Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...

Cisco MARS Information Disclosure Vulnerability

A vulnerability in the configuration of the XML parser of the Cisco Security Monitoring, Analysis and Response System MARS could allow an unauthenticated, remote attacker to have "read" access to part of information stored in the affected system. The vulnerability is due to improper handling of X...

Grant "Browse Project" permission to "Current Assignee" makes project visible to all users

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report|http://jira.atlassian.com/browse/JRASERVER-31720. panel panel:title=Status Update|borderStyle=solid|borderColor=ff7f7f|titleBGColor=ff7f7f|bgColor=e5e5e5 Hi everyone, We have reviewed...

CVE-2013-1623

The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks...

Default application configuration files are available for download

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-27693. panel h3. Summary of The Bug By browsing to the following URL path user would be able to download any files under...

Default application configuration files are available for download

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-27693. panel h3. Summary of The Bug By browsing to the following URL path user would be able to download any files under...

Cisco Wireless LAN Controller Software Form Post Denial of Service Vulnerability

Cisco Wireless LAN Controller Software contains a vulnerability that could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient validation of user-supplied input to the affected software. An authenticated, remote attacker cou...

Cisco Wireless LAN Controller Cross-Site Request Forgery Vulnerability

Cisco Wireless LAN Controller WLC Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site request forgery attacks on a targeted system. The vulnerability is due to insufficient sanitization of user-supplied input processed by the WLC management...

CVE-2012-3523

The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection"...

Stable Channel Update

The Stable channel has been updated to 22.0.1229.92 for Windows, Mac, and Linux. This update contains a number of stability fixes, including an issue with multiple profiles on Mac OS X 10.8.2. It also contains a fix for text display on the Mac, as well as the security updates listed below. Securi...

Fedora Core 3 : mailman-2.1.5-30.fc3 (2005-132)

There is a critical security flaw in Mailman 2.1.5 which will allow attackers to read arbitrary files. The extent of the vulnerability depends on what version of Apache httpd you are running, and possibly how you have configured your web server. It is believed the vulnerability is not available...

Fedora Core 2 : mailman-2.1.5-8.fc2 (2005-131)

There is a critical security flaw in Mailman 2.1.5 which will allow attackers to read arbitrary files. The extent of the vulnerability depends on what version of Apache httpd you are running, and possibly how you have configured your web server. It is believed the vulnerability is not available...

webERP 4.08.4 SQL Injection

Exploit Title: webERP =4.08.4 WorkOrderEntry.php SQL Injection Vulnerability Date: 14/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.weberp.org Software Link: http://sourceforge.net/projects/web-erp/files/ Version: 4.08.4 Tested on: Windows 2003 Standard...

webERP 4.08.4 - WorkOrderEntry.php SQL Injection

webERP 4.08.4 - WorkOrderEntry.php SQL Injection Exploit Title: webERP =4.08.4 WorkOrderEntry.php SQL Injection Vulnerability Date: 14/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.weberp.org Software Link: http://sourceforge.net/projects/web-erp/files/...

webERP 4.08.4 - 'WorkOrderEntry.php' SQL Injection

Exploit Title: webERP =4.08.4 WorkOrderEntry.php SQL Injection Vulnerability Date: 14/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.weberp.org Software Link: http://sourceforge.net/projects/web-erp/files/ Version: 4.08.4 Tested on: Windows 2003 Standard...

User email showing in suggestions section with visibility set to hidden

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report|http://jira.atlassian.com/browse/JRASERVER-29690. panel Assignee user-picker shows user email in Suggestions section, with User Email Visibility set to hidden. Steps to reproduce: Ema...

Persistent xss flaw in the revision history (of comments).

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47387. panel Whilst a comment is html encoded /sanitized when displayed within an answer to a question the revision history page...

ValidationHash generation should use random.SystemRandom instead of random class

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47146. panel ValidationHash generation should use random.SystemRandom instead of the random.Random class when generating a rando...

ValidationHash generation should use random.SystemRandom instead of random class

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47146. panel ValidationHash generation should use random.SystemRandom instead of the random.Random class when generating a rand...

CVE-2012-0283

Cross-site scripting XSS vulnerability in the tplmediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php...