377 matches found
[SECURITY] Fedora 19 Update: file-roller-3.8.3-1.fc19
File Roller is an application for creating and viewing archives files, such as tar or zip files...
Fedora 19 : file-roller-3.8.3-1.fc19 (2013-12667)
This update fixes CVE-2013-4668 : The File Roller archive manager for the GNOME desktop suffers from a path traversal vulnerability caused by insufficient path sanitization. A specially crafted archive file can be used to trigger creation of arbitrary files in any location, writable by the user...
Gnome File Roller directory traversal
Directory traversal on archive processing...
[oCERT-2013-001] File Roller path sanitization errors
2013-001 File Roller path sanitization errors Description: The File Roller archive manager for the GNOME desktop suffers from a path traversal vulnerability caused by insufficient path sanitization. A specially crafted archive file can be used to trigger creation of arbitrary files in any locatio...
CVE-2013-4668
Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to...
Operation High Roller Now Targets Europe's SEPA Network and Large US Bank
The criminals behind Operation High Roller, a complex wire-fraud scheme that has scammed high-end banking customers out of millions, have added a new dimension of automation to their attacks and expanded their efforts beyond Europe and have targeted a major U.S. bank. Researchers at McAfee provid...
CVE-2012-2381: Apache Roller Cross-Site-Scripting (XSS) vulnerability
Severity: important Vendor: The Apache Software Foundation Versions Affected: Roller 4.0.0 to Roller 4.0.1 Roller 5.0 The unsupported Roller 3.1 release is also affected Description: Roller trusts bloggers to post HTML and JavaScript code in the weblog and for some sites this can be a problem...
CVE-2012-2380: Apache Roller Cross-Site-Resource-Forgery (XSRF) vulnerability
Severity: important Vendor: The Apache Software Foundation Versions Affected: Roller 4.0.0 to Roller 4.0.1 Roller 5.0 The unsupported Roller 3.1 release is also affected Description: HTTP POST interfaces in the Roller admin/editor console were not protected from CSRF attacks. This issue has been...
Three Baltic Men Jailed After Using SpyEye Malware
Two men found using the SpyEye Trojan to swindle users out of their banking information were jailed last week after violating the United Kingdom’s Computer Misuse Act. Pavel Cyganok, 28, a Lithuanian, along with Ilja Zakrevski, 26, an Estonian, were jailed for four years while a third man, Latvia...
New Fraud Ring 'Operation High Roller' Targets the Rich
A recent fraud ring through which attackers raided high-value bank accounts, nicknamed Operation High Roller .PDF, employed attacks that were quick, required no human interaction and have already affected several tiers of credit unions, regional banks and large global banks, over the last several...
CVE-2012-2381
Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role...
CVE-2012-2380
Multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality...
CVE-2012-2381
Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role...
CVE-2012-2380
Multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality...
CVE-2012-2381
Apache Roller exposes multiple XSS vulnerabilities in versions prior to 5.0.1 via untrusted blogger content. Affected: Roller 4.0.0–4.0.1, Roller 5.0, and even the unsupported Roller 3.1. The issue stems from letting bloggers post HTML/JavaScript; an upgrade path recommended by sources is Roller ...
CVE-2012-2380
CVE-2012-2380 affects the Apache Roller project, specifically the admin/editor console. The issue is that HTTP POST interfaces in the Roller admin/editor console were not protected against CSRF, allowing remote attackers to hijack admin/editor authentication. Affected versions include Roller 4.0....
The Cadence of Microsoft Security Patches
By Andrew Storms Every month, like clockwork, Microsoft releases security bulletins and every month people ask me if it’s small or a big release. While the exact details of the patches are generally treated as news, the expected workload each month really shouldn’t be a guessing game because...
