Confluence search returns results from Questions, eventhough CQ does not have anonymous "can-use" permissions

h4.Steps to Reproduce: Install CQ "1.0.618" or "1.0.618.001" Make sure that CQ does not have anonymous access Browse through Confluence as anonymous Do a search h4.Expected Results: Results should not contain anything from Questions. h4.Actual Results: Results show Questions topics, but upon...

Confluence search returns results from Questions, eventhough CQ does not have anonymous "can-use" permissions

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47841. panel h4.Steps to Reproduce: Install CQ "1.0.618" or "1.0.618.001" Make sure that CQ does not have anonymous access Brows...

Confluence search returns results from Questions, eventhough CQ does not have anonymous "can-use" permissions

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47841. panel h4.Steps to Reproduce: Install CQ "1.0.618" or "1.0.618.001" Make sure that CQ does not have anonymous access Brow...

Microsoft Pillar - Client Side SWF Cross Site Vulnerability

Document Title: =============== Microsoft Pillar - Client Side SWF Cross Site Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1328 https://www.youtube.com/watch?v=jVMHhCxM2pY Release Date: ============= 2014-09-29 Vulnerability Laboratory ID VL-ID:...

openssl: DTLS anonymous (EC)DH denial of service

A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman DH key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled...

PayPal Inc BB #71 PPM - Persistent Filter Vulnerability

Document Title: =============== PayPal Inc BB 71 PPM - Persistent Filter Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=870 PayPal Security UID: Roc83bl Release Date: ============= 2014-09-24 Vulnerability Laboratory ID VL-ID:...

openssl: DTLS anonymous (EC)DH denial of service

A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman DH key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled...

Anonymous authentication in ldap_bind() function of PHP, using null byte

More info at https://framework.zend.com/security/advisory/ZF2014-05...

(Plone): Anonymous users can batch change titles of content items

It was discovered that Plone, included as a part of luci, allowed a remote anonymous user to change titles of content items due to improper permissions checks...

(Plone): Anonymous users can list user account names

It was discovered that Plone, included as a part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially crafted URL that, when processed, could allow the attacker to enumerate user account names...

Add global option "Enable group <anyone>"

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-39912. panel As mentioned in JRA-18076 and JRA-23255, the predefined group anyone poses security risks in many cases as it exposes projects t...

Add global option "Enable group <anyone>"

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-39912. panel As mentioned in JRA-18076 and JRA-23255, the predefined group anyone poses security risks in many cases as it exposes projects ...

Design/Logic Flaw

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the...

[SECURITY] Fedora 20 Update: tor-0.2.4.23-1.fc20

Tor is a connection-based low-latency anonymous communication system. Applications connect to the local Tor proxy using the SOCKS protocol. The local proxy chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the...

[SECURITY] Fedora 19 Update: tor-0.2.4.23-1.fc19

Tor is a connection-based low-latency anonymous communication system. Applications connect to the local Tor proxy using the SOCKS protocol. The local proxy chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20140813)

It was discovered that the OBJobj2txt function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. CVE-2014-3508 Multiple flaws were discovered in the way OpenS...

Anonymous Hackers Claim to Identify the Cop Who killed Mike Brown in Ferguson

Members of the international hacker collective Anonymous have claimed they have identified the Ferguson, Missouri law enforcement officer involved in the fatal shooting of Michael Brown, an unarmed teenager killed on Saturday, which sparked days of protest and raised racial tensions. The hacktivi...

openssl: DTLS anonymous (EC)DH denial of service

A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman DH key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled...

DEBIAN-CVE-2014-3510

The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service NULL pointer dereference and client application crash via a crafted handshake message in conjunction with a 1...

openssl: DTLS anonymous (EC)DH denial of service

A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman DH key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled...