188 matches found
"User Custom Field Value" permission type incorrectly exposes JIRA project names to everyone
Problem: Project names are shown to users with no permission to see the project. Impact: Security hole! Recipe: it helps to have two browsers open one logged in as admin the other as the user I will create called dummy Add user dummy Add project blah Add custom field myuser of type user picker,...
Code injection
Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5 on z/OS allows remote authenticated users to obtain sensitive information via...
IBM WebSphere Application Server 6.1 < Fix Pack 19 Multiple Flaws
IBM WebSphere Application Server 6.1 before Fix Pack 19 appears to be running on the remote host. As such, it is reportedly affected by multiple flaws : - An as-yet unspecified security exposure vulnerability exists when the 'FileServing' feature in the Servlet Engine / Web Container component is...
IBM WebSphere Application Server < 6.1.0.17 Multiple Vulnerabilities
IBM WebSphere Application Server 6.1 before Fix Pack 17 appears to be running on the remote host. As such, it is reportedly affected by multiple flaws : - An attribute in a SOAP security header may cause a security exposure in Web Services applications. PK61315 - An unspecified vulnerability in t...
CVE-2007-3960
Multiple unspecified vulnerabilities in IBM WebSphere Application Server WAS before Fix Pack 21 6.0.2.21 have unknown impact and attack vectors, aka 1 PK33799, or 2 a "Potential security exposure" in the Samples component PK40213...
Code injection
Multiple unspecified vulnerabilities in IBM WebSphere Application Server WAS before Fix Pack 21 6.0.2.21 have unknown impact and attack vectors, aka 1 PK33799, or 2 a "Potential security exposure" in the Samples component PK40213...
CVE-2007-3960
CVE-2007-3960 affects IBM WebSphere Application Server 6.0.x before Fix Pack 21 (6.0.2.21). Connected sources indicate multiple vulnerabilities, including at least one where the web container may emit response data intended for a different request after a closed connection error (PK41446) and oth...
CVE-2006-7198
Unspecified vulnerability in IBM WebSphere Application Server WAS before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.13, has unknown impact and attack vectors, related to a "Potential security exposure," aka PK26123...
CVE-2006-5323
Unspecified vulnerability in IBM WebSphere Application Server before 6.1.0.2 has unspecified impact and attack vectors, related to a "possible security exposure," aka PK29360...
AIX 5.2 : IY64355
The remote host is missing AIX Critical Security Patch number IY64355 SECURITY: POSSIBLY SECURITY EXPOSURE IN CHCOD COMMAND. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...
AIX 5.1 : IY64356
The remote host is missing AIX Critical Security Patch number IY64356 SECURITY: POSSIBLE SECURITY EXPOSURE IN CHCOD COMMAND. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...
CVE-2006-4222
Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.0.2.13 have unspecified vectors and impact, including 1 an "authority problem" in ThreadIdentitySupport as identified by PK25199, and "Potential security exposure" issues as identified by 2 PK22747, 3 PK24334, 4...
CVE-2006-3417
Tor client before 0.1.1.20 prefers entry points based on isfast or isstable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" isguard systems by directory authorities...
IBM WebSphere Widespread configuration JSP disclosure
IBM WebSphere Widespread configuration JSP disclosure Release Date: 04/13/2005 Severity: High Systems Affected IBM WebSphere Application 6 and prior. Description The practice of sharing the document root of the app server within the document root of the web server creates a security exposure that...
Apache Web Server ap_log_rerror() function discloses full path to CGI script
Overview There is a vulnerability in Apache 2.0 through 2.035 that could disclose the real path to a CGI script or other file. Description A vulnerability in the Apache web server could disclose sensitive information. Quoting from the Apache Change Log: Security Added the APLOGTOCLIENT flag to...
Apache Httpd < 2.0.36 : Warning messages could be displayed to users
In some cases warning messages could get returned to end users in addition to being recorded in the error log. This could reveal the path to a CGI script for example, a minor security exposure...
cisco.packet.leakage.txt
Date: Tue, 13 Apr 1999 14:57:11 -0000 From: [email protected] To: [email protected] Subject: Cisco security notice: Input Access List Leakage with NAT -----BEGIN PGP SIGNED MESSAGE----- Cisco IOSR Software Input Access List Leakage with NAT Revision 1.2 For release Tuesday, April 13, 1999, 08:00...