Design/Logic Flaw

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient...

Joomla! < 3.8.0 Information Disclosure Vulnerability

Joomla is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

CVE-2017-14595

In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...

CVE-2017-14595

In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...

Information disclosure

In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...

CVE-2017-14595

In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...

[20170901] - Core - Information Disclosure

A logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...

Borg Spoofing Vulnerability

Borg is a deduplication backup program that supports compression and authentication encryption, among other things. A security vulnerability exists in versions of Borg prior to 1.0.9, which stems from an error in the encryption protocol used to validate manifests archive lists. An attacker could...

Harvest: Stored XSS in Restoring Archived Tasks

Hello Harvest Team, There is stored XSS in restoring archived/deleted tasks. POC: 1. Create a task with name with xss payload " 2. Now from Tasks, delete the task and the task will be archived. 3. Now Click on Manage archived tasks, to restore it back. 4. Click on the task with xss payload, XSS i...

PYSEC-2016-1

The createscript function in the lxccontainer module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on 1 /opt/.lxc-attach-script, 2 the archived container in the archivepath directory, or the 3...

openSUSE Security Update : systemd (openSUSE-2016-488)

This update for systemd fixes several issues : e5e362a udev: exclude MD from block device ownership event locking 8839413 udev: really exclude device-mapper from block device ownership event locking 66782e6 udev: exclude device-mapper from block device ownership event locking bsc972727 1386f57...

Cross site scripting

Cross-site scripting XSS vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts...

CVE-2015-7536

Cross-site scripting XSS vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts...

CVE-2015-7536

Cross-site scripting XSS vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts...

FTGate 2009 Build 6.4.00 - Multiple Vulnerabilities

Exploit for php platform in category web applications Vendor: ================================ www.ftgate.com Product: ======================================== FTGate 2009 SR3 May 13 2010 Build 6.4.00 Vulnerability Type: ================================= Cross site request forgery CSRF CVE...

Disconnect.me Mac OSX Client 2.0 - Local Privilege Escalation

Disconnect.me Mac OSX Client 2.0 - Local Privilege Escalation Disconnect.me is the search engine entrusted by the Tor Browser. Unfortunately, the Mac OS X client has an LPE to root vulnerability 0day. Original Download = v2.0: https://disconnect.me/premium/mac Archived Download: http://d-h.st/LKq...

Info-ZIP UnZip 5.50 Encoded Character Hostile Destination Path Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7550/info Info-ZIP UnZip contains a vulnerability during the handling of pathnames for archived files. Specifically, when certain encoded characters are inserted into '../' directory traversal sequences, the creator of th...

doremovespacemail action can be called by non-admins

The doremovespacemail action is provided by the confluence-mail-archiving plugin, and allows all of the archived mail associated with a space to be removed. This action can be called by any authenticated user, which appears to be an oversight in access control, given that similar methods such as...

Plugx RAT targeting government organizations in Japan using spear phishing

Roland Dela Paz Threat Researcher at TrendMirco reported that last year a Malware Campaign to target specific users in Japan, China, and Taiwan once again on rise using new breed of Remote Access Tool RAT called Plugx also known as Korplug. This new custom made version comes for less recognition...

CVE-2006-7219

eZ publish before 3.8.5 does not properly enforce permissions for editing in a specific language, which allows remote authenticated users to create a draft in an unauthorized language by editing an archived version of an object, and then using Manage Versions to copy this version to a new draft...