title: Red Hat Security Advisory: Red Hat JBoss Portal 6.1.0 update
description: Tomcat/JBoss Web - Bypass of CSRF prevention filter Web: jsessionid exposed via encoded url when using cookie based session tracking JBoss: custom authorization module implementations shared between applications apache-cxf: XML encryption backwards compatibility attacks PicketBox: Insecure storage of masked passwords tomcat: Session fixation in form authenticator Gatein: JGroups configurations enable diagnostics without authentication apache-cxf: Multiple denial of service flaws in the StAX parser Java: XML signature spoofing JGroups: Authentication via cached credentials remote-naming: Session fixation due improper connection caching ejb-client: Session fixation due improper connection caching Bayeux: Reflected Cross-Site Scripting (XSS)
cpes: cpe:/a:redhat:jboss_enterprise_portal_platform:6.1.0