Re: ownCloud Unencrypted Private Key Exposure

2014-08-06 Thread Anthony Dubuissez
Hello, If by acces to the file system you mean with all administrative privileges, yes but only if there are users sessions in php session storage to decrypt the files for that user. You can have multiple websites on the FS if they do not share the tmp session storage for php there are no

RE: ownCloud Unencrypted Private Key Exposure - version (6.0.4) reported not vulnerable

2014-08-06 Thread Choulat, Trace
This came into our security group when we inquired with ownCloud: It has been officially confirmed by ownCloud security team that the version (6.0.4) running on our servers is not vulnerable to this issue. Hi --: I heard back from the Security team within ownCloud and this is not an issue in

CVE-2014-5075 MitM Vulnerability in the Smack XMPP Library for Java

2014-08-06 Thread Georg Lukas
CVE-2014-5075 MitM Vulnerability in the Smack XMPP Library for Java === Smack http://www.igniterealtime.org/projects/smack/ is an Open Source XMPP (Jabber) client library for instant messaging and presence written in Java. Smack

[SECURITY] [DSA 2997-1] reportbug security update

2014-08-06 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-2997-1 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso August 05, 2014

Re: ownCloud Unencrypted Private Key Exposure

2014-08-06 Thread Jack Brennan
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, A valid concern. HTTPS should be used to secure traffic from a client to the server, solving any problems related to eavesdropping. Encrypting the content of the account data should solve two problems. 1. Secure data from curious system

[security bulletin] HPSBMU03085 rev.1 - HP Application Lifecycle Management / Quality Center, Elevation of Privilege

2014-08-06 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04394553 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04394553 Version: 1 HPSBMU03085

PhotoSync Wifi Bluetooth v1.0 - File Include Vulnerability

2014-08-06 Thread Vulnerability Lab
Document Title: === PhotoSync Wifi Bluetooth v1.0 - File Include Vulnerability References (Source): http://www.vulnerability-lab.com/get_content.php?id=1289 Release Date: = 2014-08-04 Vulnerability Laboratory ID (VL-ID):

[ MDVSA-2014:149 ] php

2014-08-06 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2014:149 http://www.mandriva.com/en/support/security/

PhotoSync v2.2 iOS - Command Inject Web Vulnerability

2014-08-06 Thread Vulnerability Lab
Document Title: === PhotoSync v2.2 iOS - Command Inject Web Vulnerability References (Source): http://www.vulnerability-lab.com/get_content.php?id=1290 Release Date: = 2014-08-05 Vulnerability Laboratory ID (VL-ID):