Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.3.1 update
JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure Console: XSS in invoke operation Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs JBoss invoker servlets do not require authentication JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided jruby: Murmur hash function collisions (oCERT-2012-001) JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure JBoss: allows empty password to authenticate against LDAP
cpe:/a:redhat:jboss_enterprise_soa_platform:5.3