Debian DSA-2500-1 : mantis - several vulnerabilities

Several vulnerabilities were discovered in Mantis, an issue tracking system. - CVE-2012-1118 Mantis installation in which the privatebugviewthreshold configuration option has been set to an array value do not properly enforce bug viewing restrictions. - CVE-2012-1119 Copy/clone bug report actions...

Threat Outbreak Alert: Fake DHL Express Tracking Notification Email Messages on February 3, 2014

Medium Alert ID: 26262 First Published: 2012 June 27 20:46 GMT Last Updated: 2014 February 4 13:56 GMT Version: 26 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a DHL Express tracking notification for the recipient. The text in the...

Trojan.Milicenso Print Bomb - Printer Trojan cause massive printing

Trojan.Milicenso - Printer Trojan cause massive printing A Trojan that sends printers crazy, making them print pages of garbled nonsense until all the paper has been used up, has seen a spike in activity.Symantec detected the Trojan.Milicenso across various countries, but the worst hit regions...

CVE-2012-2692

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

Design/Logic Flaw

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

CVE-2012-2692

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

PT-2012-4185

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.11 Description The issue allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments due to a lack of permission check for delete attachments...

CVE-2012-2692: Undefined Security Weakness

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

DEBIAN-CVE-2012-1253

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

E-mail Trends Show Hackers Working Weekends Less and Less

While there are an increasing number of weekends catered to hacking, even hackers need a day off – and it shouldn’t surprise many that increasingly, that day is usually Sunday. Network security company FireEye reviewed statistics on email-based attacks for 2012 that suggest that Sunday has slowed...

User can upload attachments to restricted pages that adopt restrictions from parent page

Users that should have no access to restricted pages that adopt restrictions from the parent page are able to upload attachments if they know the page ID. How to reproduce: 1. Create 2 users, user1 and user2 2. Create a page with user1 and set the page view and edit restrictions to "Me" 3. Create...

Threat Outbreak Alert: Fake Picture Link Email Messages on September 16, 2013

Low Alert ID: 25964 First Published: 2012 May 18 17:00 GMT Last Updated: 2013 September 17 14:05 GMT Version: 78 Summary Cisco Security has detected significant activity related to spam email messages. The text in the email message instructs the recipient to follow a link or open an attachment...

XSS Vulnerabilities in JIRA Attachments?

At the current moment, JIRA do not have any restrictions for attachment files, which allows users to upload malicious file into JIRA issues. This can be a problem when we open an attachments using Mozilla Firefox, since the browser allows us to open attachments using web browser. The steps to...

XSS Vulnerabilities in JIRA Attachments?

At the current moment, JIRA do not have any restrictions for attachment files, which allows users to upload malicious file into JIRA issues. This can be a problem when we open an attachments using Mozilla Firefox, since the browser allows us to open attachments using web browser. The steps to...

XSS Vulnerabilities in JIRA Attachments?

At the current moment, JIRA do not have any restrictions for attachment files, which allows users to upload malicious file into JIRA issues. This can be a problem when we open an attachments using Mozilla Firefox, since the browser allows us to open attachments using web browser. The steps to...

DNSChanger Malware

UPDATE: On March 5, 2012, a federal judge agreed to allow more time for organizations and individuals to clean systems of the DNSChanger malware and extended the deadline for shutting off servers that had been keeping infected computers connected to the internet. Although the new deadline is July...

Wordpress Auto Attachments 0.2.9 File Upload

File upload vulnerability in Wordpress Auto Attachments plugin Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Ongoing Targeted Attack Campaign Going After Defense, Aerospace Industries

Researchers have identified a strain of malware that’s being used in a string of targeted attacks against defense contractors, government agencies and other organizations by leveraging exploits against zero-day vulnerabilities. The attacks may have been going on since 2009 in some form and the...

CVE-2011-5070

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...

CVE-2011-5070

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...