CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0CVE-2009-1380 – jbossas JMX-Console cross-site-scripting in filter parameter
https://notcve.org/view.php?id=CVE-2009-1380
15 Dec 2009 — Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en JMX-Console en JBossAs en Red Hat JBoss Enterprise Application Platform (tambien conocida... • http://secunia.com/advisories/37671 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2009-0027 – JBoss EAP unprivileged local xml file access
https://notcve.org/view.php?id=CVE-2009-0027
09 Mar 2009 — The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read arbitrary XML files via a crafted request. El manejador de solicitudes de JBossWS en JBoss Enterprise Application Platform (alias JBoss o JBEAP PEA) 4.2 antes de 4.2.0.CP06 y 4.3 antes de 4.3.0.CP04 no valida la rut... • http://rhn.redhat.com/errata/RHSA-2009-0346.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2008-3519 – JBossEAP allows download of non-EJB class files
https://notcve.org/view.php?id=CVE-2008-3519
23 Sep 2008 — The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273. La configuración por defecto del componente JBossAs en Red Hat JBoss Enterprise Application Platform (... • http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=458823 • CWE-16: Configuration •
CVSS: 5.4EPSS: 34%CPEs: 9EXPL: 5CVE-2008-0455 – Apache 2.2.6 mod_negotiation - HTML Injection / HTTP Response Splitting
https://notcve.org/view.php?id=CVE-2008-0455
25 Jan 2008 — Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a req... • https://www.exploit-db.com/exploits/31052 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •