[SECURITY] [DSA 3230-1] django-markupfield security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3230-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini April 20, 2015 http://www.debian.org/security/faq -...

DLA-206-1 django-markupfield - security update

Bulletin has no description...

Debian Security Advisory DSA 3230-1 (django-markupfield - security update)

James P. Turk discovered that the ReST renderer in django-markupfield, a custom Django field for easy use of markup in text fields, didn OpenVAS Vulnerability Test $Id: deb3230.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3230-1 using nvtgen 1.0 Script version: 1.0...

Fedora 20 : rest-0.7.93-1.fc20 (2015-4554)

CVE-2015-2675 rest: memory corruption when using oauth because of implicit declaration of restproxycallgeturl Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as...

DSA-3230-1 django-markupfield - security update

Bulletin has no description...

Fedora Update for rest FEDORA-2015-4554

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-3230-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 20 Update: rest-0.7.93-1.fc20

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of servic es don't actually adhere to this strict definition. Instead, their RESTful e...

openSUSE Security Update : rubygem-rest-client (openSUSE-2015-307)

rubygem-rest-client was updated to fix one security issue. The following vulnerability was fixed : - Application logging of password information in plaintext could have allowed a local attacker to gain access to this information bnc917802 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

WordPress WP REST API Plugin <= 1.2 - Post Revision Disclosure

Because of this vulnerability, unpublished content and post revisions can be retrieved via the REST API. Solution Update the plugin...

WP REST API (WP API) <= 1.2 - Post Revision Disclosure

Unauthenticated users could access revisions of published and unpublished posts. Revisions are now only accessible to authenticated users with permission to edit the revision's post...

Sensitive information displayed in anonymous REST API calls

h4. Expected behavior Block sensitive information from being displayed on anonymous REST API calls in JIRA. h4. Actual behavior Users' full-name are displayed when running the calls below: noformat /user/picker?query= /groupuserpicker?query=ali&showAvatar noformat Default fields and custom fields...

Sensitive information displayed in anonymous REST API calls

h4. Expected behavior Block sensitive information from being displayed on anonymous REST API calls in JIRA. h4. Actual behavior Users' full-name are displayed when running the calls below: noformat /user/picker?query= /groupuserpicker?query=ali&showAvatar noformat Default fields and custom fields...

Sensitive information displayed in anonymous REST API calls

h4. Expected behavior Block sensitive information from being displayed on anonymous REST API calls in JIRA. h4. Actual behavior Users' full-name are displayed when running the calls below: noformat /user/picker?query= /groupuserpicker?query=ali&showAvatar noformat Default fields and custom fields...

CVE-2015-1820 rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses

REST client for Ruby aka rest-client before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect...

rest-client -- session fixation vulnerability

Andy Brody reports: When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration...

Citrix NITRO SDK - Command Injection Vulnerability

A command injection vulnerability in Citrix NITRO SDK's xenhotfix page was discovered. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance along with all underlying applications and data. Abstract...

Citrix Nitro SDK - Command Injection

Citrix Nitro SDK - Command Injection Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all...

Citrix Nitro SDK - Command Injection

Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data. Tested...

ElasticSearch - Search Groovy Sandbox Bypass (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ElasticSearch Search Groovy Sandbox Bypass', 'Description' = %q This module exploits a remote command execution RCE vulnerability in...