David Jorm

The issue arises from the different handling of default hostname by JBoss AS 7 and mod cluster, leading to a mismatch in the excluded-contexts list and potentially exposing the root context.

Name of the Vulnerable Software and Affected Versions: Nuxeo Platform versions 5.6.0 through 5.6.0 before HF27 Nuxeo Platform versions 5.8.0 through 5.8.0 before HF-01 Description: The issue allows remote attackers to execute arbitrary code via crafted serialized data because the RichFaces implementation does not restrict the classes for which deserialization methods can be called. Recommendations: For Nuxeo Platform versions 5.6.0 through 5.6.0 before HF27, apply Hotfix 27 to resolve the issue. For Nuxeo Platform versions 5.8.0 through 5.8.0 before HF-01, apply Hotfix 01 to resolve the issue.

An XML eXternal Entity (XXE) issue exists in an endpoint using XML transport, which lets a remote attacker obtain sensitive information.

The issue is related to reflected XSS in JBossWeb Bayeux.

The issue is related to Remote Code Execution (RCE) due to EL interpolation in logging.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

A missing permission check was found in The CLI in JBoss Operations Network, which does not properly check permissions. This allows JBoss ON users to perform management tasks and configuration changes with the privileges of the administrator user.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack user authentication for requests with unspecified impact. The exact vectors used for this exploitation are not specified.

Name of the Vulnerable Software and Affected Versions: Hawt.io (affected versions not specified) Description: The issue concerns the admin terminal in Hawt.io, which does not require authentication. This allows remote attackers to execute arbitrary commands via the `k` parameter. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Play versions prior to 2.2.6 Play versions 2.3.x prior to 2.3.5 Description: The issue is related to an XML external entity (XXE) vulnerability in the Java XML processing functionality. This might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data. Recommendations: For Play versions prior to 2.2.6, update to version 2.2.6 or later. For Play versions 2.3.x prior to 2.3.5, update to version 2.3.5 or later.

The issue concerns the custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight. This realm will authenticate any username and password combination, indicating a significant security flaw.

Name of the Vulnerable Software and Affected Versions: Ambari versions 1.2.0 through 2.2.2 Description: The issue allows for the potential execution of arbitrary system commands on the Ambari Server host during the generation of SSL certificates for hosts in an Ambari cluster. Recommendations: For Ambari versions 1.2.0 through 2.2.2, update to a version that contains a fix for this issue to prevent the execution of arbitrary system commands.

The issue is related to an XML external entity (XXE) vulnerability in the dashbuilder import facility. This vulnerability allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and potentially have other unspecified impacts by providing a crafted XML document.

Name of the Vulnerable Software and Affected Versions: Spring Framework versions 3.0.0 through 3.2.8 Spring Framework versions 4.0.0 through 4.0.4 Description: The issue arises when processing user-provided XML documents, as the Spring Framework did not disable by default the resolution of URI references in a DTD declaration, enabling an XXE attack. Recommendations: For Spring Framework versions 3.0.0 through 3.2.8, disable the resolution of URI references in DTD declarations to prevent XXE attacks. For Spring Framework versions 4.0.0 through 4.0.4, disable the resolution of URI references in DTD declarations to prevent XXE attacks.

The issue allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue. This means that an attacker can potentially access sensitive files on the system by exploiting this weakness.

The issue is related to an XML External Entity (XXE) problem in the REST API of the ovirt-engine in oVirt. This allows remote authenticated users to read arbitrary files and potentially have other impacts via unknown vectors.

The issue is related to the improper enforcement of "modify resource" permissions for remote authenticated users. Specifically, when a remote authenticated user deletes a plug-in configuration update from the group connection properties history, the activity is not recorded in the audit trail.

The issue allows local users to read or modify subdirectories and files within the root directory due to the use of 0777 permissions when installing a remote client. This could potentially allow users to obtain JON credentials.

The issue allows remote attackers to hijack agent sessions via an agent registration request without a security token.

The issue allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request when LDAP authentication is enabled and the LDAP bind account credentials are invalid.