Red Hat Security AdvisoryRHSA-2009:1146
JBoss Enterprise Application Platform 4.3.0.CP05 update
Released 2009-07-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS glassfish-jaxb-2.1.4-1.11.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.11.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP08.0jpp.ep1.2.el4 +30
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES glassfish-jaxb-2.1.4-1.11.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.11.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP08.0jpp.ep1.2.el4 +30
Fixes 3 records
Priority MEDIUM 64
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.9444 · Published 2009-06-05 · Fixed in 4.1.40, 5.5.28 +1 CWE-200
Priority MEDIUM 41
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, whic…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.18685 · Published 2009-06-16 · Fixed in 4.1.40, 5.5.28 +1 CWE-22
Priority LOW 21
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web…
CVSS 3.0MEDIUM 4.2· Local · High privileges · No interaction · EPSS 0.00809 · Published 2009-06-05 · Fixed in 6.0.20 CWE-200
THREATIST.IORead the docs