CVE-2014-3529

apache-poi: XML eXternal Entity (XXE) flaw

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 4.3 Medium EPSS 12.8% KEV · Not listed

Vendors

Apache Redhat

Products

Poi Jboss Bpms Jboss Brms and 3 more

CVE-2014-3490

RESTEasy: XXE via parameter entities

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

CVSS 2.0 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Bpms Jboss Brms and 8 more

CVE-2014-3481

JAX-RS: Information disclosure via XML eXternal Entity (XXE)

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Data Grid Jboss Data Virtualization Jboss Enterprise Application Platform and 3 more

CVE-2014-3472

Security: Invalid EJB caller role check implementation

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVSS 2.0 · 4.9 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 2 more

CVE-2014-1904

Framework: cross-site scripting flaw when using Spring MVC

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

CVSS 2.0 · 4.3 Medium EPSS 6.9% KEV · Not listed

Vendors

Pivotal Software Redhat

Products

Spring Framework Jboss Amq Jboss Fuse

CVE-2014-0364

smack: IQ response spoofing

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

CVSS 2.0 · 5.0 Medium EPSS 6.2% KEV · Not listed

Vendors

Igniterealtime Redhat

Products

Smack Jboss Bpms Jboss Brms and 1 more

CVE-2014-0363

smack: incorrect X.509 certificate validation

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

CVSS 2.0 · 5.8 Medium EPSS 1.2% KEV · Not listed

Vendors

Igniterealtime Redhat

Products

Smack Jboss Bpms Jboss Brms and 1 more

CVE-2014-0193

netty: DoS via memory exhaustion during data aggregation

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Netty Redhat

Products

Netty Jboss Amq Jboss Bpms and 7 more

CVE-2014-0168

Jolokia: cross-site request forgery (CSRF)

Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Jolokia Redhat

Products

Jolokia Jboss Amq Jboss Fuse

CVE-2014-0112

struts2: ClassLoader manipulation via request parameters

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

CVSS 3.0 · 7.3 High EPSS 98.1% KEV · Not listed

Vendors

Apache Redhat

Products

Struts Jboss Fuse

CVE-2014-0110

CXF: Large invalid content could cause temporary space to fill

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Jboss Amq Jboss Bpms and 4 more

CVE-2014-0109

CXF: HTML content posted to SOAP endpoint could cause OOM errors

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Jboss Amq Jboss Bpms and 4 more

CVE-2014-0107

Xalan-Java: insufficient constraints in secure processing feature

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed

Vendors

Apache Oracle Redhat

Products

Xalan-java Webcenter Sites Enterprise Linux and 12 more

CVE-2014-0093

6: JSM policy not respected by deployed applications

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.

CVSS 2.0 · 5.8 Medium EPSS 2.1% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 2 more

CVE-2014-0085

Fuse: admin user cleartext password appears in logging

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss A-mq Jboss Amq Jboss Fuse

CVE-2014-0074

Shiro: successful authentication without specifying user name or password

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

CVSS 2.0 · 7.5 High EPSS 5.5% KEV · Not listed

Vendors

Apache Redhat

Products

Shiro Fuse Esb Enterprise Fuse Management Console and 3 more

CVE-2014-0058

EAP6: Plain text password logging during security audit

The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Bpms Jboss Brms Jboss Data Grid and 5 more

CVE-2014-0054

Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

CVSS 2.0 · 6.8 Medium EPSS 91.4% KEV · Not listed

Vendors

Redhat Springsource Vmware

Products

Jboss Amq Jboss Fuse Spring Framework and 1 more

CVE-2014-0035

CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 4.3 Medium EPSS 7.1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Jboss Amq Jboss Bpms and 4 more

CVE-2014-0034

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

CVSS 2.0 · 4.3 Medium EPSS 7.4% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Jboss Amq Jboss Bpms and 4 more