CVE-2021-31864

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the addissuenotes permission requirement by leveraging the incoming mail handler...

CVE-2021-31864

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the addissuenotes permission requirement by leveraging the incoming mail handler...

CVE-2021-31864

CVE-2021-31864 affects Redmine: upstream versions pre-4.0.9, pre-4.1.3 (4.1.x), and pre-4.2.1 (4.2.x) are vulnerable to an access-restriction bypass via the incoming mail handler, allowing bypass of add_issue_notes permissions. Public sources confirm the issue and list affected releases; Debian L...

Redmine 安全特征问题漏洞

Redmine is a set of open source Web-based project management and defect tracking tools . The product provides project management , issue tracking and role-based access control and other features . A security feature issue vulnerability exists in Redmine versions prior to 4.0.9, 4.1.x series...

CVE-2021-31864: Undefined Security Weakness

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the addissuenotes permission requirement by leveraging the incoming mail handler...

Service Desk mail handler create comments in other JIRA issues if subject have valid issues keys

h3. Summary Service Desk mail handler create comments in other JIRA issues if email subject have valid issues keys of issues from other JIRA Projects. h3. Environment Cloud h3. Steps to Reproduce Create a SD project Setup the mail handler Create another project and create an issue on it. Send an...

Processing malformed PNG by incoming mail handler causes OOM and blocks queue

There are two problems: 1. OOM 2. Incoming email processing is blocked Looks like this is similar problem to JRA-35816, fixed in atlassian-core, but mail handler does not use atlassian-core. It affects production OnDemand, all instances. codejava.lang.OutOfMemoryError: Java heap space Dumping hea...

[SECURITY] Fedora 16 Update: rubygem-mail-2.4.4-1.fc16

A really Ruby Mail handler...

[SECURITY] Fedora 15 Update: rubygem-mail-2.4.4-1.fc15

A really Ruby Mail handler...

Mozilla Firefox < 3.5.9 Multiple Vulnerabilities

Binary data 5494.prm...

SeaMonkey < 2.0.4 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.0.4. Such versions are potentially affected by the following security issues : - Multiple crashes can result in arbitrary code execution. MFSA 2010-16 - A select event handler for XUL tree items can be called after the item is deleted. MFSA...

Mozilla Firefox 3.6.x < 3.6.2 Multiple Vulnerabilities

Binary data 5485.prm...

Opera 9.52/9.60 Stored Cross Site Scripting Code Exec PoC

No description provided by source. !-- Just found a way to use Stefano’s opera:config idea to execute code from remote. Instead of changing the HTTP Proxy, an attacker can change the default external mail application to “\evil\malware.exe ”, or to local commands e.g. ftp.exe which can be used to...

opera-xssexecpoc.txt

bb var z=null; function x window.setTimeout"z=window.open'opera:historysearch?q=%2A';window.focus;",1500; window.setTimeout"z.close;",3000; window.setTimeout"location.href='mailto:'",3000; " onclick="x"Click me... s=document.createElement"IFRAME"; s.src="opera:config"; document.body.appendChilds;...

Opera 9.52/9.60 Stored Cross Site Scripting Code Exec PoC

Exploit for unknown platform in category remote exploits ========================================================= Opera 9.52/9.60 Stored Cross Site Scripting Code Exec PoC ========================================================= bb var z=null; function x...

Opera 9.52/9.60 - Persistent Cross-Site Scripting Code Execution

bb var z=null; function x window.setTimeout"z=window.open'opera:historysearch?q=%2A';window.focus;",1500; window.setTimeout"z.close;",3000; window.setTimeout"location.href='mailto:'",3000; " onclick="x"Click me... s=document.createElement"IFRAME"; s.src="opera:config"; document.body.appendChilds;...

Opera 9.529.60 - Persistent Cross-Site Scripting Code Execution

Opera 9.529.60 - Persistent Cross-Site Scripting Code Execution bb var z=null; function x window.setTimeout"z=window.open'opera:historysearch?q=%2A';window.focus;",1500; window.setTimeout"z.close;",3000; window.setTimeout"location.href='mailto:'",3000; " onclick="x"Click me...