За лето в офисе Mail.Ru Group прошли пять митапов, выступлениями с которых мы с вами сегодня поделимся. Каждое видео — доклад, рассказывающий о последних новостях и технологиях в различных областях. Просмотр позволит вам идти в ногу с профессиональными сообществами. Ниже мы публикуем подборку видео с митапов лета 2017-го: Moscow Data Science Junior, 10.06 QA Meetup в Нижнем Новгороде, 06.07 MySQL Meetup, 11.07 IT-HR Meetup, 19.07 Moscow Python Meetup 47, 27.07 Читать дальше →
The inode_init_owner function in fs/inode.c in the Linux kernel through 4.17.4 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group.
Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a group's visibility and the group's members visibility can be configured such that it is restricted to logged on users, members of the group or staff users. A vulnerability has been discovered in versions prior to…
Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user…