title: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update
description: httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token Mojarra: deployed web applications can read FacesContext from other applications under certain conditions httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains apache-cxf: SOAPAction spoofing on document literal web services AS: EJB authorization succeeds for any role when allowed roles list is empty JACC: Security constraints configured for EJBs are incorrectly interpreted and not applied
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6::el6