CVE-2019-12746

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

CVE-2019-12746

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

Design/Logic Flaw

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

Design/Logic Flaw

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to...

CVE-2019-12746: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

CVE-2019-13458

CVE-2019-13458 affects Open Ticket Request System (OTRS) and its Community Edition: 7.0.x (up to 7.0.8), 5.0.x (up to 5.0.36) and 6.0.x (up to 6.0.19). An attacker with an agent login and appropriate permissions can abuse OTRS notification tags in templates to disclose hashed user passwords. Publ...

CVE-2019-12746

CVE-2019-12746 affects Open Ticket Request System (OTRS) Community Edition: an agent login session ID could be disclosed by sharing a link to an embedded ticket article, enabling potential impersonation. Affected: OTRS 5.0.x up to 5.0.36 and 6.0.x up to 6.0.19. Impact: session impersonation risk ...

CVE-2019-12746

Removed by vendor...

CVE-2019-11209

The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1;...

DEF CON and Feds Partner on Anonymous Bug Submission Program

Hacking conference organizer DEF CON Communications said it plans to roll out a global anonymous bug submission platform based on the SecureDrop communications tool. During a session at DEF CON in Las Vegas last week, conference founder Jeff Moss said the goal was to launch the yet-to-be-named...

[SECURITY] Fedora 29 Update: igraph-0.7.1-12.fc29

igraph wants to be an efficient platform for 1 complex network analysis and 2 developing and implementing graph algorithms. It provides flexible and efficient data structures for graphs and related tasks. It also provides implementation to many classic and new graph algorithms like: maximum flows...

[SECURITY] Fedora 30 Update: igraph-0.7.1-12.fc30

igraph wants to be an efficient platform for 1 complex network analysis and 2 developing and implementing graph algorithms. It provides flexible and efficient data structures for graphs and related tasks. It also provides implementation to many classic and new graph algorithms like: maximum flows...

Congratulations to our Query of the Month Winner for July 2019!

Our Query of The Month competition recognizes the top community-shared query that provides value to other Osquery users. To determine the query of the month, our team selects the customer query that has the most engagement or helps solve an important problem. The winner of the contest each month...

Authorization Bypass

magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as a user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information...

SQL Injection

magento/community-edition is vulnerable to SQL injection. The vulnerability exists as a user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications...

Information Disclosure

magento/community-edition is vulnerable to information disclosure. The vulnerability exists as the samples of disabled downloadable products are accessible due to the lack of user input sanitization...

Authorization Bypass

magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as a low-privileged user to make unauthorized environment configuration changes...

Libgit2 -- multiple vulnerabilities

The Git community reports: A carefully constructed commit object with a very large number of parents may lead to potential out-of-bounds writes or potential denial of service. The ProgramData configuration file is always read for compatibility with Git for Windows and Portable Git installations...

4 Dating Apps Pinpoint Users' Precise Locations – and Leak the Data

Four popular dating apps that together can claim 10 million users have been found to leak precise locations of their members. “By simply knowing a person’s username we can track them from home, to work,” explained Alex Lomas, researcher at Pen Test Partners, in a blog on Sunday. “We can find out...

Evaluating the NSA's Telephony Metadata Program

Interesting analysis: "Examining the Anomalies, Explaining the Value: Should the USA FREEDOM Act's Metadata Program be Extended?" by Susan Landau and Asaf Lubin. Abstract: The telephony metadata program which was authorized under Section 215 of the PATRIOT Act, remains one of the most controversi...