Adding Subscription Cal by URL stores user password unencrypted

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48402. panel I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really ...

Adding Subscription Cal by URL stores user password unencrypted

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48402. panel I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really ...

Adding Subscription Cal by URL stores user password unencrypted

I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really no excuse for this. Subscribe to a calendar by url, then in the DB : code SELECT TOP 1000 ID ,KEY ,SUBCALENDARID ,VALUE FROM YOUR-DB-NAME.dbo.AO950DC3TCSUBCALSPROPS code As an...

Adding Subscription Cal by URL stores user password unencrypted

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-48402. panel I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really...

mlb.mlb.com XSS vulnerability

Open Bug Bounty ID: OBB-51540 Description| Value ---|--- Affected Website:| mlb.mlb.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

WePay: Horizontal Privilege Escalation

An attacker can update the subscription details of the victim without any action from the victim. Following are the steps to reproduce: 1. Login into account with any set of credentials, say [email protected] 2. Click on "Create an Account", Click on Organization, Fill in all the details. Complete...

AST-2014-009: Remote crash based on malformed SIP subscription requests

Asterisk Project Security Advisory - AST-2014-009 Product Asterisk Summary Remote crash based on malformed SIP subscription requests Nature of Advisory Remotely triggered crash of Asterisk Susceptibility Remote authenticated sessions Severity Major Exploits Known No Reported On 30 July, 2014...

Low: Red Hat Security Advisory: Red Hat Storage 2.1 security, bug fix, and enhancement update

Updated glusterfs, geo-replication, and native client packages that fix one security issue, several bugs, and adds an enhancement are now available Red Hat Storage 2.1. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: katello-configure security update

An updated katello-configure package that fixes one security issue is now available for Red Hat Subscription Asset Manager. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Katello: proxied Candlepin calls authorization bypass

A flaw was found where incorrect permission checks in Katello led to certain HTTP API calls being accessible without a proper certificate. An attacker could use this vulnerability to view and alter subscription information for managed systems...

Critical: Red Hat Enhancement Advisory: Release of Satellite 6.0

Red Hat Satellite 6.0 is now available. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without necessity to provide public Internet access to their servers or other client systems. It also performs provisioning and configuration...

Square: Editing Client Details of other People

Hi there, I have found out that there is no "authorization" in which prohibits a user to modify client's data of other users. As per sample I have two2 accounts: One freebie account and One subscribed account Monthly The freebie account has a Client with ID : f42b88d1af62f0a9d240024e83690174. Tha...

SOL15557 - OpenSSH vulnerability CVE-2011-4327

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

(RHSA-2014:1063) Low: Transition Red Hat Network Classic Hosted to Red Hat Subscription Management

Red Hat is transitioning to Red Hat Subscription Management for all Red Hat products by July 31, 2017. All systems registered as clients to Red Hat Network Classic Hosted directly, or indirectly with Red Hat Proxy, must be migrated to Red Hat Subscription Management by July 31, 2017. Customers...

[security bulletin] HPSBMU03081 rev.1 - HP Enterprise Maps, Remote Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04390793 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04390793 Version: 1 HPSBMU03081 rev....

Nmedia MailChimp 3.1 - api_mailchimp/postToMailChimp.php abs_path Parameter XSS

The N-Media MailChimp Subscription WordPress plugin was affected by an apimailchimp/postToMailChimp.php abspath Parameter XSS security vulnerability...

Easebay Resources Paypal Subscription Manager Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/22141/info Easebay Resources Paypal Subscription Manager is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. The vulnerabilities include an...

X-Cart Email Subscription 'email' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36601/info X-Cart is prone to a cross-site scripting vulnerability in the email subscription component because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to...

RHEL 6 : candlepin in Subscription Asset Manager (RHSA-2013:1863)

Updated candlepin packages that fix one security issue are now available for Red Hat Subscription Asset Manager. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

[security bulletin] HPSBMU03048 rev.1 - HP Software Executive Scorecard, Remote Execution of Code, Directory Traversal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04341295 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04341295 Version: 1 HPSBMU03048 rev....