The i18n in velocity templates does not auto html encode parameters

All the getText methods on com.atlassian.confluence.util.i18n.DefaultI18NBean are anontated as HtmlSafe which means that any parameter which gets passed in as an argument will not be auto html encoded by the Anti-XSS module. The most straight forward way to fix this is to wrap the parameter insid...

Shared Filter properties exposed without authentication

Some URLs are not protected by authentication which could expose some properties in JIRA that users may not wish to reveal. Example 1: Searching filters http://support.atlassian.com/secure/ManageFilters.jspa?filterView=search Example 2: Viewing properties of filters. I can see custom fields, sear...

Shared Filter properties exposed without authentication

Some URLs are not protected by authentication which could expose some properties in JIRA that users may not wish to reveal. Example 1: Searching filters http://support.atlassian.com/secure/ManageFilters.jspa?filterView=search Example 2: Viewing properties of filters. I can see custom fields, sear...

Shared Filter properties exposed without authentication

Some URLs are not protected by authentication which could expose some properties in JIRA that users may not wish to reveal. Example 1: Searching filters http://support.atlassian.com/secure/ManageFilters.jspa?filterView=search Example 2: Viewing properties of filters. I can see custom fields, sear...

Java Web Start File Inclusion via System Properties Override

Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.218 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the 1 java.home, 2 java.ext.dirs, or 3 user.home System...

Mandriva Update for openoffice.org MDVA-2008:162 (openoffice.org)

Check for the Version of openoffice.org OpenVAS Vulnerability Test Mandriva Update for openoffice.org MDVA-2008:162 openoffice.org Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

CentOS Update for firefox CESA-2008:0549 centos4 i386

Check for the Version of firefox OpenVAS Vulnerability Test CentOS Update for firefox CESA-2008:0549 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CentOS Update for seamonkey CESA-2008:0547 centos3 i386

Check for the Version of seamonkey OpenVAS Vulnerability Test CentOS Update for seamonkey CESA-2008:0547 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify ...

CentOS Update for seamonkey CESA-2008:0547 centos4 i386

Check for the Version of seamonkey OpenVAS Vulnerability Test CentOS Update for seamonkey CESA-2008:0547 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify ...

CentOS Update for firefox CESA-2008:0549 centos3 i386

Check for the Version of firefox OpenVAS Vulnerability Test CentOS Update for firefox CESA-2008:0549 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CentOS Update for seamonkey CESA-2008:0547 centos3 x86_64

Check for the Version of seamonkey OpenVAS Vulnerability Test CentOS Update for seamonkey CESA-2008:0547 centos3 x8664 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify...

GMail, GTalk phishing scam underway

Attention GMail and GTalk users: There’s a major spam run underway with social engineering lures to steal your login cretentials. This image shows a GMail message that purports to be an account termination warning from Google but, if a user is tricked into clicking on the link, he/she is redirect...

The use of python properties. right-vulnerability warning-the black bar safety net

| ! --- The use of python properties provide the right Home not on the network, looked at the python core programming, found an interesting use of python tricks, did not dare to hide Private, to come up with to give you kinky people to share. Whether it is stealing is also good, grab it, and get ...

Cross site scripting

Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting XSS attacks, via vectors involving a chrome XBL method and the window.eval...

Java Web Start File Inclusion via System Properties Override

Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.218 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the 1 java.home, 2 java.ext.dirs, or 3 user.home System...

Java Web Start File Inclusion via System Properties Override

Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.218 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the 1 java.home, 2 java.ext.dirs, or 3 user.home System...

Openfire多个跨站脚本和目录遍历漏洞

BUGTRAQ ID: 32935,32937,32938,32939,32940,32943,32944,32945 Openfire（原名为Wildfire）是一个采用Java开发的跨平台开源实时协作（RTC）服务器。...

fib_semantics.c out of bounds access vulnerability

A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTAMAX to be used as an array size instead of RTNMAX, which leads to an "out of bound access" by the 1 dnfibprops dnfib.c, DECNet and 2 fibprops fibsemantics.c, IPv4 functions...

fib_semantics.c out of bounds access vulnerability

A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTAMAX to be used as an array size instead of RTNMAX, which leads to an "out of bound access" by the 1 dnfibprops dnfib.c, DECNet and 2 fibprops fibsemantics.c, IPv4 functions...

phpGreetCards XSS / File Upload

................................................................................................... remote shell upload/xss script: phpGreetCards download from:http://www.w2b.ru/download/phpGreetCards.zip www.site.com/path/index.php?mode=select&category shell:...