Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

eDeploy has RCE via cPickle deserialization of untrusted data

eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data

eDeploy has tmp file race condition flaws

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.

Console: CORS headers set to allow all in Red Hat AMQ.

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.

modproxyajp did not correctly process certain malformed HTTP requests, which could cause it to incorrectly put a backend server to an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in a temporary denial of service.

Upstream commit: http://svn.apache.org/viewvc?view=revision&revision=1166551

Reference: http://community.jboss.org/message/625307

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies