PT-2012-3090

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns the access has bug level function in core/access api.php, which fails to properly restrict access when the private bug view threshold is set to an array. This allows remote...

PT-2012-3094

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns a permission checking flaw in bug actiongroup.php. This flaw allows remote authenticated users with certain privileges to bypass access restrictions and move bug reports to...

PT-2012-3092

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns the SOAP API in MantisBT, where it fails to properly enforce certain permissions, specifically bugnote allow user edit delete and delete bug threshold. This allows remote...

PT-2012-3091

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue makes it easier for remote attackers to copy bug reports without detection because it does not audit when users copy or clone a bug report. Recommendations For versions prior to 1.2.9,...

CVE-2012-1118: Undefined Security Weakness

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...

CVE-2012-1122: Undefined Security Weakness

bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...

CVE-2012-1120: Undefined Security Weakness

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

PayPal will Pay Security Researchers for finding Vulnerabilities

PayPal will Pay Security Researchers for finding Vulnerabilities Payment services provider PayPal will reward security researchers who discover vulnerabilities in its website with money, if they report their findings to the company in a responsible manner. If you manage to find a security flaw in...

Design/Logic Flaw

The Apport hook DistUpgradeApport.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. NOTE: this vulnerabilit...

abrt: may leak some personal information to bugzilla with some certain applications

No documentation needed...

PT-2020-7131

Name of the Vulnerable Software and Affected Versions ABRT affected versions not specified Description The issue allows attackers to obtain sensitive information from crash reports. There is no information provided about the estimated number of potentially affected devices worldwide or real-world...

CVE-2012-2563

Multiple cross-site scripting XSS vulnerabilities in Bloxx Web Filtering before 5.0.14 allow 1 remote attackers to inject arbitrary web script or HTML via web traffic that is examined within the Bloxx Reports component, and allow 2 remote authenticated administrators to inject arbitrary web scrip...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bloxx Web Filtering before 5.0.14 allow 1 remote attackers to inject arbitrary web script or HTML via web traffic that is examined within the Bloxx Reports component, and allow 2 remote authenticated administrators to inject arbitrary web scrip...

CVE-2012-2563

Multiple cross-site scripting XSS vulnerabilities in Bloxx Web Filtering before 5.0.14 allow 1 remote attackers to inject arbitrary web script or HTML via web traffic that is examined within the Bloxx Reports component, and allow 2 remote authenticated administrators to inject arbitrary web scrip...

PT-2012-4104

Name of the Vulnerable Software and Affected Versions Bloxx Web Filtering versions prior to 5.0.14 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via web traffic examined within...

CVE-2012-2563: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Bloxx Web Filtering before 5.0.14 allow 1 remote attackers to inject arbitrary web script or HTML via web traffic that is examined within the Bloxx Reports component, and allow 2 remote authenticated administrators to inject arbitrary web scrip...

Ubuntu 11.04 / 11.10 / 12.04 LTS : update-manager vulnerability (USN-1443-2)

USN-1443-1 fixed vulnerabilities in Update Manager. The fix for CVE-2012-0949 was discovered to be incomplete. This update fixes the problem. Felix Geyer discovered that the Update Manager Apport hook incorrectly uploaded certain system state archive files to Launchpad when reporting bugs. This...

Open Source Vulnerability Scanner: OpenVAS

OpenVAS is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution.The powerful and comprehensive OpenVAS solution is available as Free Software and maintained on a daily basis. Open Source Vulnerability Scanner:...

Ubuntu: Security Advisory (USN-1443-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 11.04 / 11.10 / 12.04 LTS : update-manager vulnerabilities (USN-1443-1)

It was discovered that Update Manager created system state archive files with incorrect permissions when upgrading releases. A local user could possibly use this to read repository credentials. CVE-2012-0948 Felix Geyer discovered that the Update Manager Apport hook incorrectly uploaded certain...