IssueLevelSecurity permission check does not work with a DocumentIssueImpl if no security level has been set.

We need to be able to handle per issue permission checks, if no issue security level has been set. The problem is that if no issue level security is set, -1 gets indexed. The permissions code however expects a null value...

IssueLevelSecurity permission check does not work with a DocumentIssueImpl if no security level has been set.

We need to be able to handle per issue permission checks, if no issue security level has been set. The problem is that if no issue level security is set, -1 gets indexed. The permissions code however expects a null value...

Security level for attachments and screenshots

Discussing inside the team issues reported to JIRA by customers, we can hide from them our in-team comments, but cannot do it to attachments and screen-shots...

CommentService validation methods do not check user's security level

The validateCommentUpdate, hasPermissionToUpdate and hasPermissionToDelete methods on DefaultCommentService check the user's comment-related permissions but neglect to check whether they have a role/group security level viewable by the user attempting to delete a comment...

CommentService validation methods do not check user's security level

The validateCommentUpdate, hasPermissionToUpdate and hasPermissionToDelete methods on DefaultCommentService check the user's comment-related permissions but neglect to check whether they have a role/group security level viewable by the user attempting to delete a comment...

Project Role Modifications not reflected in Issue Security Scheme

If you modify users/groups in a project's project role and this project uses an issue security scheme, you must remove the role and re-add it to the issue security scheme for the role changes to take effect. Steps to Reproduce: 1. Need to be the admin of a project whose issue creation screen has...

Project Role Modifications not reflected in Issue Security Scheme

If you modify users/groups in a project's project role and this project uses an issue security scheme, you must remove the role and re-add it to the issue security scheme for the role changes to take effect. Steps to Reproduce: 1. Need to be the admin of a project whose issue creation screen has...

Project Role Modifications not reflected in Issue Security Scheme

If you modify users/groups in a project's project role and this project uses an issue security scheme, you must remove the role and re-add it to the issue security scheme for the role changes to take effect. Steps to Reproduce: 1. Need to be the admin of a project whose issue creation screen has...

Microsoft Windows Server Service SMB Rename Code Execution (MS06-063; CVE-2006-4696)

SMB Server Message Block is a file, print, and other network services suite used by Windows operating systems. By sending a specially crafted SMB Rename request, an attacker may cause a remote Windows server to reboot or halt. In combination with successful code injection, this could also lead to...

Joomla! Component Kochsuite 0.9.4 - Remote File Inclusion

.: insecurity research team :. ....:...:. . .:. | |/ :/ // :/ .:. : | | | \\ /\ / :. . ..: ||| / \ \ .: .:.. .. ./ .:/:. ./. .:/: . ...:. .advisory. .:... :..................: 18.o8.2oo6 .. Affected Application: Kochsuite v0.9.4 Mambo/Joomla CMS Component . . : contact :...

rt-sa-2005-15.txt

Advisory: BSD Securelevels: Circumventing protection of files flagged immutable By mounting an arbitrary filesystem, it is possible to mask files flagged immutable with any user-defined files. Details ======= Product: FreeBSD up to 6.0-STABLE and 7.0-CURRENT OpenBSD up to 3.8 DragonFly up to 1.2...

[Full-disclosure] BSD Securelevels: Circumventing protection of files flagged immutable

Advisory: BSD Securelevels: Circumventing protection of files flagged immutable By mounting an arbitrary filesystem, it is possible to mask files flagged immutable with any user-defined files. Details ======= Product: FreeBSD up to 6.0-STABLE and 7.0-CURRENT OpenBSD up to 3.8 DragonFly up to 1.2...

bizdb1-search.cgi located

One of the BizDB scripts, bizdb-search.cgi, passes a variable SPDX-FileCopyrightText: 2000 Roelof Temmingh Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

A user cannot set the security level to none if the default security level is set

Selecting 'none' always creates an issue with the default security level...

A user cannot set the security level to none if the default security level is set

Selecting 'none' always creates an issue with the default security level...

SUSE-SA:2005:034: opera

The remote host is missing the patch for the advisory SUSE-SA:2005:034 opera. The web browser Opera has been updated to version 8.01 to fix various security-related bugs. Fixed XMLHttpRequest redirect vulnerability reported in Secunia Advisory 15008. Fixed cross-site scripting vulnerability...

CMDExe.txt

This unpatched vulnerability is a variant of the "Auto SP2 RC Exploit" Solution : Set the security level for all zones to "High" in Internet Explorer // index.htm // locate.HHClick;setTimeout"locator.HHClick",100;setTimeout "window.opener=null;window.close",10000 // htm.txt // document.write" par...

MoveIssue does not keep the security issue level after the move.

MoveIssue does not keep the security issue level after the move...

FreeBSD securelevel protection bypass

It's possible to lower security level by installing new syscall...

When deleting an Issue Security Level issues need to be re-indexed

Create 1 security levels Put some issues into it Delete the level hence removing any security level from the issues You will not be able to find the issues any more - need to re-index...