Etsy Feature Flags Keep Marketplace Online and Secure

BOSTON – Etsy is one of the Web’s biggest marketplaces. Its developers may be one of Web’s busiest teams. Proudly, the vintage and homemade goods online store, will push code to production upwards of 50 times a day. And, according to Kenneth Lee, senior product security engineer, they do so with...

Triton Unified Security Center多个信息泄露漏洞

Bugtraq ID:66687 CVE ID:CVE-2014-0347 Triton Unified Security Center是基于Web浏览器的图形管理的安全应用。 Triton Unified Security Center在实现上存在多个信息泄露漏洞，攻击者可利用这些漏洞查看高级用户存储的凭证。 0 Websense TRITON Unified Security Center 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.websense.com/content/support/library/deployctr/v76/tusccd.asp...

Facebook Bug Bounty Submissions Dramatically Increase

Facebook today reported a dramatic increase in 2013 submissions to its bug bounty program, and said that despite reports from researchers that it’s becoming difficult to find severe bugs on its various properties, the social network plans to increase rewards for critical bugs. “The volume of...

Why Full Disclosure Still Matters

When the venerable Full Disclosure security mailing list shut down abruptly last month, many in the security community were surprised. But a lot of people, even those who had been members of the list for a long time, greeted the news with a shrug. Twitter, blogs and other outlets had obviated the...

Debian Security Advisory DSA 2882-1 (extplorer - security update)

Multiple cross-site scripting XSS vulnerabilities have been discovered in extplorer, a web file explorer and manager using Ext JS. A remote attacker can inject arbitrary web script or HTML code via a crafted string in the URL to application.js.php, admin.php, copymove.php, functions.php, header.p...

SVNManager多个SQL注入漏洞

SVNManager是一个基于Web的SVN资料库的管理工具。 SVNManager存在多个SQL注入漏洞，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。 0 SVNManager 1.x SVNManager 1.10已经修复该漏洞，建议用户下载更新： http://freecode.com/projects/svnmanager...

Fedora Update for mantis FEDORA-2014-3421

Check for the Version of mantis OpenVAS Vulnerability Test Fedora Update for mantis FEDORA-2014-3421 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

FrontAccounting 'attachments.php'任意文件上传漏洞

Bugtraq ID:66217 FrontAccounting FA是一个针对企业ERP供应链的网页会计系统。 FrontAccounting /admin/attachments.php脚本存在安全漏洞，允许攻击者上传使用恶意扩展名的文件，并以WEB权限执行。 0 FrontAccounting 2.x FrontAccounting 2.3.20已经修复该漏洞，建议用户下载更新： http://frontaccounting.com...

Fedora Update for ReviewBoard FEDORA-2014-3446

Check for the Version of ReviewBoard OpenVAS Vulnerability Test Fedora Update for ReviewBoard FEDORA-2014-3446 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

[SECURITY] Fedora 20 Update: ReviewBoard-1.7.22-2.fc20

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It scales well from small projects to large companies and offers a variety of tools to take much of the stress and time out of the code review process...

[SECURITY] Fedora 19 Update: ReviewBoard-1.7.22-1.fc19

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It scales well from small projects to large companies and offers a variety of tools to take much of the stress and time out of the code review process...

[SECURITY] Fedora 19 Update: mantis-1.2.17-1.fc19

Mantis is a free popular web-based issue tracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a web server. Almost any web browser should be able to function as a client. Documentation can be found in: /usr/share/doc/mantis-1.2.17...

Palo Alto Networks PAN-OS < 5.0.10 / 5.1.x < 5.1.5 XSS

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.10 / 5.1.x prior to 5.1.5. It is, therefore, affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input to the web-based device management interface. C Tenable Network Security,...

synetics i-doit pro API跨站脚本漏洞

BUGTRAQ ID：65957 CVE ID：CVE-2014-2231 Synetics i-doit是德国Synetics公司的一个基于Web的开源IT文档和CMDB（配置管理数据库），它能够记录IT系统及其变化的信息，同时针对系统变化制定应急方案，最终确保IT网络稳定、高效的运作。 synetics i-doit 1.2.5之前版本的的API存在跨站脚本漏洞，允许远程攻击者通过产权注入任意的web脚本或HTML。 0 synetics GmbH i-doit 1.2.4 synetics GmbH i-doit 1.1.1 synetics GmbH i-doit 1.1.2...

IBM Rational Quality Manager Jazz Team Server未明远程代码执行漏洞

Bugtraq ID:65900 CVE ID:CVE-2014-0862 IBM Rational Quality Manager是一款为完整的软件开发生命周期提供集成的测试计划和测试资产的协作的，基于Web的质量管理软件。 IBM Rational Quality Manager所包含的Jazz Team服务器存在未明错误，允许远程攻击者利用漏洞执行任意代码。 0 IBM Rational Quality Manager 2.x IBM Rational Quality Manager 3.x IBM Rational Quality Manager 4.x 厂商补丁： IBM...

CVE-2013-7032

Multiple cross-site scripting XSS vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name of an uploaded file or 2 customer name in a resource created from an uploaded file, a different vulnerability...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name of an uploaded file or 2 customer name in a resource created from an uploaded file, a different vulnerability...

Cisco WLC Web-Based Management Interface XSS Vulnerability (CSCuf77810)

A vulnerability in the web-based management interface of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input...

Shadowbox Local File Inclusion

Author: TUNISIAN CYBER + Exploit Title: Shadowbox LFI Vulnerability + Date: 03-02-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Vendor: http://shadowbox-js.com/ + Friendly Sites: na3il.com,th3-creative.com +Description: Shadowbox is a web-based media viewer application that...

Cross-site Scripting Vulnerability

A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. Ref 59010...