Most recent entries from all

fkie_cve-2025-2901

Rejected reason: This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.

GHSA-f7jh-m6wp-jm7f — HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

Affected: Maven: org.jboss.hal:hal-console

A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when an application improperly sanitizes user input before storing it in a data store. When this stored data is later included in web pages without adequate sanitization, malicious scripts can execute in the context of users who view these pages, leading to potential data theft, session hijacking, or other malicious activities.

### Impact Cross-site scripting (XSS) vulnerability in the management console.

### Patches Fixed in [HAL 3.7.11.Final](https://github.com/hal/console/releases/tag/v3.7.11)

### Workarounds No workaround available

RHSA-2025:10452 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update

org.jboss.eap:wildfly-ejb3: Improper Deserialization in JBoss Marshalling Allows Remote Code Execution org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files base-x: base-x homograph attack allows Unicode lookalike characters to bypass validation. commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

WID-SEC-W-2025-0650 — Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.