self
https://bugzilla.redhat.com/show_bug.cgi?id=874349	external
https://www.cve.org/CVERecord?id=CVE-2012-5478	external
https://nvd.nist.gov/vuln/detail/CVE-2012-5478	external

Acknowledgments

Ruhr-University Bochum Juraj Somorovsky

Tyler Krpata

Red Hat Security Response Team David Jorm

Apache CXF project

Red Hat Carlo de Wolf

Red Hat Derek Horton

JSON

To clipboard

Loading 1.0 MB of JSON…

CVE-2009-5066 (GCVE-0-2009-5066)

Vulnerability from cvelistv5 – Published: 2012-08-13 20:00 – Updated: 2024-08-07 07:24

Summary

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

16 references

URL	Tags
http://www.openwall.com/lists/oss-security/2012/07/23/2	mailing-listx_refsource_MLIST
http://objectopia.com/2009/10/01/securing-jmx-inv…	x_refsource_MISC
https://issues.jboss.org/browse/JBPAPP-3391?_sscc=t	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0221.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/52054	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0533.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2012/07/20/1	mailing-listx_refsource_MLIST

Date Public

2009-10-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:24:54.004Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20120723 Re: CVE for JBOSS EAP 5.0(twiddle and jmx invocations) ?",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/07/23/2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.jboss.org/browse/JBPAPP-3391?_sscc=t"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0221",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "52054",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52054"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "name": "RHSA-2013:0533",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "name": "[oss-security] 20120720 CVE for JBOSS EAP 5.0(twiddle and jmx invocations) ?",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/07/20/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-01-13T17:57:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20120723 Re: CVE for JBOSS EAP 5.0(twiddle and jmx invocations) ?",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/07/23/2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.jboss.org/browse/JBPAPP-3391?_sscc=t"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0221",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "52054",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52054"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "name": "RHSA-2013:0533",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "name": "[oss-security] 20120720 CVE for JBOSS EAP 5.0(twiddle and jmx invocations) ?",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/07/20/1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-5066",
    "datePublished": "2012-08-13T20:00:00.000Z",
    "dateReserved": "2011-04-05T00:00:00.000Z",
    "dateUpdated": "2024-08-07T07:24:54.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-1096 (GCVE-0-2011-1096)

Vulnerability from cvelistv5 – Published: 2012-11-23 20:00 – Updated: 2024-08-06 22:14

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

31 references

URL	Tags
http://aktuell.ruhr-uni-bochum.de/pm2011/pm00330.…	x_refsource_MISC
http://cxf.apache.org/note-on-cve-2011-1096.html	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2012-1301.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=681916	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://coheigea.blogspot.com/2012/04/note-on-cve-…	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0221.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-1437.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/55770	vdb-entryx_refsource_BID
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/52054	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://rhn.redhat.com/errata/RHSA-2012-1344.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0261.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1330.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT
http://dl.acm.org/citation.cfm?id=2046756&dl=ACM&…	x_refsource_MISC
http://www.csoonline.com/article/692366/widely-us…	x_refsource_MISC
https://lists.apache.org/thread.html/8d5d29747548…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rc7742781358…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r36e44ffc1a9…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rff42cfa5e7d…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rd49aabd984e…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rec7160382ba…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfb87e0bf399…	mailing-listx_refsource_MLIST

Date Public

2011-10-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:14:27.617Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://aktuell.ruhr-uni-bochum.de/pm2011/pm00330.html.de"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cxf.apache.org/note-on-cve-2011-1096.html"
          },
          {
            "name": "RHSA-2012:1301",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1301.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=681916"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://coheigea.blogspot.com/2012/04/note-on-cve-2011-1096.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0221",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "RHSA-2013:1437",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1437.html"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "55770",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/55770"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "52054",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52054"
          },
          {
            "name": "jboss-web-services-cbc-info-disc(79031)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79031"
          },
          {
            "name": "RHSA-2012:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1344.html"
          },
          {
            "name": "RHSA-2013:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0261.html"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "name": "RHSA-2012:1330",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1330.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://dl.acm.org/citation.cfm?id=2046756\u0026dl=ACM\u0026coll=DL"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.csoonline.com/article/692366/widely-used-encryption-standard-is-insecure-say-experts"
          },
          {
            "name": "[cxf-commits] 20190326 svn commit: r1042570 [4/4] - in /websites/production/cxf/content: cache/docs.pageCache docs/jax-rs-http-signature.html docs/jax-rs-jose.html docs/jax-rs-oauth2.html docs/jax-rs-xml-security.html docs/secure-jax-rs-services.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8d5d29747548a24cccdb7f3e2d4d599ffb7ffe4537426b3c9a852cf4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-10-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses, aka \"character encoding pattern attack.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-16T11:07:21.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://aktuell.ruhr-uni-bochum.de/pm2011/pm00330.html.de"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cxf.apache.org/note-on-cve-2011-1096.html"
        },
        {
          "name": "RHSA-2012:1301",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1301.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=681916"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://coheigea.blogspot.com/2012/04/note-on-cve-2011-1096.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0221",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "RHSA-2013:1437",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1437.html"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "55770",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/55770"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "52054",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52054"
        },
        {
          "name": "jboss-web-services-cbc-info-disc(79031)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79031"
        },
        {
          "name": "RHSA-2012:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1344.html"
        },
        {
          "name": "RHSA-2013:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0261.html"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "name": "RHSA-2012:1330",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1330.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://dl.acm.org/citation.cfm?id=2046756\u0026dl=ACM\u0026coll=DL"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.csoonline.com/article/692366/widely-used-encryption-standard-is-insecure-say-experts"
        },
        {
          "name": "[cxf-commits] 20190326 svn commit: r1042570 [4/4] - in /websites/production/cxf/content: cache/docs.pageCache docs/jax-rs-http-signature.html docs/jax-rs-jose.html docs/jax-rs-oauth2.html docs/jax-rs-xml-security.html docs/secure-jax-rs-services.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8d5d29747548a24cccdb7f3e2d4d599ffb7ffe4537426b3c9a852cf4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-1096",
    "datePublished": "2012-11-23T20:00:00.000Z",
    "dateReserved": "2011-02-24T00:00:00.000Z",
    "dateUpdated": "2024-08-06T22:14:27.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2487 (GCVE-0-2011-2487)

Vulnerability from cvelistv5 – Published: 2020-03-11 15:45 – Updated: 2024-08-06 23:00

Summary

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

Severity

No CVSS data available.

CWE

Other

Assigner

redhat redhat root

References

18 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=713539	x_refsource_MISC
https://www.nds.ruhr-uni-bochum.de/research/publi…	x_refsource_MISC
http://cxf.apache.org/note-on-cve-2011-2487.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0191.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0192.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0193.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0194.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0195.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0196.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0198.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0221.html	x_refsource_MISC
http://www.securityfocus.com/bid/57549	x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilit…	x_refsource_MISC
https://lists.apache.org/thread.html/r36e44ffc1a9…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rff42cfa5e7d…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rd49aabd984e…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rec7160382ba…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfb87e0bf399…	mailing-listx_refsource_MLIST

Impacted products

2 products

Vendor	Product	Version
Apache	WSS4J	Affected: before 1.6.5
Red Hat	JBossWS	Affected: unknown

Date Public

2013-01-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:00:33.988Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=713539"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://cxf.apache.org/note-on-cve-2011-2487.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/57549"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81737"
          },
          {
            "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WSS4J",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "before 1.6.5"
            }
          ]
        },
        {
          "product": "JBossWS",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "datePublic": "2013-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-16T11:06:54.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=713539"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://cxf.apache.org/note-on-cve-2011-2487.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/57549"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81737"
        },
        {
          "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-2487",
    "datePublished": "2020-03-11T15:45:46.000Z",
    "dateReserved": "2011-06-15T00:00:00.000Z",
    "dateUpdated": "2024-08-06T23:00:33.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2730 (GCVE-0-2011-2730)

Vulnerability from cvelistv5 – Published: 2012-12-05 17:00 – Updated: 2024-08-06 23:08

