CVE-2010-1428
Red Hat JBoss Information Disclosure Vulnerability
CVSS
7.5
Alto
EPSS
62.3%
p99
KEV
SÍ
25 may 2022
Exploit Today
80
0-100
Publicado: 28 abr 2010 · Última mod.: 14 ago 2026 · CWE-749
62.3%EPSS · 30 días62.3%
2026-08-022026-08-31
Producto
Red Hat / JBoss
Vulnerabilidad
Red Hat JBoss Information Disclosure Vulnerability
Añadido a KEV
25 may 2022
Remediar antes de
15 jun 2022
Uso conocido en ransomware
Sí
Descripción resumida
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
Acción requerida
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2010-1428
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
- marc.infohttp://marc.info/?l=bugtraq&m=132698550418872&w=2
- secunia.comhttp://secunia.com/advisories/39563
- securitytracker.comhttp://securitytracker.com/id?1023917
- www.securityfocus.comhttp://www.securityfocus.com/bid/39710
- www.vupen.comhttp://www.vupen.com/english/advisories/2010/0992
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=585899
- exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/58148
- rhn.redhat.comhttps://rhn.redhat.com/errata/RHSA-2010-0376.html
- rhn.redhat.comhttps://rhn.redhat.com/errata/RHSA-2010-0377.html
- rhn.redhat.comhttps://rhn.redhat.com/errata/RHSA-2010-0378.html
- rhn.redhat.comhttps://rhn.redhat.com/errata/RHSA-2010-0379.html
- marc.infohttp://marc.info/?l=bugtraq&m=132698550418872&w=2
- secunia.comhttp://secunia.com/advisories/39563
- securitytracker.comhttp://securitytracker.com/id?1023917
- www.securityfocus.comhttp://www.securityfocus.com/bid/39710
- www.vupen.comhttp://www.vupen.com/english/advisories/2010/0992
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=585899
- exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/58148
- rhn.redhat.comhttps://rhn.redhat.com/errata/RHSA-2010-0376.html
- rhn.redhat.comhttps://rhn.redhat.com/errata/RHSA-2010-0377.html
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-182637.8 ALT3.1%
——1Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886.5dCVE-2026-182627.8 ALT2.9%
——1Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28885.10dCVE-2026-131217.8 ALT2.9%
——1Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29220.10dCVE-2026-528778.3 ALT23.4%
——7Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.12dCVE-2026-4805610.0 CRÍ30.9%
——9Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.20dCVE-2026-688239.1 CRÍ46.5%
——14Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.24d