Red Hat Security Advisory

RHSA-2008:0158

JBoss Enterprise Application Platform security update

Released 2008-03-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Application Stack v1 for Enterprise Linux AS (v.4) concurrent-1.3.4-7jpp.ep1.6.el4, glassfish-jaf-1.1.0-0jpp.ep1.10.el4, glassfish-javamail-1.4.0-0jpp.ep1.8 +26
Red Hat Application Stack v1 for Enterprise Linux ES (v.4) concurrent-1.3.4-7jpp.ep1.6.el4, glassfish-jaf-1.1.0-0jpp.ep1.10.el4, glassfish-javamail-1.4.0-0jpp.ep1.8 +26

Fixes 5 records

TI-2007-04429 CVE-2007-4575 · GHSA-583w-wjg4-5w8f

HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows…

MEDIUM 55

HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.14284 Published 2007-12-06 Fixed CWE-94

TI-2007-05247 CVE-2007-5461 · GHSA-v5p2-vg3c-pmrr

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0…

MEDIUM 44

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.39681 Published 2007-10-15 Fixed CWE-22

TI-2007-06139 CVE-2007-6433 · GHSA-9vxv-w3hg-m494

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x…

LOW 39

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03231 Published 2007-12-18 Fixed CWE-20

TI-2008-00002 CVE-2008-0002 · GHSA-5x5f-9r6q-q7mh

Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong…

LOW 34

Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as dem…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.05016 Published 2008-02-12 Fixed in 6.0.16 CWE-200

TI-2007-06013 CVE-2007-6306 · GHSA-2qpv-6w5r-q697

Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3)…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0276 Published 2007-12-11 Fixed CWE-79