"JIRA Project Releases" event should respect Project's permissions

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48963. panel Adding "JIRA Project Releases" event type to the Team calendar seems to NOT respect permissions from the project. I...

"JIRA Project Releases" event should respect Project's permissions

Adding "JIRA Project Releases" event type to the Team calendar seems to NOT respect permissions from the project. It means even people that have no access to some project will see the release dates from the forbidden project. Expected behavior: Users should see only "JIRA Project Releases" from...

CA20150604-01: Security Notice for CA Common Services

-----BEGIN PGP SIGNED MESSAGE----- CA20150604-01: Security Notice for CA Common Services Issued: June 4, 2015 CA Technologies Support is alerting customers to multiple potential risks with products that bundle CA Common Services on Unix/Linux platforms. A local attacker may exploit these...

Xxe

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager RQM 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert RTC 2.0 through...

CVE-2015-0112

CVE-2015-0112 maps to an XML External Entity (XXE) issue in IBM Jazz Foundation/CLM stack (Jazz Team Server and multiple CLM-based products). Affected: CLM 3.0.1–5.0.2, RRC 2.0–4.0.7, RDNG 4.x–5.0.2, RELM 1.0/4.0.3–5.0.2, Rhapsody DM 3.0–5.0, RSA DM 3.0–5.0, RTC 2.0–5.0.2, RQM 2.0–5.0.2. Impact: ...

DSA-3281-1 Debian Security Team PGP/GPG key change notice

This is a notice that the Debian Security Team has changed its PGP/GPG contact key because of a periodic regular key rollover. The new key's fingerprint is: 0D59 D2B1 5144 766A 14D2 41C6 6BAF 400B 05C3 E651 The creation date is 2015-01-18 and it has been signed by the previous Security Team conta...

pipe inatomic

The 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local users to cause a denial of service system crash or possibly gain privileges via a...

Syria2u You Shop 1.0 Cross Site Request Forgery / Cross Site Scripting

| Title : Syria2u You Shop v1.0 Mullti Vulnerability | Author : indoushka | email : [email protected] | Dork : سكربت يوشــوب للتسوق عبر الانترنت , قم باختيار المدينة ثم تمتع بالتسوق في مدينتك من أي مكان | Tested on: win8.1 Fr V.Pro 15:39 23/05/2015 | Bug : Mullti | Download :...

Syria2u Arbahtube 1.0 Cross Site Request Forgery / Cross Site Scripting

| Title : Syria2u Arbahtube v1.0 Mullti Vulnerability | Author : indoushka | email : [email protected] | Dork : Copyright ©2014 script syria2u version1. All Rights Reserved. | Tested on: win8.1 Fr V.Pro 15:39 22/05/2015 | Bug : Mullti | Download : http://www.syria2u.com/...

Microsoft to Support SSH in Windows

After several false starts, Microsoft finally is planning to support SSH in Windows and the company’s engineers also will contribute to the OpenSSH project. While SSH has been a popular tool for remote login and command execution on many Unix and linux systems for years, Windows has not supported...

Hive 2.0 RC2 XSS / Code Execution / SQL Injection

| Title : Hive v2.0 RC2 Multi Vulnerability | Author : indoushka | email : [email protected] | Dork : "Powered by DigitalHive" | Tested on: windows 8.1 Français V.Pro | Bug : Stop Script | Download : http:///www.digitalhive.com ======================================= Stop SCript working :...

QuickTalk 1.5 Password Hash Disclosure

| Title : QuickTalk 1.5 Reinstall Script Vulnerability | Author : indoushka | email : [email protected] | Dork : powered by QT-cute | Tested on: windows 8.1 Français V.Pro | Bug : Reinstall Script | Download : http://www.scriptmafia.org ======================================= 1 -...

Novalnet Payment Module Drupal Commerce - Critical - SQL Injection - Unsupported - SA-CONTRIB-2015-117

This module enables you add the Novalnet payment service provider to Drupal Commerce. The module fails to sanitize a database query by not using the database API properly, thereby leading to a SQL Injection vulnerability. Since the affected path is not protected against CSRF, a malicious user can...

Pirelli Router Information Disclosure

Remote information disclosure Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Threat Outbreak Alert RuleID15580: Email Messages Distributing Malicious Software on May 28, 2015

Medium Alert ID: 39055 First Published: 2015 May 29 13:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15580 may contain the following files: Name | Size...

Rockwell RSView32 Security Vulnerability Patched

Human machine interface software from Rockwell Automation has been patched, protecting users from a vulnerability in the way stored passwords are protected. The vulnerability was discovered in RSView32, versions 7.60.00 and earlier, according to an alert from the Industrial Control System Cyber...

DLA-231-1 dulwich - security update

Bulletin has no description...

Chamilo integration - Less Critical - Open Redirect - SA-CONTRIB-2015-115

Chamilo integration module integrates Drupal with Chamilo LMS. The module has an Open Redirect vulnerability, it doesn't sufficiently check passed parameters in the URL. An attacker could trick users to visit malicious sites without realizing it. CVE identifiers issued CVE-2015-5503 Versions...

extjs Arbitrary File Read

Hi all£º Baidu Security Team found a vulnerability in extjs,with this vulnerability we can read arbitrary file and request internal http services File: /examples/feed-viewer/feed-proxy.php line:3-line:6 $feed = $REQUEST'feed'; if$feed != '' && strpos$feed, 'http' === 0 header'Content-Type:...

Visual Mining NetCharts Server saveFile.jsp File Upload

File upload vulnerability in Visual Mining NetCharts Server saveFile.jsp Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...