https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:46:25.216049+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318691 EUVD-2026-318691 2026-10-02T19:46:25.233279+00:00 EUVD-2026-318691 https://cve.radiocsirt.org/vuln/fkie_cve-2012-4549 fkie_cve-2012-4549 2026-10-02T19:46:25.233319+00:00

A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (EJB) method invocation. This allows attackers to bypass intended access restrictions for EJB methods, leading to unauthorized access to sensitive functionalities.

 https://cve.radiocsirt.org/vuln/ghsa-4crg-m9w3-g9fc GHSA-4crg-m9w3-g9fc 2026-10-02T19:46:25.233353+00:00

The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.

 https://cve.radiocsirt.org/vuln/gsd-2012-4549 gsd-2012-4549 2026-10-02T19:46:25.233371+00:00 gsd-2012-4549 https://cve.radiocsirt.org/vuln/rhsa-2012:1591 RHSA-2012:1591 — Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update 2026-10-02T19:46:25.233383+00:00

httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token Mojarra: deployed web applications can read FacesContext from other applications under certain conditions httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains apache-cxf: SOAPAction spoofing on document literal web services JBoss Enterprise Application Platform: org.jboss.as.ejb3: JBoss Enterprise Application Platform: Access restriction bypass via improper EJB method authorization JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass