GitLab: User with guest access can access private merge requests

Vulnerability details A guest user to a private group, cannot access a project's merge requests. However, through the subscription API, an attacker can unsubscribe itself to a merge request, revealing private information that shouldn't be accessible. Impact Merge request might contain private...

CVE-2016-4455

It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack...

subscribe.ajc.com XSS vulnerability

Vulnerable URL: https://subscribe.ajc.com/subscriptionpanel?pid='"--...

StoreFront Upgrade Fails with Large Subscription Database

Note: This issue is not found in Storefront 3.11 and later versions. StoreFront upgrade fails with large subscription database. C:\Windows\Temp\StoreFront\CitrixMSI-CitrixStoreFront log points to following error: An error occurredcreating the snapshot: 'System.IO.IOException: The file is too long...

bvdw.org XSS vulnerability

Vulnerable URL: http://www.bvdw.org/anbieter/profil/adition-technologies-ag?company=1566" Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 09:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 225395 VIP websit...

CentOS 7 : python-rhsm / subscription-manager (CESA-2016:2592)

An update for subscription-manager, subscription-manager-migration-data, and python-rhsm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

python, subscription security update

CentOS Errata and Security Advisory CESA-2016:2592 An update for subscription-manager, subscription-manager-migration-data, and python-rhsm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerabili...

key.leawo.com XSS vulnerability

Vulnerable URL: http://key.leawo.com/plugin.php?special=benchmarkemail=subscription=prompt/OPENBUGBOUNTY/...

RedHat Update for subscription-manager RHSA-2016:2592-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : subscription-manager (RHSA-2016:2592)

An update for subscription-manager, subscription-manager-migration-data, and python-rhsm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

subscription-manager: sensitive world readable files in /var/lib/rhsm/

It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack...

PT-2017-8492 · Red Hat +1 · Subscription-Manager +2

Name of the Vulnerable Software and Affected Versions: Subscription Manager versions prior to 1.17.7-1 Description: The issue concerns weak permissions set for cache directories in the Subscription Manager package, allowing local users to access sensitive information by reading files in these...

Candlepin 'subscription-manager' Insecure File Permissions Vulnerability

Candlepin is a collection of subscription tools that allow companies to manage their software. An insecure file permission vulnerability exists in Candlepin 'subscription-manager'. A local attacker could gain access to world-readable files and extract sensitive information from them...

iSpy Keylogger Targets Passwords, Skype, Webcams

Researchers are monitoring sales and infection rates of a new keylogger being sold on the dark web for $25 to $35. Along with capturing keystrokes, iSpy grabs passwords stored in web browsers, records Skype chats, takes webcam screenshots and steals the license keys of software such as Adobe...

Storefront upgrade failing

-In the event viewer windows application logs we get "\CitrixStoreFront-x64.msi failed with error code 1603" -And in CitrixDeliveryServices logs we get " error in retrieving synchronization information " -Checked logs on SF and see that it was unable to stop "Citrix Subscription Store" service...

Moderate: Red Hat Bug Fix Advisory: Satellite 6.2.2 bug fix update

Updated Satellite 6.2 packages that fix several bugs are now available. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs...

online.email.subscription.centre.1sl-applstore.com XSS vulnerability

Vulnerable URL: http://online.email.subscription.centre.1sl-applstore.com/secure/index.php?em=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

your4state.com XSS vulnerability

Vulnerable URL: http://www.your4state.com/search?ppid=searchresultWARsitesearchportletplifecycle=1pstate=normal&searchresultWARsitesearchportletjavax.portlet.action=search=rrrrrrr%22%20onfocus=prompt%22OPENBUGBOUNTY%22%20autofocus%20x=%22=0=0 Details: Description| Value ---|--- Patched:| Yes, at...

How to Export and Import StoreFront Subscription Database on StoreFront 3.6

This article explains how to export and import a StoreFront subscription database on Storefront 3.6. Background The previous versions of StoreFront had different commands to export and import a StoreFront subscription database. The previous commands are now obsolete. The following is the previous...

WordPress ALO EasyMail Newsletter Plugin Cross-Site Request Forgery Vulnerability

The ALO EasyMail Newsletter plugin provides list management results, and it is necessary to read emails from the mail server, so this plugin also stores the login information of the mail server explicitly in the WordPress database. The WordPress Plugin ALO EasyMail Newsletter suffers from a...