bugtraq mailing list - 2010/11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2010/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 31	² 10	³ 5	⁴ 22	⁵ 6	⁶	⁷
⁸ 12	⁹ 10	¹⁰ 13	¹¹	¹² 17	¹³	¹⁴
¹⁵ 6	¹⁶ 12	¹⁷ 13	¹⁸ 6	¹⁹ 13	²⁰	²¹
²² 9	²³ 6	²⁴ 5	²⁵ 17	²⁶ 6	²⁷	²⁸
²⁹ 9	³⁰ 11

Messages by day:

November 1 (31 messages)

[USN-1011-3] Xulrunner vulnerability (Jamie Strandboge <jamie@...onical.com>)
Secunia Research: Adobe Shockwave Player "pamm" Chunk Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Adobe Shockwave Player "DEMX" Chunk Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: SonicWALL SSL-VPN End-Point ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2010:218 ] php (security@...driva.com)
Audacity <= 1.3 Beta Multiple Local Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[security bulletin] HPSBMA02602 SSRT100317 rev.1 - HP Insight Control Performance Management for Windows, Remote Cross Site Scripting (XSS… (security-alert@...com)
[security bulletin] HPSBMA02605 SSRT100238 rev.1 - HP Insight Managed System Setup Wizard for Windows, Remote Arbitrary File Download (security-alert@...com)
[security bulletin] HPSBMA02604 SSRT100320 rev.1 - HP Insight Recovery for Windows, Remote Cross Site Scripting (XSS), Arbitrary File Down… (security-alert@...com)
[security bulletin] HPSBMA02600 SSRT100239 rev.1 - HP Insight Control Performance Management for Windows, Remote Arbitrary File Download (security-alert@...com)
[security bulletin] HPSBMA02606 SSRT100321 rev.1 - HP Insight Orchestration Software for Windows, Remote Arbitrary File Download, Unauthor… (security-alert@...com)
[ MDVSA-2010:219 ] mozilla-thunderbird (security@...driva.com)
[security bulletin] HPSBMA02607 SSRT100214 rev.1 - HP Insight Control for Linux, Remote Cross Site Request Forgery (CSRF) (security-alert@...com)
[security bulletin] HPSBMA02598 SSRT100314 rev.2 - HP Insight Control Virtual Machine Management for Windows, Remote Cross Site Scripting … (security-alert@...com)
H2HC 2010 - Final Speakers List Available ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[DEMO] Sample videos about IDS/IPS evasions... ("Nelson Brito" <nbrito@...ure.org>)
Revision: Audacity <= 1.3 Beta Multiple Local Vulnerabilities ===> Audacity <= 1.3 Beta DLL Hijacking Vulnerability (Salvatore Fresta aka Drosophila <drosophil…)
[ MDVSA-2010:214 ] kernel (security@...driva.com)
[ MDVSA-2010:215 ] python (security@...driva.com)
[ MDVSA-2010:216 ] python (security@...driva.com)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4086 (Rodrigo Branco <rbranco@...ckpoint.com>)
cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4088 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4087 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4089 (Rodrigo Branco <rbranco@...ckpoint.com>)
[ MDVSA-2010:217 ] dovecot (security@...driva.com)
XSS and SQL Injection vulnerabilities in CMS WebManager-Pro ("MustLive" <mustlive@...security.com.ua>)
'WSN Links' SQL Injection Vulnerability (CVE-2010-4006) (Mark Stanislav <mark.stanislav@...il.com>)
Joomla 1.5.21 | Potential SQL Injection Flaws (YGN Ethical Hacker Group <lists@...g.net>)
Call for Papers -YSTS V - Security Conference, Brazil (Luiz Eduardo <le@...s.org>)
Call for Papers: The International Conference on Cyber Conflict, Estonia (k g <kgconference@...il.com>)

November 2 (10 messages)

[SECURITY] [DSA 2123-1] New NSS packages fix cryptographic weaknesses (Florian Weimer <fw@...eb.enyo.de>)
XSS vulnerability in Kandidat CMS (advisory@...ridge.ch)
[SECURITY] [DSA 2124-1] New Xulrunner packages fix several vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)
Security-Assessment.com Advisory: BroadWorks Call Detail Record Disclosure Vulnerability (Nick Freeman <nick.freeman@...urity-assessment.com>)
Stored XSS (Cross Site Scripting) vulnerability in MemHT Portal (advisory@...ridge.ch)
Stored XSS vulnerability in Webmedia Explorer (advisory@...ridge.ch)
XSS vulnerability in Kandidat CMS (advisory@...ridge.ch)
XSS vulnerability in MemHT Portal (advisory@...ridge.ch)
XSS vulnerability in MemHT Portal (advisory@...ridge.ch)
XSS vulnerability in Kandidat CMS (advisory@...ridge.ch)