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

19 references

URL	Tags
http://support.springsource.com/security/cve-2011-2730	x_refsource_CONFIRM
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0221.html	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2012/dsa-2504	vendor-advisoryx_refsource_DEBIAN
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/55155	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/52054	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0533.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1029151	vdb-entryx_refsource_SECTRACK
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT
https://docs.google.com/document/d/1dc1xxO8UMFaGL…	x_refsource_MISC

Date Public

2011-09-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:08:23.793Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.springsource.com/security/cve-2011-2730"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0221",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
          },
          {
            "name": "DSA-2504",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2504"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "55155",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/55155"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "52054",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52054"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "name": "RHSA-2013:0533",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
          },
          {
            "name": "1029151",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1029151"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka \"Expression Language Injection.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-08T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.springsource.com/security/cve-2011-2730"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0221",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
        },
        {
          "name": "DSA-2504",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2504"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "55155",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/55155"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "52054",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52054"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "name": "RHSA-2013:0533",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
        },
        {
          "name": "1029151",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1029151"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-2730",
    "datePublished": "2012-12-05T17:00:00.000Z",
    "dateReserved": "2011-07-11T00:00:00.000Z",
    "dateUpdated": "2024-08-06T23:08:23.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2908 (GCVE-0-2011-2908)

Vulnerability from cvelistv5 – Published: 2012-11-23 20:00 – Updated: 2024-08-06 23:15

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

18 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2012-1165.html	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/54915	vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://secunia.com/advisories/50230	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1152.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/50549	third-party-advisoryx_refsource_SECUNIA
https://bugzilla.redhat.com/show_bug.cgi?id=730176	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1232.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT
http://www.osvdb.org/84530	vdb-entryx_refsource_OSVDB

Date Public

2011-08-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:15:31.651Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2012:1165",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1165.html"
          },
          {
            "name": "54915",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/54915"
          },
          {
            "name": "jboss-jmx-console-csrf(77549)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77549"
          },
          {
            "name": "50230",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50230"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "name": "RHSA-2012:1152",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1152.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "50549",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50549"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=730176"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "name": "RHSA-2012:1232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "name": "84530",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/84530"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2012:1165",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1165.html"
        },
        {
          "name": "54915",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/54915"
        },
        {
          "name": "jboss-jmx-console-csrf(77549)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77549"
        },
        {
          "name": "50230",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50230"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "name": "RHSA-2012:1152",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1152.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "50549",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50549"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=730176"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "name": "RHSA-2012:1232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "name": "84530",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/84530"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-2908",
    "datePublished": "2012-11-23T20:00:00.000Z",
    "dateReserved": "2011-07-27T00:00:00.000Z",
    "dateUpdated": "2024-08-06T23:15:31.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-4575 (GCVE-0-2011-4575)

Vulnerability from cvelistv5 – Published: 2013-02-05 23:11 – Updated: 2024-08-07 00:09

Summary

Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

14 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=760387	x_refsource_MISC
http://www.osvdb.org/89578	vdb-entryx_refsource_OSVDB
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0221.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/52054	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/57548	vdb-entryx_refsource_BID

Date Public

2013-01-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:09:18.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=760387"
          },
          {
            "name": "89578",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/89578"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0221",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "52054",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52054"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "name": "57548",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/57548"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-01-13T17:57:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=760387"
        },
        {
          "name": "89578",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/89578"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0221",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "52054",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52054"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "name": "57548",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/57548"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-4575",
    "datePublished": "2013-02-05T23:11:00.000Z",
    "dateReserved": "2011-11-29T00:00:00.000Z",
    "dateUpdated": "2024-08-07T00:09:18.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-0034 (GCVE-0-2012-0034)

Vulnerability from cvelistv5 – Published: 2013-02-05 23:11 – Updated: 2024-08-06 18:09

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

16 references

URL	Tags
http://www.osvdb.org/78259	vdb-entryx_refsource_OSVDB
https://bugzilla.redhat.com/show_bug.cgi?id=772835	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0221.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
https://issues.jboss.org/browse/JBCACHE-1612	x_refsource_CONFIRM
http://www.securityfocus.com/bid/51392	vdb-entryx_refsource_BID
http://rhn.redhat.com/errata/RHSA-2012-1072.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-0108.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/52054	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0533.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT

