Make custom field description and options rendering consistent for OnDemand and BTF

JIRA has different behaviour for how it renders custom field descriptions and options depending on if it's running BTF or on OnDemand. On OnDemand, custom field descriptions are wiki markup, but on BTF they're HTML. On OnDemand, custom field options e.g. for checkbox are plain text, but on BTF...

Tribq CMS 5.2.7 Cross Site Request Forgery

Exploit Title: Tribq CMS CSRF - Adding/Editing new administrator account Date: 2013 8 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://sourceforge.net/projects/tribiq/ Tested on: Linux & Windows, PH...

HP LaserJet Pro Printers remotely exploitable to gain unauthorized access to Wi-Fi and Printer Data

Do you own an HP printer? If so, it may be vulnerable to Hackers. Multiple HP LaserJet Pro Printers are printer vulnerable to hackers according to a new advisory posted by the vendor, dubbed as CVE-2013-4807 SSRT101181. Researcher 'Micha Sajdak' of Securitum.pl have found a security hole HP...

Full Disclosure - WD My Net N600, N750, N900, N900C - Plain Text Disclosure of Admin Credentials

Vulnerable Products - WD My Net N600 HD Dual Band Router Wireless N WiFi Router Accelerate HD WD My Net N750 HD Dual Band Router Wireless N WiFi Router Accelerate HD Linux 2.6.3 Kernel Firmware Ver. 1.03.xx 1.04.xx Firmware unaffected Ver 1.01.xx WD My Net N900 HD Dual Band Router Wireless N WiFi...

FOSCAM IP-Cameras Improper Access Restrictions

Advisory ID Internal CORE-2013-0613 1. Advisory Information Title: FOSCAM IP-Cameras Improper Access Restrictions Advisory ID: CORE-2013-0613 Advisory URL:http://www.coresecurity.com/advisories/foscam-ip-cameras-improper-access-restrictions Date published: 2013-07-23 Date of last update:...

Western Digital My Net N600, N750, N900 and N900C - Plain text disclosure of administrative credentials

Vulnerable Products - WD My Net N600 HD Dual Band Router Wireless N WiFi Router Accelerate HD WD My Net N750 HD Dual Band Router Wireless N WiFi Router Accelerate HD Linux 2.6.3 Kernel All firmware including the latest Ver. 1.04.16 WD My Net N900 HD Dual Band Router Wireless N WiFi Router...

Tumblr Patches Password Sniffing Bug for iOS

Popular blogging platform Tumblr pushed out an emergency update to its iOS app yesterday, patching an apparent password sniffing bug that attackers may have been using to steal users’ logins and passwords. The update, version 3.4.1 on iOS addresses “an issue that allowed passwords to be compromis...

Oracle Linux 5 : Important: / gnupg (ELSA-2007-0107)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-0107 advisory. 1.4.5-13 - incorporate patch from Werner to work around clients which can't tell that multiple plain messages have been processed 230457 Tenable has extracted t...

CVE-2013-4094

The Key Management feature in the SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the 1 privatekey or 2 publickey parameter in a T/keyManagement request to plain/settings.html, as demonstrated b...

CVE-2013-4093: Improper Limitation of a Pathname to a Restricted Directory

The SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote attackers to obtain sensitive information via 1 a direct request to dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr, which reveals the installation path in the s0.filePath...

CVE-2013-4095: Improper Input Validation

plain/actionsets.html in the SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to execute arbitrary commands via a task with a command.value field in conjunction with an arguments.value field...

CVE-2013-4094: Improper Input Validation

The Key Management feature in the SecureSphere Operations Manager SOM Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the 1 privatekey or 2 publickey parameter in a T/keyManagement request to plain/settings.html, as demonstrated b...

FreeBSD NFS server memory corruption

It's possible to call readdir on plain file...

Zyxel NBG5715 Local admin privileges bypass Vulnerability

Exploit for linux/mips platform in category local exploits ================================================================================================== | | | | / || '|\ \ /\ / /\ / /| '|\ \ /\ / /\ / /| '|\ \ /\ / /\ / / | | || | \ V V / Vendor: ZyXEL Products Affected: NBG5715...

Osama Bin Laden-Themed Phishing

Summary The intent of this advisory is to provide general guidance to public and private sector organizations and individuals on potential targeted phishing attacks often referred to as “spear phishing” with respect to the Osama Bin Laden related media reporting, and to offer some suggested metho...

KIK Messenger Password Disclosure

KIK Messenger stores password in plain text This is the conclusion of Mobile Security Company, a Dutch organisation specialized in security audits of mobile applications. The username and password are stored in the com.kik.chat.plist file. This file can be viewed on a jailbroken device or when...

Road passenger Baba stored in plain text and any password get-vulnerability warning-the black bar safety net

Brief description: Password stored in plain text plus cross-site worms, you know Detailed description: Register road passenger Baba sent a message, the message content for the test code as /textareascriptalertdocumeng. cookie/script I registered two account xxoo2013 and xxoo2014, the password is ...

Google AD Sync Tool - Exposure of Sensitive Information

Google AD Sync Tool - Exposure of Sensitive Information Sense of Security - Security Advisory - SOS-13-001 Release Date. 03-Apr-2013 Last Update. - Vendor Notification Date. 03-Sep-2012 Product. Google Active Directory Sync GADS Tool Platform. Windows, Linux, Solaris Affected versions. All versio...

Google AD Sync Tool - Exposure of Sensitive Information Vulnerability - Security Advisory - SOS-13-001

Sense of Security - Security Advisory - SOS-13-001 Release Date. 03-Apr-2013 Last Update. - Vendor Notification Date. 03-Sep-2012 Product. Google Active Directory Sync GADS Tool Platform. Windows, Linux, Solaris Affected versions. All versions up to 3.1.3 Severity Rating. High Impact. Exposure of...

Google AD Sync Tool Vulnerability (GADS)

Exploit for multiple platform in category local exploits Due to a weakness in the way the Java encryption algorithm PBEwithMD5andDES has been implemented in the GADS tool all stored credentials can be decrypted into plain-text. This includes all of the encrypted passwords stored in any end-users...