November 3 (5 messages)

[ MDVSA-2010:202-1 ] krb5 (security@...driva.com)
[Onapsis Security Advisory 2010-008] Oracle Virtual Server Agent Arbitrary File Access (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2010-010] Oracle Virtual Server Agent Local Privilege Escalation (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2010-009] Oracle Virtual Server Agent Remote Command Execution (Onapsis Research Labs <research@...psis.com>)
CVE-2010-3863: Apache Shiro information disclosure vulnerability (Les Hazlewood <lhazlewood@...che.org>)

November 4 (22 messages)

Re: [WEB SECURITY] [TOOL] DotDotPwn v2.1 - The Directory Traversal Fuzzer (neza0x@...il.com)
Zen Cart 1.3.9h Local File Inclusion Vulnerability (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Security Advisory for Bugzilla 3.2.8, 3.4.8, 3.6.2, and 3.7.3 (Max Kanat-Alexander <mkanat@...zilla.org>)
Adsoft Remote Sql Injection Vulnerability (md.r00t.defacer@...il.com)
BBcode XSS in MiniBB (advisory@...ridge.ch)
SQL injection in SweetRice CMS (advisory@...ridge.ch)
RFI in JAF CMS (advisory@...ridge.ch)
Shell create & command execution in JAF CMS (advisory@...ridge.ch)
XSS in SweetRice CMS (advisory@...ridge.ch)
Reset admin password in SweetRice CMS (advisory@...ridge.ch)
SQL injection in MiniBB (advisory@...ridge.ch)
XSS in Textpattern CMS (advisory@...ridge.ch)
LFI in eoCMS (advisory@...ridge.ch)
Path disclosure in eoCMS (advisory@...ridge.ch)
SQL injection in eoCMS (advisory@...ridge.ch)
LFI in eoCMS (advisory@...ridge.ch)
BBcode XSS in eoCMS (advisory@...ridge.ch)
[ MDVSA-2010:220 ] pam (security@...driva.com)
Re: [WEB SECURITY] [TOOL] DotDotPwn v2.1 - The Directory Traversal Fuzzer ("Arturo 'Buanzo' Busleiman" <buanzo@...nzo.com.ar>)
[USN-1012-1] CUPS vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1013-1] FreeType vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1014-1] Pidgin vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)

November 5 (6 messages)

[FG-VD-10-020]Adobe Flash Player Remote Memory corruption Vulnerability ("xpzhang" <xpzhang@...tinet.com>)
ASPR #2010-11-05-01: Remote Binary Planting in Adobe Flash Player ("ACROS Security Lists" <lists@...os.si>)
Common consumer routers password disclosure (danieljcrteixeira@...il.com)
Re: [Full-disclosure] Joomla 1.5.21 | Potential SQL Injection Flaws (YGN Ethical Hacker Group <lists@...g.net>)
Angel LMS Exploit (Wesley Kerfoot <wjak56@...il.com>)
Wargame Qualifications - Win a car !!! ("Ivan Buetler" <ivan.buetler@...c.ch>)

November 8 (12 messages)

nSense-2010-003: Cisco Unified Communications Manager (Henri Lindberg <henri+lists@...nse.fi>)
[ MDVSA-2010:221 ] openoffice.org (security@...driva.com)
CFP: DIMVA 2011 - Detection of Intrusions and Malware & Vulnerability Assessment (Konrad Rieck <konrad.rieck@...berlin.de>)
Vulnerabilities in PHPShop ("MustLive" <mustlive@...security.com.ua>)
some ooold Juniper bugs (was: [Full-disclosure] ZDI-10-231: Juniper Secure Access Series meeting_testjava.cgi XSS Vulnera… (Michal Zalewski <lcamtuf@...edump.cx>)
Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978 (Rodrigo Branco <rbranco@...ckpoint.com>)
Seo Panel 2.1.0 - Critical File Disclosure (advisories@...ern0t.net)
Malware Collections and Feed Exchange ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[ MDVSA-2010:155-1 ] mysql (security@...driva.com)
Hackito Ergo Sum 2011 - Call For Paper - HES2011 CFP (Philippe Langlois <philippe.langlois@...il.com>)
Re: Seo Panel 2.1.0 - Critical File Disclosure (Zach C <fxchip@...il.com>)
DIMVA 2011 Call for Workshops Proposals (Lorenzo Cavallaro <lorenzo.cavallaro@...il.com>)

