UploadAttachmentsAction XSRF

The UploadAttachmentsAction action is declared to use a validatingStack interceptor chain, but does not use the RequiresSecurityToken element, leaving it open to an XSRF attack. If this were exploited, an attacker could force a user’s browser to upload files into a space they have write permissio...

Holiday Season Phishing Scams and Malware Campaigns

Since the winter holidays are quickly approaching, US-CERT is republishing this entry to increase awareness about phishing scams and malware campaigns. In the past, US-CERT has received reports of an increased number of phishing scams and malware campaigns that take advantage of the winter holida...

GLSA-201211-01 : MantisBT: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201211-01 MantisBT: Multiple vulnerabilities Multiple vulnerabilities have been discovered in MantisBT. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could exploit these vulnerabilities...

Design/Logic Flaw

The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments...

CVE-2012-4495

The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments...

CVE-2012-4495

CVE-2012-4495 affects the Drupal Mime Mail module (6.x-1.x before 6.x-1.1). The root cause is improper restriction of access to files outside Drupal’s publish files directory, allowing remote authenticated users to send arbitrary files as attachments. Impact is that authenticated users can attach...

Malware making bomb and death threats detected

Japanese police had arrested three people, accused them of making death threats via email and discussion forums. However, later Researchers at Symantec have determined that a piece of malware was making death and bomb threats online on behalf of its victims infected. Symantec confirmed that the...

Threat Outbreak Alert: Fake Changelog Email Messages on September 11, 2014

Medium Alert ID: 27244 First Published: 2012 October 19 18:19 GMT Last Updated: 2014 September 12 13:05 GMT Version: 5 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a changelog for the recipient. The text in the email message attempt...

Accidental XSRF and DoS consumption-of-space issue

We experienced an unusual growth of our nonspaced attachments that appears to be a DoS vunerability both in an accidental way with a workaround and intentional not easily worked around. This is under Confluence 4.0, but appears to probably apply to 4.3.1 as well. It appears the growing nonspaced...

CVE-2012-3731

Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors...

CVE-2012-3730

Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments via a header value that was also used in a previous e-mail message, as demonstrated by a message from a different sender...

Code injection

Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments via a header value that was also used in a previous e-mail message, as demonstrated by a message from a different sender...

CVE-2012-3730

Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments via a header value that was also used in a previous e-mail message, as demonstrated by a message from a different sender...

Inherit Edit Restrictions for Child Pages

As it said in Documentation for Page Restrictions|https://confluence.atlassian.com/display/DOC/Page+Restrictions: quote'Edit' restrictions are not inherited from the parent page, only from the space. In a space, the 'Add Pages' permission governs both the creation and the editiing of pages. See...

Inherit Edit Restrictions for Child Pages

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-26446. panel As it said in Documentation for Page Restrictions|https://confluence.atlassian.com/display/DOC/Page+Restrictions:...

FreeBSD Ports: mantis

The remote host is missing an update to the system as announced in the referenced advisory. VID 55587adb-b49d-11e1-8df1-0004aca374af OpenVAS Vulnerability Test $ Description: Auto generated from VID 55587adb-b49d-11e1-8df1-0004aca374af Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-1200 A flaw was found in the way browser plug-ins interac...

Threat Outbreak Alert: Fake Anti-Phishing Email Messages on March 9, 2015

Low Alert ID: 26510 First Published: 2012 July 30 22:05 GMT Last Updated: 2015 March 10 11:01 GMT Version: 32 Summary Cisco Security has detected significant activity related to spam email messages that claim to be from the antiphishing.org support team. The message claims the recipient's system...

WordPress Plugin Resume Submissions & Job Postings 2.5.1 - Unrestricted Arbitrary File Upload

Exploit Title: WordPress Resume Submissions & Job Postings v2.5.1 Unrestricted File Upload Date: 7/9/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.geerservices.com/ Software Link: http://downloads.wordpress.org/plugin/resume-submissions-job-postings.2.5.1.zip Version: 2.5.1...

Debian DSA-2500-1 : mantis - several vulnerabilities

Several vulnerabilities were discovered in Mantis, an issue tracking system. - CVE-2012-1118 Mantis installation in which the privatebugviewthreshold configuration option has been set to an array value do not properly enforce bug viewing restrictions. - CVE-2012-1119 Copy/clone bug report actions...