CVE Vulnerability Advisory Database

[Affected Scope] JBoss Seam 2 (jboss-seam2) framework as integrated in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux

[Impact] Remote attackers can execute arbitrary Java code and system commands via crafted URLs when the Java Security Manager is not properly configured

[Mitigation] Upgrade to the patched version of JBoss Seam/EAP, enable the Java Security Manager, and implement strict input validation filters

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.

[Impact] Remote attackers can bypass authentication and access sensitive administrative information within the Web Console by utilizing non-standard HTTP methods (such as HEAD or PUT).

[Mitigation] Apply the official Cumulative Patch (CP) or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 (prior to 4.2.0.CP09) and 4.3 (prior to 4.3.0.CP08).

[Impact] Remote attackers can bypass authentication on the JMX-Console by utilizing non-standard HTTP methods (such as HEAD), allowing unauthorized administrative actions.

[Mitigation] Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Adobe BlazeDS 3.2 and earlier, and integrated products including LiveCycle, ColdFusion, and Flex Data Services

[Impact] Unauthenticated remote attackers can read arbitrary local files and disclose sensitive system information via crafted XML requests

[Mitigation] Apply official security patches or disable external entity resolution (XXE) in the XML parser configuration

[Affected Scope] Systems running Microsoft Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista, and Server 2008 utilizing the MPEG2TuneRequest ActiveX control (msvidctl.dll)

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft security updates (MS09-037) or configure the ActiveX Kill Bit in the Windows Registry to disable the vulnerable control

[Affected Scope] Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac.

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted PowerPoint file.

[Mitigation] Apply the official Microsoft MS09-017 security update immediately and restrict the execution of untrusted PPT/PPS files.

[Affected Scope] phpMyAdmin versions 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1

[Impact] Unauthenticated remote attackers can inject arbitrary PHP code into the configuration file via the setup.php save action, leading to full system compromise

[Mitigation] Upgrade to patched versions immediately, or delete/restrict access to the setup.php script in production environments

[Affected Scope] HP OpenView Network Node Manager (NNM) versions 6.2 through 7.50 are affected.

[Impact] Remote attackers can execute arbitrary system commands with web server privileges without authentication by injecting shell metacharacters into vulnerable OVPL scripts.

[Mitigation] Restrict external access to the vulnerable OVPL scripts immediately and apply official vendor patches or upgrade to a supported version.