Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
modproxyajp did not correctly process certain malformed HTTP requests, which could cause it to incorrectly put a backend server to an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in a temporary denial of service.
Upstream commit: http://svn.apache.org/viewvc?view=revision&revision=1166551
Reference: http://community.jboss.org/message/625307
EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.
An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies
eDeploy has RCE via cPickle deserialization of untrusted data
eDeploy has tmp file race condition flaws
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
Console: CORS headers set to allow all in Red Hat AMQ.