CVSS: 6.5EPSS: 22%CPEs: 5EXPL: 1CVE-2015-0250 – Schneider Electric EcoStruxure Data Center Expert XML External Entity Processing Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2015-0250
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file. Vulnerabilidad de entidad externa XML (XXE) en los gráficos vectoriales redimensionables en las clases de conversión (1) PNG y (2) JPG en Apache Batik 1.x anterior a 1.8 permite a atacantes remotos leer ficheros arbitrarios o causar una denegación de servicio a través de un fichero de gráficos vectoriales redimensionables manipulado. It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Data Center Expert. • http://advisories.mageia.org/MGASA-2015-0138.html http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html http://rhn.redhat.com/errata/RHSA-2016-0041.html http://rhn.redhat.com/errata/RHSA-2016-0042.html http://seclists.org/fulldisclosure/2015/Mar/142 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://www.debian.org/security/2015/dsa-3205 http://www.mandriva.com/security/advisories?name=MDVSA-2015:203 http://www.securitytracker.com/id/1032781 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 3.6EPSS: 0%CPEs: 2EXPL: 0CVE-2014-0005 – PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application
https://notcve.org/view.php?id=CVE-2014-0005
PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application. PicketBox y JBossSX, utilizado en Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 y JBoss BRMS anterior a 6.0.3 roll up patch 2, permite a usuarios remotos autenticados leer y modificar la configuración y estado del servidor de la aplicación mediante el despliegue de una aplicación manipulada. It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution. • http://rhn.redhat.com/errata/RHSA-2014-0343.html http://rhn.redhat.com/errata/RHSA-2014-0344.html http://rhn.redhat.com/errata/RHSA-2014-0345.html http://rhn.redhat.com/errata/RHSA-2015-0234.html http://rhn.redhat.com/errata/RHSA-2015-0235.html http://rhn.redhat.com/errata/RHSA-2015-0720.html https://access.redhat.com/security/cve/CVE-2014-0005 https://bugzilla.redhat.com/show_bug.cgi?id=1049736 • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2014-3518 – 5: Remote code execution via unauthenticated JMX/RMI connector
https://notcve.org/view.php?id=CVE-2014-3518
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to execute arbitrary code via unspecified vectors. jmx-remoting.sar en JBoss Remoting, utilizado en Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2 y Red Hat JBoss SOA Platform 5.3.1, no implementa debidamente la especificación JSR 160, lo que permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados. JBoss Application Server 5 and supported Red Hat JBoss 5.x products contain JBoss Remoting, which includes a partial implementation of the JMX remoting specification JSR 160. This implementation is provided in jmx-remoting.sar, which is deployed by default in unsupported community releases of JBoss Application Server 5.x. This implementation does not implement security as defined in JSR 160, and therefore does not apply any authentication or authorization constraints. A remote attacker could use this flaw to potentially execute arbitrary code on a vulnerable server. • http://rhn.redhat.com/errata/RHSA-2014-0887.html https://access.redhat.com/security/cve/CVE-2014-3518 https://bugzilla.redhat.com/show_bug.cgi?id=1112545 https://access.redhat.com/solutions/1120423 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-306: Missing Authentication for Critical Function •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2013-6468 – Drools: Remote Java Code Execution in MVEL
https://notcve.org/view.php?id=CVE-2013-6468
JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression. JBoss Drools, Red Hat JBoss BRMS anterior a 6.0.1 y Red Hat JBoss BPM Suite anterior a 6.0.1 permite a usuarios remotos autenticados ejecutar código Java arbitrario a través de una expresión (1) MVFLEX Expression Language (MVEL) o (2) Drools • http://rhn.redhat.com/errata/RHSA-2014-0371.html http://rhn.redhat.com/errata/RHSA-2014-0372.html http://secunia.com/advisories/57716 http://secunia.com/advisories/57719 https://access.redhat.com/security/cve/CVE-2013-6468 https://bugzilla.redhat.com/show_bug.cgi?id=1051261 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2013-2186 – commons-fileupload: Arbitrary file upload via deserialization
https://notcve.org/view.php?id=CVE-2013-2186
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance. La clase DiskFileItem en Apache Commons FileUpload, tal como se utiliza en Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2 y 6.0.0; y Red Hat JBoss Web Server 1.0.2 permite a atacantes remotos escribir en archivos arbitrarios a través de un byte NULL en un nombre de archivo en una instancia serializada. • http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html http://rhn.redhat.com/errata/RHSA-2013-1428.html http://rhn.redhat.com/errata/RHSA-2013-1429.html http://rhn.redhat.com/errata/RHSA-2013-1430.html http://rhn.redhat.com/errata/RHSA-2013-1442.html http://rhn.redhat.com/errata/RHSA-2013-1448.html http://secunia.com/advis • CWE-20: Improper Input Validation CWE-626: Null Byte Interaction Error (Poison Null Byte) •