Date Public

2012-02-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:09:17.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "78259",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/78259"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=772835"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0221",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.jboss.org/browse/JBCACHE-1612"
          },
          {
            "name": "51392",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/51392"
          },
          {
            "name": "RHSA-2012:1072",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1072.html"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "RHSA-2012:0108",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-0108.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "52054",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52054"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "name": "RHSA-2013:0533",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-02-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-01-13T17:57:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "78259",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/78259"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=772835"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0221",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.jboss.org/browse/JBCACHE-1612"
        },
        {
          "name": "51392",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/51392"
        },
        {
          "name": "RHSA-2012:1072",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1072.html"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "RHSA-2012:0108",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-0108.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "52054",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52054"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "name": "RHSA-2013:0533",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-0034",
    "datePublished": "2013-02-05T23:11:00.000Z",
    "dateReserved": "2011-12-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T18:09:17.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-0874 (GCVE-0-2012-0874)

Vulnerability from cvelistv5 – Published: 2013-02-05 23:11 – Updated: 2024-08-06 18:38

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

18 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0221.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/57552	vdb-entryx_refsource_BID
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://securitytracker.com/id?1028042	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/52054	third-party-advisoryx_refsource_SECUNIA
http://archives.neohapsis.com/archives/bugtraq/20…	mailing-listx_refsource_BUGTRAQ
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=795645	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2013-0533.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://www.exploit-db.com/exploits/30211	exploitx_refsource_EXPLOIT-DB
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT

Date Public

2013-01-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:38:14.958Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0221",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "57552",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/57552"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "1028042",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1028042"
          },
          {
            "name": "52054",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52054"
          },
          {
            "name": "20131219 ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=795645"
          },
          {
            "name": "RHSA-2013:0533",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "name": "30211",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/30211"
          },
          {
            "name": "jboss-eap-jmxinvokerhaservlet-code-exec(81511)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81511"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors.  NOTE: this issue can only be exploited when the interceptor is not properly configured with a \"second layer of authentication,\" or when used in conjunction with other vulnerabilities that bypass this second layer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0221",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "57552",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/57552"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "1028042",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1028042"
        },
        {
          "name": "52054",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52054"
        },
        {
          "name": "20131219 ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=795645"
        },
        {
          "name": "RHSA-2013:0533",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "name": "30211",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/30211"
        },
        {
          "name": "jboss-eap-jmxinvokerhaservlet-code-exec(81511)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81511"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-0874",
    "datePublished": "2013-02-05T23:11:00.000Z",
    "dateReserved": "2012-01-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T18:38:14.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2377 (GCVE-0-2012-2377)

Vulnerability from cvelistv5 – Published: 2012-11-23 20:00 – Updated: 2024-08-06 19:34

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

19 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2012-1028.html	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/54183	vdb-entryx_refsource_BID
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/50084	third-party-advisoryx_refsource_SECUNIA
http://www.osvdb.org/83085	vdb-entryx_refsource_OSVDB
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/50549	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=823392	x_refsource_MISC
http://secunia.com/advisories/49669	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2012-1232.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1125.html	vendor-advisoryx_refsource_REDHAT

Date Public

2012-06-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:34:23.942Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2012:1028",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1028.html"
          },
          {
            "name": "54183",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/54183"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "50084",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50084"
          },
          {
            "name": "83085",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/83085"
          },
          {
            "name": "jboss-jgroups-info-disc(76540)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76540"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "50549",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50549"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=823392"
          },
          {
            "name": "49669",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49669"
          },
          {
            "name": "RHSA-2012:1232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "name": "RHSA-2012:1125",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1125.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-06-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2012:1028",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1028.html"
        },
        {
          "name": "54183",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/54183"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "50084",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50084"
        },
        {
          "name": "83085",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/83085"
        },
        {
          "name": "jboss-jgroups-info-disc(76540)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76540"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "50549",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50549"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=823392"
        },
        {
          "name": "49669",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49669"
        },
        {
          "name": "RHSA-2012:1232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "name": "RHSA-2012:1125",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1125.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2377",
    "datePublished": "2012-11-23T20:00:00.000Z",
    "dateReserved": "2012-04-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T19:34:23.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2379 (GCVE-0-2012-2379)

