CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2012-2148
https://notcve.org/view.php?id=CVE-2012-2148
An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies Se presenta un problema en la funcionalidad property replacements en cualquier descriptor en JBoxx AS versión 7.1.1 ignora las políticas de seguridad de Java. • https://access.redhat.com/security/cve/cve-2012-2148 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2148 https://security-tracker.debian.org/tracker/CVE-2012-2148 • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2012-4529 – Web: jsessionid exposed via encoded url when using cookie based session tracking
https://notcve.org/view.php?id=CVE-2012-4529
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log. El método org.apache.catalina.connector.Response.encodeURL en Red Hat JBoss Web 7.1.x y anteriores, cuando el modo de traceo está fijado a COOKIE, envia el parámetro jsessionid en la URL de la primera respuesta de una sesion, lo que permite a atacantes remotos obtener el id de sesion a treves de un ataque man-in-the-middle o leyendo un log • http://ocpsoft.org/support/topic/session-id-is-appended-as-url-path-parameter-in-very-first-request http://rhn.redhat.com/errata/RHSA-2013-0833.html http://rhn.redhat.com/errata/RHSA-2013-0834.html http://rhn.redhat.com/errata/RHSA-2013-0839.html http://rhn.redhat.com/errata/RHSA-2013-1437.html https://issues.jboss.org/browse/JBWEB-249 https://access.redhat.com/security/cve/CVE-2012-4529 https://bugzilla.redhat.com/show_bug.cgi?id=868202 •