Remember my password with LDAP

At the login screen, when we click on 'Remember my login on this computer' and login, everything works well. When we close the browser without logout, the login should be remember on this computer. When we try to get back into Jira, here's the bug that we have into our log file. 2008-04-22...

Users can move attachments to a space they have no permission for

Any user with permission to edit pages in a space can move attachments in that space to any page in Confluence. Eg: suppose we have a user named StandardUser who has permission to edit pages in GeneralSpace, but no permission to view or edit RestrictedSpace, which contains a page predictably name...

SA-2008-026 - Drupal core - Access bypass

The menu system routes page requests to appropriate handlers. It also determines whether a user has access to pages based on several criteria, such as permissions assigned to a role. Drupal 6 features an entirely revised menu system, including changes to the way access is dealt with, which if not...

FreeBSD-SA-07:10.gtar

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:10.gtar Security Advisory The FreeBSD Project Topic: gtar directory traversal vulnerability Category: contrib Module: contribtar Announced: 2007-11-29 Credits:...

Three minutes to get to the hidden administrator account-vulnerability warning-the black bar safety net

On the regedit. exe everyone is familiar with, but not to the registry key set permissions, regedt32. exe the biggest advantages is the ability to the registry key set permissions. nt/2 0 0 0/xp account information in the registry of HKEYLOCALMACHINE＼SAM＼SAM key, but in addition to the system use...

Evolution: User-assisted remote execution of arbitrary code

Background Evolution is the mail client of the GNOME desktop environment. Camel is the Evolution Data Server module that handles mail functions. Description The imaprescan function of the file camel-imap-folder.c does not properly sanitize the "SEQUENCE" response sent by an IMAP server before bei...

Microsoft Word工作区内存破坏远程代码执行漏洞（MS07-060）

BUGTRAQ ID: 25906 CVECAN ID: CVE-2007-3899 Word是Office办公套件中的文字处理软件。 Word处理特制Word文件的方式中存在一个远程执行代码漏洞，远程攻击者可能利用此漏洞通过诱使用户处理恶意文件控制用户系统。 如果用户打开带有畸形字符串的特制Word文件，该漏洞就可能允许远程执行指令。那些帐户被配置为拥有较少系统用户权限的用户比具有管理用户权限的用户受到的影响要小。 Microsoft Office 2004 for Mac Microsoft Word 2002 SP3 Microsoft Word 2000 SP3 临时解决方法：...

Hidden administrator account the three minutes to get-vulnerability warning-the black bar safety net

On the regedit. exe everyone is familiar with, but not to the registry key set permissions, regedt32. exe the biggest advantages is the ability to the registry key set permissions. nt/2 0 0 0/xp account information in the registry HKEYLOCALMACHINE\SAM\SAM key, but in addition to the system user...

VMware Workstation 6.0多个安全漏洞

BUGTRAQ ID: 25728,25729,25731,25732 CVECAN ID: CVE-2007-0061,CVE-2007-0062,CVE-2007-0063,CVE-2007-4059,CVE-2007-4155,CVE-2007-4496,CVE-2007-4497 VMWare是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。 VMWare的实现上存在多个安全漏洞，可导致多种威胁。 具体如下： 1 VMWare的DHCP服务器可被恶意网页用来获取系统权限。 2...

The use of xss vulnerability can do? - Vulnerability warning-the black bar safety net

Perhaps we often see some of the master testXSSvulnerabilities are alert a window. They thoughtXSSthat is the case, when your own alert out of the window, then said he found the vulnerability. In fact, far not so simple. You found the only programmer of a small bug only, far fromXSS. Their...

Security issue: user can copy page with only view permissions

I have a user who only has view permissions to a space. Logging on as that user, I went to the Info tab of a page. The Copy operation appeared, and I was able click the link, edit the copied page, and save it. This must be a security hole?...

Security issue: user can copy page with only view permissions

I have a user who only has view permissions to a space. Logging on as that user, I went to the Info tab of a page. The Copy operation appeared, and I was able click the link, edit the copied page, and save it. This must be a security hole?...

CommentService validation methods do not check user's security level

The validateCommentUpdate, hasPermissionToUpdate and hasPermissionToDelete methods on DefaultCommentService check the user's comment-related permissions but neglect to check whether they have a role/group security level viewable by the user attempting to delete a comment...

Util-linux安全绕过漏洞

util-linux包含大量底层系统工具。 util-linux不正确验证用户权限，远程攻击者可以利用漏洞绕过安全限制，进行未授权访问。 问题存在于登录进程处理登录时不需要验证，部分参考自身验证的进程允许远程攻击者绕过访问策略，进行未授权访问。 util-linux util-linux 2.12 a + MandrakeSoft Linux Mandrake 10.2 x8664 + MandrakeSoft Linux Mandrake 10.2 x8664 + MandrakeSoft Linux Mandrake 10.2 + MandrakeSoft Linux Mandrak...

The establishment of the hidden super-user-vulnerability warning-the black bar safety net

A few days ago on a websitecan't remember, sorry ^on saw an article introduce how to build a hidden super-user graphic tutorial, give me a lot of inspiration, the author only describes how the local graphical interface is established under the hidden super-user, and the author said he could not a...

Remote upgrade ordinary user permissions-bug warning-the black bar safety net

The steps of: 1, assuming that we pass the scanner to get a 1 9 2. 1 6 8. 0. 1 on a user test password for the test belonging to the administrators group. 2, Using the GetAccount http://www.lsky.org/download/GetAccount.exe 获得 系统 中 已经 存在 的 帐号 信息 of course the use of empty connections are also...

Grayscale Blog 0.8.0 (Security Bypass/SQL/XSS) Multiple Remote Vulns

No description provided by source. Security Advisory - Multiple Vulnerabilities in Grayscale Blog 0.8.0 Date : 2007-02-24 Product : Grayscale Blog Version : 0.8.0 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/gsblogger/ - http://www.karlcore.com/programming/blog/...

Grayscale Blog 0.8.0 - Security Bypass / SQL Injection / Cross-Site Scripting

Security Advisory - Multiple Vulnerabilities in Grayscale Blog 0.8.0 Date : 2007-02-24 Product : Grayscale Blog Version : 0.8.0 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/gsblogger/ - http://www.karlcore.com/programming/blog/ Vendor Status : 2007-02-24 - Not...

Project Role Modifications not reflected in Issue Security Scheme

If you modify users/groups in a project's project role and this project uses an issue security scheme, you must remove the role and re-add it to the issue security scheme for the role changes to take effect. Steps to Reproduce: 1. Need to be the admin of a project whose issue creation screen has...

Microsoft Windows XP/2003 - ReadDirectoryChangesW Information Disclosure

// source: https://www.securityfocus.com/bid/22664/info Microsoft Windows is prone to a local information-disclosure vulnerability. A local attacker may leverage this issue to gain access to potentially sensitive information about user permissions and accessed files. Information gained may aid in...