Session must not be invalidated on logout

People ran into problems|http://forums.atlassian.com/thread.jspa?forumID=101&threadID=29965 because we started invalidating the session on logout in 2.9.2. They expect certain session attributes like the seraph LOGGEDOUTKEY to be present. This means we need to remove all session attributes except...

CVE-2008-2221

Unspecified vulnerability in the Java plugin in IBM WebSphere Application Server 5.0.2 allows untrusted applets to gain privileges via unknown attack vectors...

SuSE 10 Security Update : Security update for (ZYPP Patch Number 5134)

This update brings Mozilla Firefox to security update version 2.0.0.13 Following security problems were fixed : - XUL popup spoofing variant cross-tab popups. MFSA 2008-19 / CVE-2008-1241 - Java socket connection to any local port via LiveConnect. MFSA 2008-18 / CVE-2008-1195 / CVE-2008-1240 -...

mozilla -- multiple vulnerabilities

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program. MFSA 2008-19 XUL popup spoofing variant cross-tab popups MFSA 2008-18 Java sock...

Privacy issue with SSL Client Authentication — Mozilla

Peter Brodersen and Alexander Klink independently reported that the default setting for SSL Client Authentication, automatically selecting a client certificate on behalf of the user, creates a potential privacy issue for users by allowing tracking through client certificates. For users who alread...

Unfixed XSS vulnerability at searchsnap.net

Security researcher Mystick, has submitted on 03/11/2008 a cross-site-scripting XSS vulnerability affecting searchsnap.net, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/11/2010. It is currently...

skyportal vrc6 - Multiple Vulnerabilities

WwW.BugReport.ir BugReport Security Research & Penetration Testing Group Title: Sky Portal Multiple SQL Injection Vulnerabilities Vendor: http://skyportal.net Exploitation: Remote with browser Fix Available: Patched In Last Version In Vendor Leaders : Shahin Ramezany & Sorush Dalili Team Members:...

CVE-2007-0227

CVE-2007-0227 affects slocate 3.1, which does not properly manage database entries that specify names of files in protected directories, enabling local users to obtain the names of private files. The issue is not present in slocate 2.7. Public references indicate multiple advisories (Ubuntu USN-4...

CVE-2005-0149

Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2004:150)

Daniel Fabian discovered a potential privacy issue in KDE. When creating a link to a remote file from various applications, including Konqueror, the resulting URL may contain the authentication credentials used to access that remote resource. This includes, but is not limited to, browsing SMB Sam...

Insecure handling of notes in Slashcode

Security Advisory - September 9, 2001 plastic.com's Slashcode Overview: The implementation of private notes on plastic.com's Slashcode-driven site is insecure. Any logged in user can view any message in the system. Description: After logging into the site as a user,...

cuartangojc-clipboard-msie.txt

Date: Thu, 21 Jan 1999 15:59:15 +0100 From: Juan Carlos Garcia Cuartango To: [email protected] Subject: New IE4 privacy issue Greetings, There is a new IE 4 issue affecting privacy. The clipboard content can be made public by a javascript code two lines long. I reported the problem...

netscape.4.x-javascript.txt

Date: Wed, 28 Oct 1998 10:22:02 PST From: Georgi Guninski Subject: Javascript bug in Netscape Communicator 4.5 There is a bug in Netscape Communicator 4.5, 4.07, 3.04 under Windows 95 probably others which allows reading user's cache the urls the user has visited, including the info in GET forms...

sun.cc.compiler.txt

Date: Tue, 15 Jun 1999 00:17:12 +1000 From: Darren Reed To: [email protected] Subject: big brother in your cc Whilst this isn't strictly speaking a security bug, it borders on Sun acting in a very "big brother" manner which is frightening! For those of you using Sun's SUNWspro C compiler...

microsoft.privacy.issue.txt

Date: Tue, 11 May 1999 21:55:22 -0600 MDT From: cult hero To: InfoSec News Subject: ISN Everywhere your MAC address shows up Forwarded From: MICROSOFT'S HEAVY HAND IN THE COOKIE JAR A special report from YEOW - Barry Simon. See the Woody's Office Watch discussion and details on the Office 97...