Shopify: Accessing Payments page and adding payment methods with limited access accounts

Users with the Orders permission were allowed to see the store's payment gateway information. This page should have been restricted to users with the Settings permission only. Using this vulnerability a User with limited access/ No access to Settings could add/alter/change Payment settings while...

(RHSA-2015:1842) Low: Red Hat Storage 2.1 - 30 Day Retirement Notice

In accordance with the Red Hat Storage Support Life Cycle policy, the Red Hat Storage 2.1 offering will be retired as of October 31, 2015, and support will no longer be provided. Accordingly, Red Hat will not provide extended support for this product, including Critical impact security patches or...

Threat Outbreak Alert RuleID17114: Email Messages Distributing Malicious Software on August 1, 2015

Medium Alert ID: 40302 First Published: 2015 August 3 14:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17114 may contain the following files: Name | Si...

AP Portfolio [mod_ap_portfolio], 3.3 and below, XSS (Cross Site Scripting)

AP Portfolio modapportfolio, 3.3.1 and below, XSS Cross Site Scripting Extension includes vulnerable JS library prettyPhoto Vulnerability fixed in version 3.3.2 Update notice:http://aplikko.com/joomla-extensions/ap-portfolio...

LastPass Network Breached; Calls for Master Password Reset

Password manager LastPass disclosed today that its network was breached and advised users to change their master passwords and enable multifactor authentication. CEO and founder Joe Siegrist said in a security notice that LastPass on Friday discovered suspicious activity on its network; encrypted...

Open-Source Disk Encryption for Windows: LibreCrypt

LibreCrypt is an Open-Source “on-the-fly” transparent disk encryption for Windows both 32 and 64 bit. LUKS compatible – formerly DoxBox. This software can create “virtual disks” on your computer – anything written to these disks is automatically encrypted before being stored on your computer’s ha...

[USN-2597-2] Linux kernel (Trusty HWE) regression

========================================================================== Ubuntu Security Notice USN-2597-2 May 08, 2015 linux-lts-trusty regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

RD Download, 0.9.0 and below

RD Downloads comrddownload, 0.9.0 and previous Warning: Author abandoned this component, no further support expected Update notice: https://github.com/rdeutz/rddownload...

CA20150407-01: Security Notice for CA Spectrum

-----BEGIN PGP SIGNED MESSAGE----- CA20150407-01: Security Notice for CA Spectrum Issued: April 7, 2015 CA Technologies Support is alerting customers to multiple potential risks with CA Spectrum. Two vulnerabilities exist that can potentially allow a remote authenticated attacker to gain sensitiv...

Threat Outbreak Alert RuleID14120: Email Messages Distributing Malicious Software on March 20, 2015

Medium Alert ID: 37967 First Published: 2015 March 20 12:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14120 may contain the following files: Name | Si...

Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability

A vulnerability in the inter-process communication IPC channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to write arbitrary files with elevated privileges. The vulnerability is due to lack of authentication or authorization of certain IPC commands. An...

Cisco Secure Access Control Server Default Tomcat Administration Interface Vulnerability

A vulnerability in Cisco Secure Access Control Server ACS may allow an authenticated, remote attacker to render the ACS web interface unreachable and to execute arbitrary code on the server with the privileges of the web server. The vulnerability is due to a default Tomcat administration web...

[USN-2510-1] FreeType vulnerabilities

========================================================================== Ubuntu Security Notice USN-2510-1 February 24, 2015 freetype vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...

Cisco Network Analysis Module Cross-Site Scripting Vulnerability

A vulnerability in the login page of the Cisco Network Analysis Module NAM could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by convincing the NAM us...

Cisco Common Services Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Common Services help pages could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of some...

Threat Outbreak Alert RuleID13746: Email Messages Distributing Malicious Software on February 27, 2015

Medium Alert ID: 37620 First Published: 2015 February 27 15:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13746 may contain the following files: Name |...

Cisco AsyncOS Software HTTP Redirect Vulnerability

A vulnerability in the web framework of Cisco AsyncOS could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could cause a web page redirection to a malicious website. The vulnerability is due to insufficient validation of user input before it is used as an HTTP head...

Cisco Collaboration Desk Experience Endpoints Command Injection Vulnerability

A vulnerability in the image upgrade facility of Cisco Collaboration Desk Experience DX Series endpoints could allow an authenticated, local attacker to execute commands in the context of the underlying operating system. The vulnerability is due to insufficient sanitization of input during the...

Cisco Web Security Appliance Cross-Site Scripting Vulnerability

A vulnerability in the Administrator report page of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...

Cisco Hosted Collaboration Solution Unauthorized System Access Vulnerability

A vulnerability in the Simple Object Access Protocol SOAP Interface of the Cisco Hosted Collaboration Solution HCS could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted system. An attacker could exploit the vulnerability by transmitting crafted Challenge SOAP...