SA-CONTRIB-2012-148 - OG - Access Bypass

OG Organic groups enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. A group membership can be given immediately upon subscribing, or be pending - waiting for a group administrat...

Debian: Security Advisory (DSA-2480-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Code injection

SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDITPERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups...

Debian: Security Advisory (DSA-2538-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Group Picker Should Not Listed All Groups

Confluence will display all groups registered on it when users access any group picker and put value as its search parameter. This is not a good implementation from security point of view as normal users would be able to see the whole groups. It would be better if group picker listed only the...

PYSEC-2012-10

security/init.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group...

Information disclosure in REST API

REST endpoints to search groups and to list issue resolutions allow anonymous/unauthenticated access. The former allows to enumerate all groups on a JIRA instance by sending multiple queries as results are limited by jira.ajax.autocomplete.limit. We've verified this on an instance without any...

Al Jazeera News network website hacked by Pro-Assad hackers

The official website of one of the biggest Arabic-language news network "Al Jazeera" got hacked just now by Pro-Assad hackers called "Al-Rashedon". If your miss the deface page, please have a look to mirror of it Here. Deface page designed with Dark color as shown in image and have some message i...

Fedora Update for drupal6-og FEDORA-2012-11479

Check for the Version of drupal6-og OpenVAS Vulnerability Test Fedora Update for drupal6-og FEDORA-2012-11479 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

CVE-2012-1644

The Organic Groups OG Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors...

Design/Logic Flaw

The Organic Groups OG Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors...

CVE-2012-1644

The CVE-2012-1644 entry concerns the Drupal Organic Groups (OG) Vocabulary module. Affected component: OG Vocab 6.x-1.x before 6.x-1.2. Root cause: the module does not sufficiently enforce access controls on vocabularies, allowing remote authenticated users with certain administrator permissions ...

CVE-2012-1644

The Organic Groups OG Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors...

python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root

Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem...

[SECURITY] Fedora 17 Update: drupal6-og-2.4-1.fc17

Enable users to create and manage their own 'groups'...

CVE-2012-2081

The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...

Design/Logic Flaw

The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...

CVE-2012-2081

The CVE-2012-2081 issue concerns the Organic Groups (OG) module for Drupal (versions 6.x-2.x prior to 6.x-2.3). The root cause is that the module’s Views integration does not correctly filter information from private groups, allowing remote attackers to access sensitive data. Impact: disclosure o...

CVE-2012-2081

The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...

broadcast-igmp-discovery NSE Script

Discovers targets that have IGMP Multicast memberships and grabs interesting information. The scripts works by sending IGMP Membership Query message to the 224.0.0.1 All Hosts multicast address and listening for IGMP Membership Report messages. The script then extracts all the interesting...