Crowd OpenID server does not enforce profile ownership for viewing

Similar to CWD-3465, it seems that not enforce profile ownership for viewing. That is, a non-admin user called Mallory can view Alice's profile information if Mallory obtains Alice's profileId number. For example, https://openid.atlassian.com/secure/profile/editprofiles.action?profileID=15240744...

Activity stream not respecting parent page restrictions

The Confluence Activity stream will display all pages that the user has access to according to the restrictions. However, if the user is limited in viewing a page due to inherited restrictions from a parent page, the page in question will still show up in the activity stream, and when following t...

DDIVRT-2013-51 DALIM Dialog Server 'logfile' Local File Inclusion

Title ----- DDIVRT-2013-51 DALIM Dialog Server 'logfile' Local File Inclusion Severity -------- High Date Discovered --------------- February 14, 2013 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: 0x00string, Ryan Oliver and r@b13$ Vulnerability Description...

Microsoft Exchange / FAST Search Server code execution

Code execution on Outlook Web Access document viewing / Advanced Filter Pack because of Oracle Outside In technology vulnerability...

MS Exchange Server Remote Code Execution Vulnerabilities (2809279)

This host is missing a critical security update according to Microsoft Bulletin MS13-012. OpenVAS Vulnerability Test $Id: secpodms13-012.nasl 5339 2017-02-18 16:28:22Z cfi $ MS Exchange Server Remote Code Execution Vulnerabilities 2809279 Authors: Antu Sanadi Copyright: Copyright c 2013 SecPod,...

CentOS Update for thunderbird CESA-2013:0145 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

MS Exchange Server Remote Code Execution Vulnerabilities (2784126)

This host is missing a critical security update according to Microsoft Bulletin MS12-080. OpenVAS Vulnerability Test $Id: secpodms12-080.nasl 5346 2017-02-19 08:43:11Z cfi $ MS Exchange Server Remote Code Execution Vulnerabilities 2784126 Authors: Rachana Shetty Copyright: Copyright c 2012 SecPod...

Microsoft Exchange Server Remote Code Execution Vulnerabilities (2784126)

This host is missing a critical security update according to Microsoft Bulletin MS12-080. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

ATutor 2.1 - tool_file Local File Inclusion

ATutor 2.1 - toolfile Local File Inclusion source: https://www.securityfocus.com/bid/56600/info ATutor is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this vulnerability to view files and execute local scripts i...

asaanCart <= 0.9 Multiple Vulnerabilities - Active Check

asaanCart is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Persistent xss within build and plan labels

Labels are not escaped when rendered in several resources and so are a persistent xss vector. Some example resources where this can be seen include: plan configuration, plan viewing, http://$host/bamboo/build/label/viewLabels.action and allPlans.action as filter options. An example label which ca...

Information disclosure

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

CVE-2012-2680

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

Spoofing

The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate attackers to view arbitrary stored photos by spoofing a time value...

CVE-2012-3737

The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate attackers to view arbitrary stored photos by spoofing a time value...

CVE-2012-3737

The CVE-2012-3737 entry concerns iOS Passcode Lock on devices running before iOS 6. A logic issue allowed a physically proximate attacker with device access to view photos by spoofing the device time, bypassing photo access restrictions tied to lock state. The root cause is improper handling of t...

CVE-2012-3737: Undefined Security Weakness

The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate attackers to view arbitrary stored photos by spoofing a time value...

cumin: authentication bypass flaws

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

cumin: authentication bypass flaws

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

Kerry friends of Science and technology cms upload vulnerability-vulnerability warning-the black bar safety net

The program uses the upload page uploadfile. asp not be verified, leading to the establishment of malformations directory upload image the Trojans get a shell vulnerability. Google keywords: inurl:newslist. asp? NodeCode= exp: the...