Jdstrand

The issue allows remote attackers to overwrite arbitrary files via a `..` (dot dot) in a file name, due to a directory traversal vulnerability in the ` do attachment move` function in the AttachFile action (`action/AttachFile.py`).

The issue allows remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. This has been exploited in the wild in July 2012. The vulnerabilities are found in the twikidraw (`action/twikidraw.py`) and anywikidraw (`action/anywikidraw.py`) actions.

The issue allows remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. This can potentially be leveraged to execute arbitrary code.

The issue allows remote attackers to install altered packages via a man-in-the-middle (MITM) attack, because it relies on GnuPG argument order and does not check GPG subkeys when using the `apt-key net-update` to import keyrings.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the `username` or `password` fields to the power system method in the xmlrpc API.

The issue allows physically proximate attackers to access an unattended workstation where screen locking was intended, due to gnome-screensaver not resuming its activation settings after an inhibiting application becomes unavailable on the session bus.