Sql injection

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

CmsEasy最新版5.5 存储型XSS导致GetShell

简要描述： n处XSS，我不信都插完打不到cookie，get不了shell -.- 详细说明： 第一处（只代码审计第一处，后面几处类似。都是没有过滤）： function loginfalse cookie::set'loginfalse',int cookie::get'loginfalse'+1,time+3600; event::log'loginfalse','失败 user='.front::post'username'; front::flashlang'登陆失败！'."".lang'backuppage'."";...

RHEL 6 : Subscription Asset Manager 1.4 (RHSA-2014:1863)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1863 advisory. Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines. Red Hat...

Important: Red Hat Security Advisory: Subscription Asset Manager 1.4 security update

Updated Subscription Asset Manager 1.4 packages that fix multiple security issues are now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for ea...

Fedora 21 : python-rhsm-1.13.6-1.fc21 / subscription-manager-1.13.6-1.fc21 (2014-13647)

New features : - Send list of compliance reasons on dbus - Added client-side support for --matches on the list command. Security : - 1153375: Support TLSv1.2 and v1.1 by default. CVE-2014-3566 Bug fixes : - 1120772: Don't traceback on missing /ostree/repo - 1094747: add appdata metdata file -...

[SECURITY] Fedora 21 Update: subscription-manager-1.13.6-1.fc21

The Subscription Manager package provides programs and libraries to allow u sers to manage subscriptions and yum repositories from the Red Hat entitlement platform...

RHEL 5 : MRG (RHSA-2014:0350)

This is the final notification for the retirement of Red Hat Enterprise MRG Version 1 for Red Hat Enterprise Linux 5. This notification applies only to those customers with subscriptions for Red Hat Enterprise MRG Version 1 for Red Hat Enterprise Linux 5. In accordance with the Red Hat Enterprise...

RHEL 6 : rhev-hypervisor6 (RHSA-2013:0907)

An updated rhev-hypervisor6 package that fixes two security issues and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

[SECURITY] Fedora 20 Update: subscription-manager-1.13.6-1.fc20

The Subscription Manager package provides programs and libraries to allow u sers to manage subscriptions and yum repositories from the Red Hat entitlement platform...

Fedora Update for subscription-manager FEDORA-2014-13781

Check the version of subscription-manager SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868455"...

Fedora 20 : python-rhsm-1.13.6-1.fc20 / subscription-manager-1.13.6-1.fc20 (2014-13781)

New features : - Send list of compliance reasons on dbus - Added client-side support for --matches on the list command. Security : - 1153375: Support TLSv1.2 and v1.1 by default. CVE-2014-3566 Bug fixes : - 1120772: Don't traceback on missing /ostree/repo - 1094747: add appdata metdata file -...

Adding Subscription Cal by URL stores user password unencrypted

I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really no excuse for this. Subscribe to a calendar by url, then in the DB : code SELECT TOP 1000 ID ,KEY ,SUBCALENDARID ,VALUE FROM YOUR-DB-NAME.dbo.AO950DC3TCSUBCALSPROPS code As an...

Adding Subscription Cal by URL stores user password unencrypted

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48402. panel I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really ...

Adding Subscription Cal by URL stores user password unencrypted

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-48402. panel I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really...

Adding Subscription Cal by URL stores user password unencrypted

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48402. panel I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really ...

mlb.mlb.com XSS vulnerability

Open Bug Bounty ID: OBB-51540 Description| Value ---|--- Affected Website:| mlb.mlb.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

WePay: Horizontal Privilege Escalation

An attacker can update the subscription details of the victim without any action from the victim. Following are the steps to reproduce: 1. Login into account with any set of credentials, say [email protected] 2. Click on "Create an Account", Click on Organization, Fill in all the details. Complete...

AST-2014-009: Remote crash based on malformed SIP subscription requests

Asterisk Project Security Advisory - AST-2014-009 Product Asterisk Summary Remote crash based on malformed SIP subscription requests Nature of Advisory Remotely triggered crash of Asterisk Susceptibility Remote authenticated sessions Severity Major Exploits Known No Reported On 30 July, 2014...

Low: Red Hat Security Advisory: Red Hat Storage 2.1 security, bug fix, and enhancement update

Updated glusterfs, geo-replication, and native client packages that fix one security issue, several bugs, and adds an enhancement are now available Red Hat Storage 2.1. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: katello-configure security update

An updated katello-configure package that fixes one security issue is now available for Red Hat Subscription Asset Manager. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...