Search for packages
| purl | pkg:rpm/redhat/jboss-transaction-api_1.1_spec@1.0.1-6.Final_redhat_2.ep6?arch=el6 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1yu9-avtx-cybv
Aliases: CVE-2015-1844 |
foreman: API not scoping resources to taxonomies | There are no reported fixed by versions. |
|
VCID-58f1-hrv1-gqgp
Aliases: CVE-2012-5575 GHSA-7v5v-9v8r-w864 |
Inadequate Encryption Strength in Apache CXF Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack." | There are no reported fixed by versions. |
|
VCID-7f1h-1fw8-k7c4
Aliases: CVE-2015-3155 |
foreman: the _session_id cookie is issued without the Secure flag | There are no reported fixed by versions. |
|
VCID-8wen-twwa-8khm
Aliases: CVE-2014-3653 |
foreman: cross-site scripting (XSS) flaw in template preview screen | There are no reported fixed by versions. |
|
VCID-jtbd-bbrs-vbct
Aliases: CVE-2012-4572 |
JBoss: custom authorization module implementations shared between applications | There are no reported fixed by versions. |
|
VCID-man2-98t1-myav
Aliases: CVE-2012-4529 |
Web: jsessionid exposed via encoded url when using cookie based session tracking | There are no reported fixed by versions. |
|
VCID-rc65-py17-kuhm
Aliases: CVE-2015-1816 |
foreman: lack of SSL certificate validation when performing LDAPS authentication | There are no reported fixed by versions. |
|
VCID-ryha-ndms-afbn
Aliases: CVE-2013-2067 GHSA-6m48-jxwx-76q7 |
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack. | There are no reported fixed by versions. |
|
VCID-sqjb-qpyd-p7gn
Aliases: CVE-2015-3235 |
foreman: edit_users permission allows changing of admin passwords | There are no reported fixed by versions. |
|
VCID-tbug-mv5x-uucb
Aliases: CVE-2013-4346 GHSA-4433-4cxq-vv73 PYSEC-2014-85 |
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL. | There are no reported fixed by versions. |
|
VCID-utxw-251d-gfff
Aliases: CVE-2014-3590 |
rhn_satellite_6: cross-site request forgery (CSRF) can force logout | There are no reported fixed by versions. |
|
VCID-zkgb-14kz-33dz
Aliases: CVE-2013-4347 GHSA-rv8h-p43r-4x5r PYSEC-2014-86 |
The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||