CVE-2017-7517

An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access...

Virtuozzo 6 : emacs-mercurial / emacs-mercurial-el / mercurial / etc (VZLSA-2017-1576)

An update for mercurial is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

DNI Wants Research into Secure Multiparty Computation

The Intelligence Advanced Research Projects Activity IARPA is soliciting proposals for research projects in secure multiparty computation: Specifically of interest is computing on data belonging to different -- potentially mutually distrusting -- parties, which are unwilling or unable e.g., due t...

[SECURITY] Fedora 24 Update: globus-xio-gsi-driver-3.11-1.fc24

The Globus Toolkit is an open source software toolkit used for building Grid systems and applications. It is being developed by the Globus Alliance and many others all over the world. A growing number of projects and companies are using the Globus Toolkit to unlock the potential of grids for thei...

Khan Academy: XSS through document projects

Hello, I'm Ethan Luis McDonough @elmt2 on Khan Academy, and I found a way to inject scripts into document projects. Since KA document projects output HTML, I can edit the PUT request that updates projects https://www.khanacademy.org/api/internal/scratchpads/ID and inject JavaScript code inside an...

emacs, mercurial security update

CentOS Errata and Security Advisory CESA-2017:1576 An update for mercurial is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score...

[SECURITY] Fedora 25 Update: mercurial-3.8.1-3.fc25

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects. Quick start: http://www.selenic.com/mercurial/wiki/index.cgi/QuickStart Tutorial: http://www.selenic.com/mercurial/wiki/index.cgi/Tutorial Extensions:...

Atlassian Bamboo 5.x < 5.15.7 / 6.0.x < 6.0.1 Incorrect Permission Check RCE

According to its self-reported version number, the instance of Atlassian Bamboo running on the remote host is 5.x prior to 5.15.7 or 6.0.x prior to 6.0.1. It is, therefore, affected by a remote code execution vulnerability due to improper validation of edit permissions for deployment projects. An...

[SECURITY] Fedora 26 Update: love-0.10.2-6.fc26

LOVE is an open source, cross platform 2D game engine which uses the Lua scripting language. LOVE can be used to make games of any license allowing it to be used for both free and non-free projects...

Design/Logic Flaw

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this...

CVE-2017-8907

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this...

CVE-2017-8907

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this...

InsightVM/Nexpose Patch Tuesday Reporting

Many of our customers wish to report specifically on Microsoft patch related vulnerabilities. This often includes specific vulnerabilities that are patched in Patch Tuesday updates. This post will show you the various ways that you can create reports for each of these. Remediation Projects...

Incorrect permission check for deployment projects (CVE-2017-8907)

Bamboo did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan...

[SECURITY] Fedora 26 Update: mercurial-4.2-1.fc26

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects. Quick start: http://www.selenic.com/mercurial/wiki/index.cgi/QuickStart Tutorial: http://www.selenic.com/mercurial/wiki/index.cgi/Tutorial Extensions:...

Actionable Vulnerability Remediation Projects in InsightVM

Security practitioners and the remediating teams they collaborate with are increasingly asked to do more with less. They simply cannot remediate everything; it has never been more important to prioritize and drive remediations from start to finish. The Remediation Workflow capability in InsightVM...

CVE-2016-4872

Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail...

Authentication flaw

Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail...

CVE-2016-4872

Cybozu Office versions 9.0.0–10.4.0 contain a breadcrumb-trail based access restrictions bypass (CVE-2016-4872). Remote authenticated attackers can bypass restrictions and view the names of unauthorized projects. This is a user‑capability exposure rather than a full remote execution issue. Mitiga...

CVE-2016-4872: Exposure of Sensitive Information to an Unauthorized Actor

Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail...