CVSS: 8.8EPSS: 1%CPEs: 35EXPL: 0CVE-2011-1484 – JBoss Seam privilege escalation caused by EL interpolation in FacesMessages
https://notcve.org/view.php?id=CVE-2011-1484
27 Jul 2011 — jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application. jboss-seam.jar en el framework JBoss Seam 2 2.2.x y versiones ant... • http://www.redhat.com/support/errata/RHSA-2011-0460.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 21EXPL: 0CVE-2010-3708 – JBoss drools deserialization remote code execution
https://notcve.org/view.php?id=CVE-2010-3708
30 Dec 2010 — The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer. La implementación de la serialización de JBoss Drools en la plataforma de aplicaciones Red Hat JBoss Enterprise (JBoss EAP o JBEAP) 4.3 anteriores a 4.3.0.CP09 y JBoss Enterprise SOA Platform ... • http://securitytracker.com/id?1024813 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 22EXPL: 0CVE-2010-2474
https://notcve.org/view.php?id=CVE-2010-2474
09 Aug 2010 — JBoss Enterprise Service Bus (ESB) before 4.7 CP02 in JBoss Enterprise SOA Platform before 5.0.2 does not properly consider the security domain with which a service is secured, which might allow remote attackers to gain privileges by executing a service. JBoss Enterprise Service Bus (ESB) anterior a v4.7 CP02 en JBoss Enterprise SOA Platform anterior a v5.0.2 no considera apropiadamente el dominio de seguridad con el que un servicio está garantizado, lo que podría permitir a atacantes remotos ganar privileg... • http://secunia.com/advisories/40568 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 14EXPL: 0CVE-2010-2493
https://notcve.org/view.php?id=CVE-2010-2493
09 Aug 2010 — The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intend... • http://secunia.com/advisories/40681 • CWE-16: Configuration •