CVE-2011-2977

Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files. NOTE: this issue exists because of a regression in 3...

CVE-2011-2977

Bugzilla 3.6.x (up to 3.6.5), 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows fail to delete temporary files created for uploaded attachments, allowing local users to read sensitive data. Root cause: regression in 3.6. Additionally, the vulnerability is limited to Windows builds as s...

CVE-2011-2381

Summary: CVE-2011-2381 is a CRLF injection vulnerability in Bugzilla that allows remote attackers to inject arbitrary email headers via an attachment description in a flagmail notification. The initial description lists affected versions: Bugzilla 2.17.1–2.22.7, 3.0.x–3.3.x, 3.4.x before 3.4.12, ...

Mozilla Bugzilla越权访问漏洞(CVE-2011-2977)

BUGTRAQ ID: 49042 CVE ID: CVE-2011-2977 Bugzilla是很多软件项目都在使用的基于Web的BUG跟踪系统。 Bugzilla在实现上存在多个安全漏洞，远程攻击者可利用这些漏洞获取敏感信息，执行脚本插入和欺骗攻击。 用于上传附件的临时文件没有在Windows上删除。对服务器有本地访问权限的用户可在通常情况下不允许从Bugzilla中查看附件时查看附件。 Mozilla Bugzilla 4.x Mozilla Bugzilla 3.x Mozilla Bugzilla 2.x 厂商补丁： Mozilla -------...

Threat Outbreak Alert: Fake Electronic Payment Cancellation Email Messages on April 8, 2014

Medium Alert ID: 23517 First Published: 2011 June 29 14:00 GMT Last Updated: 2014 April 10 13:53 GMT Version: 80 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an electronic payment cancellation for the recipient. The text in the e-ma...

Atlassian JIRA 3.13.5 - File Download Security Bypass

source: https://www.securityfocus.com/bid/48484/info Atlassian JIRA is prone to a security bypass vulnerability. An attacker can exploit this issue to download arbitrary attachment files within the context of the affected application. = $argv3 echo "\n\nThe second number must be bigger than the...

Jira Atlassian File Attachment Download

======================================= Jira Atlassian File Attachment Download ======================================= Exploit Title: Jira Atlassian Date: 28/3/2010 Author: Ignacio Garrido Mail: Ign.sec gmail com Software Link: http://www.atlassian.com/software/jira/JIRADownloadCenter.jspa...

CVE-2011-1218

Buffer overflow in kvarcve.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .zip attachment, aka SPR PRAD8E3NSP. NOTE: some of these details are obtained from third party information...

CVE-2011-1217

Buffer overflow in kpprzrdr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .prz attachment. NOTE: some of these details are obtained from third party information...

CVE-2011-1216

Stack-based buffer overflow in assr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via crafted tag data in an Applix spreadsheet attachment, aka SPR PRAD8823A7...

CVE-2011-1214

Stack-based buffer overflow in rtfsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted link in a .rtf attachment, aka SPR PRAD8823JQ...

Integer overflow

Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that triggers a stack-based buffer overflow, aka SPR PRAD88MJ2W...

Buffer overflow

Buffer overflow in kpprzrdr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .prz attachment. NOTE: some of these details are obtained from third party information...

Stack overflow

Stack-based buffer overflow in rtfsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted link in a .rtf attachment, aka SPR PRAD8823JQ...

Buffer overflow

Buffer overflow in kvarcve.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .zip attachment, aka SPR PRAD8E3NSP. NOTE: some of these details are obtained from third party information...

CVE-2011-1218

Buffer overflow in kvarcve.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .zip attachment, aka SPR PRAD8E3NSP. NOTE: some of these details are obtained from third party information...

CVE-2011-1215

CVE-2011-1215 is a stack-based buffer overflow in Autonomy KeyView (mw8sr.dll) used by IBM Lotus Notes before 8.5.2 FP3. The vulnerability allows remote code execution via a crafted link in an Office document attachment. The issue is mapped to the KeyView filter used by multiple Symantec/Notes-re...

CVE-2011-1214

Stack-based buffer overflow in rtfsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted link in a .rtf attachment, aka SPR PRAD8823JQ...

CVE-2011-1214

IBM Lotus Notes (with Autonomy KeyView Verity Filter) is affected by CVE-2011-1214 due to a stack-based/buffer overflow in rtfsr.dll. The vulnerability allows remote code execution via a crafted link in a .rtf attachment, with impact as described in NVD (base score 9.3). It affects Lotus Notes pr...

CVE-2011-1218

Summary: CVE-2011-1218 is a buffer overflow in Autonomy KeyView’s kvarcve.dll, affecting IBM Lotus Notes prior to 8.5.2 FP3. A crafted ZIP attachment can trigger remote arbitrary-code execution. The issue is tied to the Verity KeyView Filter used by affected Note applications. Impact (as stated):...