Jboss Enterprise Portal Platform vulnerabilities | LiveThreat CVE Feed

Product

Jboss Enterprise Portal Platform

by Redhat · last CVE Jul 16, 2015

CVEs

On KEV

–

Max CVSS

New 30D

Vulnerabilities22 In the news0 Timeline

Severity mix

Critical 0High 0Medium 0Low 0

Severity

All severities22 Critical0 High0 Medium0 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Jboss Enterprise Portal Platform to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2015-3244	–	1%	Jul 16	The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict… Affected: 6.2.0
CVE-2014-7852	–	1%	Dec 11	Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which… Affected: 6.1.1
CVE-2014-3518	–	3%	Jul 22	jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red… Affected: 5.2.2
CVE-2011-4580	–	1%	Feb 26	Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via… Affected: through 5.1.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0; 4.3.0; +4 more
CVE-2011-2941	–	1%	Feb 26	Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… Affected: through 5.1.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0; 4.3.0; +4 more
CVE-2013-2185	–	7%	Jan 19	The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0,… Affected: 6.0.0
CVE-2013-4424	–	1%	Dec 23	Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via… Affected: 6.1.0
CVE-2013-2186	–	13%	Oct 28	The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote… Affected: 4.3.0; 5.2.2; 6.0.0
CVE-2013-2102	–	1%	Oct 28	The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows… Affected: through 6.0.0; 4.3.0; 5.0.0; 5.0.1; 5.1.0; 5.1.1; +3 more
CVE-2012-4572	–	0%	Oct 28	Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new… Affected: through 6.0.0; 4.3.0; 5.0.0; 5.0.1; 5.1.0; 5.1.1; +3 more
CVE-2012-5575	–	6%	Aug 19	Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy… Affected: 4.3.0
CVE-2011-1483	–	3%	Jul 29	wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss… Affected: 4.3.0; 5.1.1
CVE-2013-2165	–	13%	Jul 23	ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss… Affected: 4.3.0; 4.3.0; 4.3.0; 4.3.0; 4.3.0; 5.0.0; +6 more
CVE-2013-0315	–	1%	Apr 12	The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML… Affected: 5.2.2
CVE-2013-0314	–	2%	Apr 12	The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to… Affected: 5.2.2
CVE-2012-3532	–	1%	Apr 12	Cross-site request forgery (CSRF) vulnerability in the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 and earlier allows remote attackers to hijack the… Affected: through 5.2.2; 4.3.0; 5.0.0; 5.0.1; 5.1.0; 5.1.1; +2 more
CVE-2012-5531	–	1%	Jan 18	Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal in JBoss Enterprise Portal Platform 5.2.2 allow remote attackers to inject arbitrary web script or HTML… Affected: 5.2.2
CVE-2012-2377	–	1%	Nov 23	JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when… Affected: through 5.2.1; 4.3.0; 4.3.0; 5.0.0; 5.0.1; 5.1.0; +2 more
CVE-2011-4605	–	4%	Nov 23	The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform… Affected: 4.3.0; 5.2.0; 5.2.1
CVE-2011-4085	–	3%	Nov 23	The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3… Affected: through 4.3.0
CVE-2011-2908	–	2%	Nov 23	Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and… Affected: through 5.2.1; 5.0.0; 5.0.1; 5.1.0; 5.1.1; 5.2.0
CVE-2011-1096	–	3%	Nov 23	The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block… Affected: through 5.2.1; 5.0.0; 5.0.1; 5.1.0; 5.1.1; 5.2.0