Scientific Linux Security Update : virt-who on SL7.x (noarch) (20150305)

It was discovered that the /etc/sysconfig/virt-who configuration file, which may contain hypervisor authentication credentials, was world- readable. A local user could use this flaw to obtain authentication credentials from this file. CVE-2014-0189 The virt-who package has been upgraded to upstre...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

Drupal Simple Subscription Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Simple Subscription is one of the subscription modules. A cross-site scripting vulnerability exists in the Drupal Simple Subscription module in versions 6.x-1.1 prior to 6.x-1.x and...

Important: Red Hat Security Advisory: redhat-access-plugin-openstack security update

An updated redhat-access-plugin-openstack package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 6.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which...

SA-CONTRIB-2015-071 - Simple Subscription - Cross Site Scripting (XSS)

This module enables you to add a block to allow visitors to subscribe to a site's newsletter. The module failed to sanitize some block content, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

[SECURITY] Fedora 21 Update: virt-who-0.8-11.fc21

Agent that collects information about virtual guests present in the system and report them to the subscription manager...

ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2015-00152)

ZOHO ManageEngine ADSelfService Plus is a secure, web-based end-user self-service password reset solution. A cross-site scripting vulnerability in ZOHO ManageEngine ADSelfService Plus prior to 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter in...

Sql injection

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

CmsEasy最新版5.5 存储型XSS导致GetShell

简要描述： n处XSS，我不信都插完打不到cookie，get不了shell -.- 详细说明： 第一处（只代码审计第一处，后面几处类似。都是没有过滤）： function loginfalse cookie::set'loginfalse',int cookie::get'loginfalse'+1,time+3600; event::log'loginfalse','失败 user='.front::post'username'; front::flashlang'登陆失败！'."".lang'backuppage'."";...

RHEL 6 : Subscription Asset Manager 1.4 (RHSA-2014:1863)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1863 advisory. Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines. Red Hat...

Important: Red Hat Security Advisory: Subscription Asset Manager 1.4 security update

Updated Subscription Asset Manager 1.4 packages that fix multiple security issues are now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for ea...

Fedora 21 : python-rhsm-1.13.6-1.fc21 / subscription-manager-1.13.6-1.fc21 (2014-13647)

New features : - Send list of compliance reasons on dbus - Added client-side support for --matches on the list command. Security : - 1153375: Support TLSv1.2 and v1.1 by default. CVE-2014-3566 Bug fixes : - 1120772: Don't traceback on missing /ostree/repo - 1094747: add appdata metdata file -...

[SECURITY] Fedora 21 Update: subscription-manager-1.13.6-1.fc21

The Subscription Manager package provides programs and libraries to allow u sers to manage subscriptions and yum repositories from the Red Hat entitlement platform...

RHEL 5 : MRG (RHSA-2014:0350)

This is the final notification for the retirement of Red Hat Enterprise MRG Version 1 for Red Hat Enterprise Linux 5. This notification applies only to those customers with subscriptions for Red Hat Enterprise MRG Version 1 for Red Hat Enterprise Linux 5. In accordance with the Red Hat Enterprise...

RHEL 6 : rhev-hypervisor6 (RHSA-2013:0907)

An updated rhev-hypervisor6 package that fixes two security issues and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

[SECURITY] Fedora 20 Update: subscription-manager-1.13.6-1.fc20

The Subscription Manager package provides programs and libraries to allow u sers to manage subscriptions and yum repositories from the Red Hat entitlement platform...

Fedora Update for subscription-manager FEDORA-2014-13781

Check the version of subscription-manager SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868455"...

Fedora 20 : python-rhsm-1.13.6-1.fc20 / subscription-manager-1.13.6-1.fc20 (2014-13781)

New features : - Send list of compliance reasons on dbus - Added client-side support for --matches on the list command. Security : - 1153375: Support TLSv1.2 and v1.1 by default. CVE-2014-3566 Bug fixes : - 1120772: Don't traceback on missing /ostree/repo - 1094747: add appdata metdata file -...

Adding Subscription Cal by URL stores user password unencrypted

I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really no excuse for this. Subscribe to a calendar by url, then in the DB : code SELECT TOP 1000 ID ,KEY ,SUBCALENDARID ,VALUE FROM YOUR-DB-NAME.dbo.AO950DC3TCSUBCALSPROPS code As an...

Adding Subscription Cal by URL stores user password unencrypted

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-48402. panel I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really...