In the default configuration, after JBoss is installed, the web console is available at http://localhost:8080/web-console. The Web console can be used to display the JNDI tree, dump the list of threads, redeploy an application or even shutdown the application server. By default, the console is not secured and can be used by remote attackers. Check References for detailed information.
The Web Console includes a JMX Invoker that normally residing at the URL http://localhost:8080/web-console/Invoker.
This Invoker is a fully-edged JMX Invoker and not limited to the functionality provided by the Web Console. Access to this Invoker is unrestricted even from remote by default, so that attackers can use it to send arbitrary JMX commands to the JBoss AS.
Restrict access to JBoss Web Console.
Securing the JMX Console and Web Console
Bridging the Gap between the Enterprise and You - or - Who's the JBoss now?
WordPress Plugin Contact Form Email Information Disclosure (1.2.66)
WordPress Plugin SS Downloads Cross-Site Request Forgery and Information Disclosure Vulnerabilities (1.4.3)
WordPress Plugin Download Zip Attachments Arbitrary File Download (1.0.0)
WordPress Plugin Easy Author Image Information Disclosure (1.5)
WordPress Plugin WordPress Mobile Pack Information Disclosure (2.1.2)