jenkins: Queue API did show items not visible to the current user (SECURITY-186)

Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api...

php: dangling pointer in the unserialization of ArrayObject items

A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrary code...

IBM WebSphere Portal Design Vulnerability

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects the internal and external parts of an organization, allowing employees, customers and suppliers to access internal data through the platform. A security vulnerability exists in IB...

Code injection

IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI...

CVE-2015-7455

CVE-2015-7455 affects IBM WebSphere Portal versions 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09. The vulnerability is described as weak permissions on content items, enabling remote authenticated users to modify content via the authoring UI. Connected source...

PT-2016-1321

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.x through 7.0.0.2 CF29 IBM WebSphere Portal versions 8.0.x before 8.0.0.1 CF20 IBM WebSphere Portal versions 8.5.x before 8.5.0.0 CF09 Description The issue is related to insufficient access control in the user...

CVE-2015-7455: Undefined Security Weakness

IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI...

Osclass SQL Injection Vulnerability

OSClass is a PHP MySQL based development , used to create and manage classified ads website open source system . Osclass suffers from a SQL injection vulnerability. Because the input passed to the "/index.php" PHP script via the "itemsPerPage" HTTP GET parameter fails to filter user input, an...

Libgraphite Context Item Code Execution Vulnerability

Talos Vulnerability Report TALOS-2016-0059 Libgraphite Context Item Code Execution Vulnerability February 5, 2016 CVE Number CVE-2016-1523 Description An exploitable heap-based buffer overflow exists in the context item handling functionality of Libgraphite. A specially crafted font can cause a...

jenkins: Queue API did show items not visible to the current user (SECURITY-186)

Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api...

Shopify: Stored XSS in /admin/orders

Hi , I have found a Stored XSS vulnerability in orders page. Steps to reproduce: 1. Create a new order with an item that requires shipping 2. Go to https://.myshopify.com/admin/orders/ 3. Click the Fulfill items button then fulfill the items 4. Now a new fulfillment with an id will be generated ,...

CVE-2015-5854

The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors...

Information disclosure

The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors...

CVE-2015-5854

The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors...

CVE-2015-5854: Exposure of Sensitive Information to an Unauthorized Actor

The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors...

Oracle: Security Advisory (ELSA-2013-0131)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

subversion: svn_repos_trace_node_locations() reveals paths hidden by authz

It was found that when an SVN server both svnserve and httpd with the moddavsvn module searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable for example, if it had been moved...

Using V8 U-AIR wizards to restore Exchange 2003 and 2007

This KB article documents the procedure for restoring Application Items for Exchange 2003 and Exchange 2007. The Veeam Explorer for Microsoft Exchange does not support these versions of Exchange. In o...

CVE-2015-5528: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the saveorder function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items parameter in an fsbsaveorder action to wp-admin/admin-ajax.ph...

PT-2015-6973

Name of the Vulnerable Software and Affected Versions Floating Social Bar plugin versions prior to 1.1.6 Description The issue is related to a cross-site scripting XSS vulnerability. It affects the save order function in the class-floating-social-bar.php file. Remote attackers can inject arbitrar...