CVE-2009-1380

Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters.

• CWE-79

• http://secunia.com/advisories/37671Vendor Advisory
• http://securitytracker.com/id?1023315
• http://www.securityfocus.com/bid/37276
• https://bugzilla.redhat.com/show_bug.cgi?id=511224Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54698
• https://jira.jboss.org/jira/browse/JBPAPP-1983
• https://rhn.redhat.com/errata/RHSA-2009-1636.htmlVendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1637.html
• https://rhn.redhat.com/errata/RHSA-2009-1649.htmlVendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1650.htmlVendor Advisory
• http://secunia.com/advisories/37671Vendor Advisory
• http://securitytracker.com/id?1023315
• http://www.securityfocus.com/bid/37276
• https://bugzilla.redhat.com/show_bug.cgi?id=511224Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54698
• https://jira.jboss.org/jira/browse/JBPAPP-1983
• https://rhn.redhat.com/errata/RHSA-2009-1636.htmlVendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1637.html
• https://rhn.redhat.com/errata/RHSA-2009-1649.htmlVendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1650.htmlVendor Advisory

Published

Dec 15, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1374Buffer overflow in the decrypt_out function in Pidgin (forme…
• CVE-2009-1375The PurpleCircBuffer implementation in Pidgin (formerly Gaim…
• CVE-2009-1376Multiple integer overflows in the msn_slplink_process_msg fu…
• CVE-2009-1377The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL …
• CVE-2009-1378Multiple memory leaks in the dtls1_process_out_of_seq_messag…
• CVE-2009-1379Use-after-free vulnerability in the dtls1_retrieve_buffered_…
• CVE-2009-1381The map_yp_alias function in functions/imap_general.php in S…
• CVE-2009-1382Multiple stack-based buffer overflows in mimetex.cgi in mime…
• CVE-2009-1383The getdirective function in mathtex.cgi in mathTeX, when do…
• CVE-2009-1384pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise…
• CVE-2009-1385Integer underflow in the e1000_clean_rx_irq function in driv…
• CVE-2009-1386ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attacker…