Increase the web session timeout from 60 minutes to 300 minutes

Usability and security testing have shown that XSRF time out is annoying people in the wild. The security guy Vitaly has ok'ed the limit to be increased. This has been done on trunk along with other changes and should be done on 4.3 branch as well...

FreeBSD Security Advisory (FreeBSD-SA-10:09.pseudofs.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:09.pseudofs.asc SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Security fix for the ALT Linux 5 package gnome-vfs version 1:2.24.4-alt0.M50P.1

Nov. 13, 2010 Andrey Cherepanov 1:2.24.4-alt0.M50P.1 - backport to p5 branch fixed CVE-2009-2473...

Security fix for the ALT Linux 5 package subversion version 1.6.13-alt0.M50P.1

Nov. 12, 2010 Andrey Cherepanov 1.6.13-alt0.M50P.1 - backport to p5 branch fixed CVE-2010-3315...

FreeBSD Security Advisory (FreeBSD-SA-10:08.bzip2.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:08.bzip2.asc ADV FreeBSD-SA-10:08.bzip2.asc OpenVAS Vulnerability Test $ Description: Auto generated from ADV FreeBSD-SA-10:08.bzip2.asc Authors: Thomas Reinke Copyright: Copyright c 2010 E-So...

cvsnt unauthorized access

Directory traversal via branch name...

CVE-2010-1326

perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories within CVSROOT, and...

CVE-2010-1326

perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories within CVSROOT, and...

Deepin TFTP Server Directory Traversal Vulnerability

Software : Deepin TFTP Server Directory Traversal Vulnerability Software Version : v1.25 Vendor: Deepin.org Vulnerability Published : 2010-08-14 Vulnerability Update Time : Status : Impact : Medium Bug Description : Deepin TFTP Server does not properly sanitise filenames containing directory...

Several XSS vulnerabilities were found in the code.

PMASA-2010-5 Announcement-ID: PMASA-2010-5 Date: 2010-08-20 Summary Several XSS vulnerabilities were found in the code. Description It was possible to conduct a XSS attack using crafted URLs or POST parameters on several pages. Severity We consider this vulnerability to be serious. Mitigation...

FreeBSD Security Advisory (FreeBSD-SA-10:07.mbuf.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:07.mbuf.asc SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Security fix for the ALT Linux 5 package openldap2.4 version 2.4.23-alt0.M50P.1

July 1, 2010 Andrey Cherepanov 2.4.23-alt0.M50P.1 - backport to p5 branch security fixes: CVE-2010-0212 and CVE-2010-0211...

Commercial da news shop system Taobao Pat branch version injection vulnerability-vulnerability warning-the black bar safety net

Commercial da news shop system Taobao Pat branch Edition, first just look at the following code, found to the of each variable are used. SafeRequest This function is to check. Looked under, only to find that turned out to be this role. Function SafeRequestParaName,ParaType Dim ParaValue...

FreeBSD Security Advisory (FreeBSD-SA-10:04.jail.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:04.jail.asc ADV FreeBSD-SA-10:04.jail.asc OpenVAS Vulnerability Test $ Description: Auto generated from ADV FreeBSD-SA-10:04.jail.asc Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft...

FreeBSD Security Advisory (FreeBSD-SA-10:05.opie.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:05.opie.asc SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Mozilla Pushes Back Firefox 3.6.4

Originally expected for today, Mozilla has confirmed that it is delaying the the release of version 3.6.4 of its open source Firefox web browser, the next security and stability update to the 3.6.x branch of Firefox. Instead, Mozilla has announced the availability of a release candidate for publi...

SA-CONTRIB-2010-054 - Storm - Cross Site Scripting (XSS)

The Storm project provides a group of modules for project management and billing. The module displays data entered by users without sanitising it, allowing for a cross site scripting XSS attack that may lead to a malicious user gaining full administrative access. Versions affected Storm project f...

FreeBSD Security Advisory (FreeBSD-SA-10:01.bind.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:01.bind.asc ADV FreeBSD-SA-10:01.bind.asc OpenVAS Vulnerability Test $ Description: Auto generated from ADV FreeBSD-SA-10:01.bind.asc Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft...

php -- multiple vulnerabilities

PHP developers reports: This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release. Security Enhancements and Fixes in PHP 5.2.12: Fixed a safemode bypass in...

FreeBSD Security Advisory (FreeBSD-SA-09:14.devfs.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-09:14.devfs.asc SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...