openSUSE Security Update : udisks2 (openSUSE-2019-834)

This update for udisks2 fixes the following issues : Following security issues was fixed : - CVE-2018-17336: A format string vulnerability in udiskslog bsc1109406 Following non-security issues were fixed : - strip trailing newline from sysfs raid level information bsc1091274 - Fix watcher error f...

Any user able to manage space watcher using REST API

h3. Summary Any Confluence user is able to manage Space Watcher by using REST API h3. Steps to Reproduce Create a user that belongs to the "confluence-users" group example: user1 Using an Adminstrator user, create a new space and restrict the space to the administrator user As the normal user...

X-Pack Alerting and Kibana 5.6.1 security update

X-Pack alerting privileged user multiple issues An error was found in the permission model used by X-Pack alerting whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges. Affected Versions: 5.0.0 to 5.6.0 Solutions and Mitigations...

Monitor AWS & GCP Configurations: Security Monkey

Monitor AWS & GCP Configurations Security Monkey is an OpenSource application from Netflix NetflixOSS which monitors/alerts/reports one or multiple AWS/GCP accounts for anomalies. Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure configurations. It...

CVE-2015-7437

Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors...

Information disclosure

Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors...

CVE-2015-7437

Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors...

PT-2016-3774

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator version 5.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This affects the Queue Watcher component. Recommendations For IBM...

CVE-2015-7431: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Queue Watcher in IBM Sterling B2B Integrator 5.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-7437: Exposure of Sensitive Information to an Unauthorized Actor

Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors...

WordPress SEO Watcher Plugin - Arbitrary File Creation

This plugin is prone to an open flash chart arbitrary file creation. Solution Update the plugin...

CVE-2015-3351

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

CVE-2015-3351

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

CVE-2015-3351

CVE-2015-3351 affects the Drupal Log Watcher module (6.x-1.x) before 6.x-1.2. The issue is a CSRF vulnerability in the report administration links that can allow an attacker to trigger actions (enable, disable, or delete a report) on behalf of an authenticated administrator, effectively hijacking...

PT-2015-6172

Name of the Vulnerable Software and Affected Versions Drupal Log Watcher module versions prior to 6.x-1.2 Description The issue allows remote attackers to hijack the authentication of administrators for requests, including enabling, disabling, or deleting a report. Recommendations For versions...

CVE-2015-3351: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Log Watcher Module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in the Drupal Log Watcher module, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

SA-CONTRIB-2015-010 - Log Watcher - Cross Site Request Forgery (CSRF)

Log Watcher allows you to monitor your site logs in a systematic way by setting up scheduled aggregations for specific log types. The report administration links are not properly protected from CSRF. A malicious user could cause a log administrator to enable, disable, or delete a Log Watcher repo...

user receives email notification even though restriction have been applied to the page

Steps to reproduce : Login to Confluence Create a page Insert a team calendar into the page Ask a user A to watch the page Make changes to team calendar User A is receiving email notification for the calendar as expected Creator of the page restrict the page with the calendar from being viewed by...