CVE-2012-1469

CVE-2012-1469 corresponds to multiple XSS vulnerabilities in Open Journal Systems (OJS) up to version 2.3.6, affecting the iBrowser component (lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php) and input fields (editor/callback, authors[][url], Bio Statement, Abstract of Submiss...

CVE-2012-1469

Multiple cross-site scripting XSS vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the 1 editor or 2 callback parameters to lib/pkp/lib/tinymce/jscripts/tinymce/plugins/ibrowser/ibrowser.php in th...

Scientific Linux Security Update : gfs2-utils on SL5.x i386/x86_64

Multiple insecure temporary file use flaws were discovered in GFS2 user level utilities. A local attacker could use these flaws to overwrite an arbitrary file writable by a victim running those utilities typically root with the output of the utilities via a symbolic link attack. CVE-2008-6552 Thi...

wordpress Diary/Notebook theme email spoofing vulnerability-vulnerability warning-the black bar safety net

WordPress this Diary/Notebook theme is to have site5 design of a personal Journal blog system theme. The recent burst of the email spoofing vulnerability. Attach the perl script Exp: !/ usr/bin/perl Exploit Title: Diary/Notebook Site5 WordPress Theme - Email Spoofing Date: 15.07.2012 Exploit...

[SECURITY] Fedora 17 Update: kdepim-4.8.4-4.fc17

KDE PIM Personal Information Manager applications, including: akregator: feed aggregator blogilo: blogging application, focused on simplicity and usability kmail: email client knode: newsreader knotes: sticky notes for the desktop kontact: integrated PIM management korganizer: journal,...

USN-1458-1: Linux kernel (OMAP4) vulnerabilities

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. CVE-2011-4086 A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to...

Ubuntu 8.04 LTS : linux vulnerability (USN-1454-1)

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenab...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2012:0571 Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring Syst...

kernel: jbd2: unmapped buffer with _Unwritten or _Delay flags set can lead to DoS

The journalunmapbuffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the Delay and Unwritten buffer head states, which allows local users to cause a denial of service system crash by leveraging the presence of an ext4 filesystem that was mounted with ...

kernel: jbd2: unmapped buffer with _Unwritten or _Delay flags set can lead to DoS

The journalunmapbuffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the Delay and Unwritten buffer head states, which allows local users to cause a denial of service system crash by leveraging the presence of an ext4 filesystem that was mounted with ...

Android information leakage

All local applications have unrestricted /proce access and access to SQLite journal files...

Advisory: Android SQLite Journal Information Disclosure (CVE-2011-3901)

1 Background ============ Android applications are executed in a sandbox environment, to ensure that no application can access sensitive information held by another, without adequate privileges. For example, The Browser application holds sensitive information such as cookies, cache and history, a...

Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1440-1)

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. CVE-2011-4086 Sasha Levin discovered a flaw in the permission checking for device assignments requested via the kvm ioctl in the...

MS12-034: Description of the security update for Windows Journal: May 8, 2012

None None...

Android SQLite Journal CVE-2011-3901信息泄露漏洞

Bugtraq ID: 53380 CVE ID：CVE-2011-3901 Open Handset Alliance Android是一款超过30家科技与移动电话公司所组成的团体开发的免费的移动电话平台。 Android SQLite数据库journal文件可被所有应用程序读取： -所有目录对应用程序数据库目录拥有执行权限，意味着应用程序数据目录可全局访问。 -/data/data/app package/databases目录以rwxrwx--x权限创建，可导致全局读写。 -数据库目录下创建的journal文件以-rw-r--r--权限创建，可被所有app读取。 0 Open...

Ubuntu 11.10 : linux vulnerabilities (USN-1431-1)

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. CVE-2011-4086 Sasha Levin discovered a flaw in the permission checking for device assignments requested via the kvm ioctl in the...

Phrack #68

Вышел новый номер лучшего журнала...

Multiple vulnerabilities in Open Journal Systems (OJS)

Advisory ID: HTB23079 Product: Open Journal Systems OJS Vendor: Public Knowledge Project Vulnerable Versions: 2.3.6 and probably prior Tested Version: 2.3.6 Vendor Notification: 29 February 2012 Vendor Patch: 16 March 2012 Public Disclosure: 21 March 2012 Vulnerability Type: Arbitrary File...

Global Payments Inc. Acknowledges Breach

Following previous announcements from Visa and Mastercard, electronic credit card processor Global Payments Inc. acknowledged late Friday that its system was breached earlier this year. Global Payments announced via press release that a portion of its processing system had been compromised in ear...

Open Journal Systems 2.3.6 XSS / File Manipulation / Shell Upload

Advisory ID: HTB23079 Product: Open Journal Systems OJS Vendor: Public Knowledge Project Vulnerable Versions: 2.3.6 and probably prior Tested Version: 2.3.6 Vendor Notification: 29 February 2012 Vendor Patch: 16 March 2012 Public Disclosure: 21 March 2012 Vulnerability Type: Arbitrary File...