Vulnerability from cvelistv5 – Published: 2013-01-03 01:00 – Updated: 2024-08-06 19:34

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

24 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2012-1559.html	vendor-advisoryx_refsource_REDHAT
http://cxf.apache.org/cve-2012-2379.html	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-0192.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0198.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1594.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0195.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0196.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51607	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0193.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/51984	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2012-1592.html	vendor-advisoryx_refsource_REDHAT
http://svn.apache.org/viewvc?view=revision&revisi…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-0191.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1593.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1573.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1591.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0197.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-0194.html	vendor-advisoryx_refsource_REDHAT
https://lists.apache.org/thread.html/rc7742781358…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r36e44ffc1a9…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rff42cfa5e7d…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rd49aabd984e…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rec7160382ba…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfb87e0bf399…	mailing-listx_refsource_MLIST

Date Public

2012-05-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:34:23.874Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2012:1559",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1559.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cxf.apache.org/cve-2012-2379.html"
          },
          {
            "name": "RHSA-2013:0192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
          },
          {
            "name": "RHSA-2013:0198",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
          },
          {
            "name": "RHSA-2012:1594",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1594.html"
          },
          {
            "name": "RHSA-2013:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
          },
          {
            "name": "RHSA-2013:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
          },
          {
            "name": "51607",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51607"
          },
          {
            "name": "RHSA-2013:0193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
          },
          {
            "name": "51984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51984"
          },
          {
            "name": "RHSA-2012:1592",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1592.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1338219"
          },
          {
            "name": "RHSA-2013:0191",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
          },
          {
            "name": "RHSA-2012:1593",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1593.html"
          },
          {
            "name": "RHSA-2012:1573",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1573.html"
          },
          {
            "name": "RHSA-2012:1591",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1591.html"
          },
          {
            "name": "RHSA-2013:0197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
          },
          {
            "name": "RHSA-2013:0194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
          },
          {
            "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-05-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-16T11:07:02.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2012:1559",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1559.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cxf.apache.org/cve-2012-2379.html"
        },
        {
          "name": "RHSA-2013:0192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
        },
        {
          "name": "RHSA-2013:0198",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
        },
        {
          "name": "RHSA-2012:1594",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1594.html"
        },
        {
          "name": "RHSA-2013:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
        },
        {
          "name": "RHSA-2013:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
        },
        {
          "name": "51607",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51607"
        },
        {
          "name": "RHSA-2013:0193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
        },
        {
          "name": "51984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51984"
        },
        {
          "name": "RHSA-2012:1592",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1592.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1338219"
        },
        {
          "name": "RHSA-2013:0191",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
        },
        {
          "name": "RHSA-2012:1593",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1593.html"
        },
        {
          "name": "RHSA-2012:1573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1573.html"
        },
        {
          "name": "RHSA-2012:1591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1591.html"
        },
        {
          "name": "RHSA-2013:0197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
        },
        {
          "name": "RHSA-2013:0194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
        },
        {
          "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2379",
    "datePublished": "2013-01-03T01:00:00.000Z",
    "dateReserved": "2012-04-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T19:34:23.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2013_0192

CVE-2009-5066 (GCVE-0-2009-5066)

CVE-2011-1096 (GCVE-0-2011-1096)

CVE-2011-2487 (GCVE-0-2011-2487)

CVE-2011-2730 (GCVE-0-2011-2730)

CVE-2011-2908 (GCVE-0-2011-2908)

CVE-2011-4575 (GCVE-0-2011-4575)

CVE-2012-0034 (GCVE-0-2012-0034)

CVE-2012-0874 (GCVE-0-2012-0874)

CVE-2012-2377 (GCVE-0-2012-2377)

CVE-2012-2379 (GCVE-0-2012-2379)

Tags

Sightings

Nomenclature