IBM Business Process Manager - User Account Reconfiguration

Exploit Title: IBM BMPS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version: 8.0.1.1 newest versions can also be vulnerable Vulnerability...

Threat Outbreak Alert: Fake Fax Delivery Email Messages on November 7, 2013

Medium Alert ID: 31674 First Published: 2013 November 7 19:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a fax delivery notification for the recipient. The text in the email message attempts to convince the recipien...

Threat Outbreak Alert: Fake Payment Slip Notification Email Messages on October 3, 2013

Severity Alert ID: 31111 First Published: 2013 October 3 15:01 GMT Version: 1 Threat Outbreak Threat Outbreak Summary Cisco Security has detected significant activity on October 3, 2013. Revision History Initial ReleaseShow Less Legal Disclaimer THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND...

Recommended updates email includes excerpts from Private/Restricted pages

The recommended updates email will include pages that are restricted, so all users will see an excerpt of that page. This is a security concern as projects that are documented could contain sensitive information. Also mentioned by users in the comments at...

SPAM via Answer

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47171. panel I have received an email notification containing a link as an aswer one of my questions. It turns out that a spam. ...

SPAM via Answer

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47171. panel I have received an email notification containing a link as an aswer one of my questions. It turns out that a spam. ...

SPAM via Answer

I have received an email notification containing a link as an aswer one of my questions. It turns out that a spam. I went online check my question and saw that the answer is not on it. So I believe this is very serious issue as we all trust and gave some personal information to Atlassian. Please...

SPAM via Answer

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47171. panel I have received an email notification containing a link as an aswer one of my questions. It turns out that a spam....

User receives an email even though they don't have access to the page where a task was unassigned

h3. Steps to reproduce: Find/Create a space that has restricted view access Create a page and assign a task to a user that doesn't have view access to the page. Save the page. User does not receive an email, and the task does not show up in the user's to-do correct behavior Edit the page and...

Wordpress Download Monitor 3.3.5.7 Cross Site Scripting

/-----------------------------------------------------------------\ | Wordpress Download Monitor - Download Page Cross-Site Scripting | -----------------------------------------------------------------/ Summary ======= Wordpress Download Monitor 3.3.5.7 is subject to a cross-site scripting...

[SECURITY] Fedora 17 Update: arpwatch-2.1a15-20.fc17

The arpwatch package contains arpwatch and arpsnmp. Arpwatch and arpsnmp are both network monitoring tools. Both utilities monitor Ethernet or FDDI network traffic and build databases of Ethernet/IP address pairs, and can report certain changes via email. Install the arpwatch package if you need...

Cloudflare CEO: AT&T Voicemail Hack Key To Compromise

Loose security protecting voice mailboxes at mobile carrier AT&T provided a key element necessary to successfully hack the Google Enterprise Apps account of tech firm CloudFlare, according to an account of the hack posted by CEO Matthew Prince. Writing on the company’s blog on Monday, Prince said...

Rootdabitch version 0.1 - Multithreaded Linux root password Bruteforcer

Rootdabitch version 0.1 - Multithreaded Linux root password Bruteforcer r00tw0rm hacker "th3breacher!" release Rootdabitch v0.1 ,which is a Multithreaded Linux/UNIX tool to brute-force cracking local root through su using sucrack. sucrack is a multithreaded Linux/UNIX tool for brute-force crackin...

A.M.Y. Cross Site Request Forgery

Exploit Title: A.M.Y CSRF change admin password Author: Jonturk75 Category:: webapps Demo site: http://calendarscripts.info/demos/amy/admin.php Email me when a new advertiser signs up...

Unfixed Redirect vulnerability at www.idverre.net

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting www.idverre.net, which at the time of submission ranked 1508056 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently unfixed. If...

Unfixed XSS vulnerability at www.topboutique.com

Security researcher Atmon3r, has submitted on 21/12/2011 a cross-site-scripting XSS vulnerability affecting www.topboutique.com, which at the time of submission ranked 826564 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is...

Unfixed XSS vulnerability at www.hit-reset.co.uk

Security researcher Genocide, has submitted on 12/12/2011 a cross-site-scripting XSS vulnerability affecting www.hit-reset.co.uk, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It is current...

InverseFlow 2.4 - Cross-Site Request Forgery (Add Admin)

Exploit Title: InverseFlow v2.4 CSRF Vulnerabilities Add Admin User + Version : 2.4 + Author : EjRaM HaCkEr + Contact : m2z9.cn + Dork : inurl:"ticket.php?cmd=lost" + Software Link : http://asria.info/download/script/inverseflow.zip...

Design/Logic Flaw

Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address aka oldemail field for e-mail change notifications, which makes it easier for remote...

Unfixed XSS vulnerability at meinekampagne.gruene.de

Security researcher zombielove, has submitted on 29/03/2011 a cross-site-scripting XSS vulnerability affecting meinekampagne.gruene.de, which at the time of submission ranked 209405 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2011. It...