Content Construction Kit (CCK) - Less Critical - Open Redirect - SA-CONTRIB-2015-126

The Content Construction Kit CCK project is a set of modules that allows you to add custom fields to nodes using a web browser. CCK uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain...

LABjs - Less Critical - Open Redirect - SA-CONTRIB-2015-124

The LABjs module integrates LABjs with Drupal for web performance optimization. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack see SA-CORE-2015-002. Only sites with the Overlay module enabled are vulnerable. CVE...

Acquia Cloud Site Factory Connector - Less Critical - Open Redirect - SA-CONTRIB-2015-125

Acquia Cloud Site Factory provides an environment and a robust set of tools that simplify management of many Drupal sites, allowing you to quickly deliver and manage any number of websites. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an ope...

Administration Views - Moderately Critical - Access Bypass - SA-CONTRIB-2015-122

This module replaces administrative overview/listing pages with Views for improved usability. When combined with other contributed or custom modules, the Administration Views module improperly grants users access to administration pages including the permissions page. This vulnerability is...

US Navy Soliciting Zero Days

The National Security Agency may find and purchase zero days, but that doesn’t mean it’s sharing its hoard with other government agencies such as the U.S. Navy, which apparently is in the market for some unpatched, undisclosed vulnerabilities of its own. A request for proposal posted last...

XML External Entity Injection Vulnerability in Multiple IBM Products

IBM Rational Collaborative Lifecycle Management CLM, etc. are products of IBM Corporation in the U.S. IBM Rational CLM, Rational Team Concert RTC and Rational Engineering Lifecycle Manager are collaborative lifecycle management solutions; Rational Quality Manager RQM is a collaborative, Web-based...

Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerability

A vulnerability in the Cisco FireSIGHT Management Center could allow an authenticated, remote attacker to perform cross-site scripting XSS attacks. The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker could exploit this...

"JIRA Project Releases" event should respect Project's permissions

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48963. panel Adding "JIRA Project Releases" event type to the Team calendar seems to NOT respect permissions from the project. I...

"JIRA Project Releases" event should respect Project's permissions

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-48963. panel Adding "JIRA Project Releases" event type to the Team calendar seems to NOT respect permissions from the project. ...

"JIRA Project Releases" event should respect Project's permissions

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48963. panel Adding "JIRA Project Releases" event type to the Team calendar seems to NOT respect permissions from the project. I...

"JIRA Project Releases" event should respect Project's permissions

Adding "JIRA Project Releases" event type to the Team calendar seems to NOT respect permissions from the project. It means even people that have no access to some project will see the release dates from the forbidden project. Expected behavior: Users should see only "JIRA Project Releases" from...

CA20150604-01: Security Notice for CA Common Services

-----BEGIN PGP SIGNED MESSAGE----- CA20150604-01: Security Notice for CA Common Services Issued: June 4, 2015 CA Technologies Support is alerting customers to multiple potential risks with products that bundle CA Common Services on Unix/Linux platforms. A local attacker may exploit these...

Xxe

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager RQM 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert RTC 2.0 through...

CVE-2015-0112

CVE-2015-0112 maps to an XML External Entity (XXE) issue in IBM Jazz Foundation/CLM stack (Jazz Team Server and multiple CLM-based products). Affected: CLM 3.0.1–5.0.2, RRC 2.0–4.0.7, RDNG 4.x–5.0.2, RELM 1.0/4.0.3–5.0.2, Rhapsody DM 3.0–5.0, RSA DM 3.0–5.0, RTC 2.0–5.0.2, RQM 2.0–5.0.2. Impact: ...

DSA-3281-1 Debian Security Team PGP/GPG key change notice

This is a notice that the Debian Security Team has changed its PGP/GPG contact key because of a periodic regular key rollover. The new key's fingerprint is: 0D59 D2B1 5144 766A 14D2 41C6 6BAF 400B 05C3 E651 The creation date is 2015-01-18 and it has been signed by the previous Security Team conta...

pipe inatomic

The 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local users to cause a denial of service system crash or possibly gain privileges via a...

Syria2u Arbahtube 1.0 Cross Site Request Forgery / Cross Site Scripting

| Title : Syria2u Arbahtube v1.0 Mullti Vulnerability | Author : indoushka | email : [email protected] | Dork : Copyright ©2014 script syria2u version1. All Rights Reserved. | Tested on: win8.1 Fr V.Pro 15:39 22/05/2015 | Bug : Mullti | Download : http://www.syria2u.com/...

Syria2u You Shop 1.0 Cross Site Request Forgery / Cross Site Scripting

| Title : Syria2u You Shop v1.0 Mullti Vulnerability | Author : indoushka | email : [email protected] | Dork : سكربت يوشــوب للتسوق عبر الانترنت , قم باختيار المدينة ثم تمتع بالتسوق في مدينتك من أي مكان | Tested on: win8.1 Fr V.Pro 15:39 23/05/2015 | Bug : Mullti | Download :...

Microsoft to Support SSH in Windows

After several false starts, Microsoft finally is planning to support SSH in Windows and the company’s engineers also will contribute to the OpenSSH project. While SSH has been a popular tool for remote login and command execution on many Unix and linux systems for years, Windows has not supported...

QuickTalk 1.5 Password Hash Disclosure

| Title : QuickTalk 1.5 Reinstall Script Vulnerability | Author : indoushka | email : [email protected] | Dork : powered by QT-cute | Tested on: windows 8.1 Français V.Pro | Bug : Reinstall Script | Download : http://www.scriptmafia.org ======================================= 1 -...