[SECURITY] [DSA 3046-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3046-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 05, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3046-1 (mediawiki - security update)

It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed from CSS,...

CVE-2014-3092

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for...

Session fixation

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for...

CVE-2014-3092

CVE-2014-3092 affects IBM Jazz Team Server-based products (e.g., Rational CLM suite, RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM) where the session cookie is not marked Secure in HTTPS, enabling potential cookie leakage over HTTP. The root cause is the cookie’s missing Secure flag during SSL s...

CVE-2014-3092

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for...

Gary McGraw on the IEEE Center for Secure Design

Dennis Fisher talks with Gary McGraw of Cigital about the IEEE’s new Center for Secure Design program, the difficulty of defeating large classes of bugs and the collaborative effort it will take to solve the software security problem. Music by Chris Gonsalves Download: digitalunderground164.mp3...

LiveWorld Multiple Products - Cross Site Scripting

LiveWorld Multiple Products - Cross Site Scripting LiveWorld Cross Site Scripting Vendor: LiveWorld, Inc Product: LiveWorld Version: Multiple Products Website: http://www.liveworld.com CVE: CVE-2004-2566 OSVDB: 9180 PACKETSTORM: 34143 Description: LiveWorld provides collaborative services for...

CVE-2014-4775

IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2 do not properly protect credentials, which allows remo...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote...

Sql injection

SQL injection vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to...

Design/Logic Flaw

IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2 allow local users to obtain administrator privileges v...

CVE-2014-3063

IBM InfoSphere Master Data Management - Collaborative Edition (CDE) versions 10.x before 10.1-FP11 and 11.x before 11.0-FP5, and InfoSphere MDM Server for Product Information Management (PIM) 9.x before 9.1-FP15, 10.x, and 11.x before 11.3-IF2 are affected by a local privilege escalation that cou...

CVE-2014-4775

IBM InfoSphere Master Data Management – Collaborative Edition 10.x (before 10.1-FP11) and 11.x (before 11.0-FP5) plus InfoSphere Master Data Management Server for Product Information Management 9.x (before 9.1-FP15) and 10.x/11.x (before 11.3-IF2) are affected by CVE-2014-4775, which describes fa...

CVE-2014-0966

IBM InfoSphere Master Data Management - Collaborative Edition (GDS component) and the related Server for Product Information Management are affected by CVE-2014-0966. The vulnerability is an SQL injection (blind) that could allow a remote authenticated attacker to view, add, modify, or delete dat...

CVE-2014-0971: IBM InfoSphere Master Data Management - Collaborative Edition session fixation

IBM InfoSphere Master Data Management - Collaborative Edition is affected by a session fixation vulnerability: the application does not upgrade the session identifier after successful authentication, potentially allowing an attacker to impersonate an authenticated user by using the victim’s sessi...

CVE-2014-3009

The CVE-2014-3009 issue affects IBM InfoSphere Master Data Management - Collaborative Edition (GDS component) 10.0–11.0 and IBM InfoSphere Master Data Management Server for Product Information Management 9.0–9.1. Root cause: the GDS component does not properly handle FRAME elements, enabling phis...

CVE-2014-3009

The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct...

CVE-2014-0968

Cross-site scripting XSS vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject...

CVE-2014-0968

CVE-2014-0968 affects IBM InfoSphere Master Data Management - Collaborative Edition (GDS) and MDM Server for Product Information Management. The root cause is improper validation of user-supplied input, enabling cross-site scripting via a crafted URL for an MHTML document. Affected products/versi...