Novell ServiceDesk 6.5/7.0.3/7.1.0 - Multiple Vulnerabilities

Multiple vulnerabilities in Novell Service Desk 7.1.0, 7.0.3 and 6.5 Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 30/03/2016 / Last updated: 10/04/2016 Background on the...

Novell Service Desk Multiple Vulnerabilities

Novell Service Desk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:novell:servicedesk";...

Cash Desk - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Cash Desk published at the 'play' market has multiple vulnerabilities...

Cash Desk - Base64 encoded String, Corrupted files, Dynamic Code Loading vulnerabilities

HackApp vulnerability scanner discovered that application Cash Desk published at the 'play' market has multiple vulnerabilities...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the getbuildid function in the elfutils.cpp file of the Debuggerd application on the Android operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a local attacker to enhance their privileges through a...

Application Enumeration Fails When Connecting Through Windows App Receiver and NetScaler Gateway

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Application enumeration fails when connecting through Windows App Receiver and NetScaler Gateway...

Project Administrators can adjust permission schemes without having the permission

h3. Summary When alterations to a permission scheme of a Service Desk projects have been made, the project administration page can display an error message as described on the following page: https://confluence.atlassian.com/servicedesk/resolving-permission-scheme-errors-660967497.html In order t...

Project Administrators can adjust permission schemes without having the permission

h3. Summary When alterations to a permission scheme of a Service Desk projects have been made, the project administration page can display an error message as described on the following page: https://confluence.atlassian.com/servicedesk/resolving-permission-scheme-errors-660967497.html In order t...

Project Administrators can adjust permission schemes without having the permission

h3. Summary When alterations to a permission scheme of a Service Desk projects have been made, the project administration page can display an error message as described on the following page: https://confluence.atlassian.com/servicedesk/resolving-permission-scheme-errors-660967497.html In order t...

Code injection

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for...

Customer can see Internal Comment created by Automation Action

h5. Environment - run JIRA from atlas-debug - JIRA 7.0.5 - JIRA Service Desk 3.0.5 h5. Steps to reproduce Create Service Desk project go to Administration - Automation tab click New rule - Custom rule add Trigger Issue Created add Action Add comment put some Comment text and select Internal as...

Customer can see Internal Comment created by Automation Action

h5. Environment - run JIRA from atlas-debug - JIRA 7.0.5 - JIRA Service Desk 3.0.5 h5. Steps to reproduce Create Service Desk project go to Administration - Automation tab click New rule - Custom rule add Trigger Issue Created add Action Add comment put some Comment text and select Internal as...

Customer can see Internal Comment created by Automation Action

h5. Environment - run JIRA from atlas-debug - JIRA 7.0.5 - JIRA Service Desk 3.0.5 h5. Steps to reproduce Create Service Desk project go to Administration - Automation tab click New rule - Custom rule add Trigger Issue Created add Action Add comment put some Comment text and select Internal as...

CVE-2015-8481

Affected products: Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3. The issue arises when the installer attaches the wrong image to e‑mail notifications for issues with inline wiki markup that references an image attachment. This could enable an attacker to...

CVE-2015-5051

IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified...

CVE-2015-5051

IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified...

CVE-2015-5017

The CVE-2015-5017 issue affects IBM Maximo Asset Management family (including Maximo Asset Management 7.6, 7.5, 7.1; Essentials; and related products like SmartCloud Control Desk and Tivoli IT Asset Management for IT). It allows remote authenticated users to bypass access controls by signing in w...

Code injection

IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API...

CVE-2015-7452

IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API...

CVE-2015-7451

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web scrip...