November 9 (10 messages)

JQuarks4s Joomla Component 1.0.0 Blind SQL Injection Vulnerability (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[CORE-2010-0825] Apple OS X ATSServer CFF CharStrings INDEX Sign Mismatch (CORE Security Technologies Advisories <advisories@...esecurity.com>)
D-Link DIR-300 authentication bypass (Karol Celiński <karol@...in.pl>)
IBM OmniFind - several vulnerabilities (Fatih Kilic <Fatih.Kilic@....fraunhofer.de>)
[USN-1008-4] libvirt regression (Jamie Strandboge <jamie@...onical.com>)
[ MDVSA-2010:222 ] mysql (security@...driva.com)
Secunia Research: Microsoft PowerPoint PP7X32.DLL Record Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2010:223 ] mysql (security@...driva.com)
Re: D-Link DIR-300 authentication bypass (Karol Celiński <karol@...in.pl>)
Secunia Research: Microsoft Office Drawing Shape Container Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)

November 10 (13 messages)

[ MDVSA-2010:224 ] php (security@...driva.com)
[ MDVSA-2010:225 ] libmbfl (security@...driva.com)
iDefense Security Advisory 11.09.10: Microsoft Word RTF File Parsing Stack Buffer Overflow Vulnerability (labs-no-reply <labs-no-reply@...fense.com>)
ASPR #2010-11-10-1: Remote Binary Planting in Microsoft PowerPoint 2010 ("ACROS Security Lists" <lists@...os.si>)
[ MDVSA-2010:225-1 ] libmbfl (security@...driva.com)
ASPR #2010-11-10-3: Remote Binary Planting in Microsoft Excel 2010 ("ACROS Security Lists" <lists@...os.si>)
Kernel 0-day (Dan Rosenberg <dan.j.rosenberg@...il.com>)
ASPR #2010-11-10-2: Remote Binary Planting in Microsoft Word 2010 ("ACROS Security Lists" <lists@...os.si>)
[USN-1015-1] libvpx vulnerability (Jamie Strandboge <jamie@...onical.com>)
Babylon Cross-Application Scripting Code Execution (Roee Hay <ROEEH@...ibm.com>)
[ MDVSA-2010:226 ] dhcp (security@...driva.com)
eBlog 1.7 Multiple SQL Injection Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Re: Kernel 0-day (James Lay <jlay@...ve-tothe-box.net>)

November 12 (17 messages)

[ MDVSA-2010:228 ] xpdf (security@...driva.com)
Vulnerability in Google AJAX Search ("MustLive" <mustlive@...security.com.ua>)
Apple Directory Services Memory Corruption - CVE-2010-1840 (Rodrigo Branco <rbranco@...ckpoint.com>)
[USN-1016-1] libxml2 vulnerability (Jamie Strandboge <jamie@...onical.com>)
Secunia Research: QuickTime Sorenson Video 3 Array-Indexing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
CORE-2010-1018 - Landesk OS command injection (CORE Security Technologies Advisories <advisories@...esecurity.com>)
FreeBSD Security Advisory FreeBSD-SA-10:09.pseudofs (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Additional information on the Microsoft Office 2010 binary planting bugs ("ACROS Security Lists" <lists@...os.si>)
[USN-1017-1] MySQL vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[TEHTRI-Security] CVE-2010-1752: Update your MacOSX (Laurent OUDOT at TEHTRI-Security <laurent.oudot@...tri-security.com>)
iDefense Security Advisory 11.11.10: Apple Mobile OfficeImport Framework Excel Parsing Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...fense.c…)
[HITB-Announce] HITB Magazine #5 Call for Articles (Hafez Kamal <aphesz@...kinthebox.org>)
[ MDVSA-2010:227 ] proftpd (security@...driva.com)
Re: D-Link DIR-300 authentication bypass (mfardiles@...oo.com.ar)
[ MDVSA-2010:229 ] kdegraphics (security@...driva.com)
[ MDVSA-2010:230 ] poppler (security@...driva.com)
[ MDVSA-2010:231 ] poppler (security@...driva.com)

November 15 (6 messages)

TWSL2010-006: Multiple Vulnerabilities in Camtron CMNC-200 IP Camera (Trustwave Advisories <trustwaveadvisories@...stwave.com>)
[SECURITY] [DSA 2038-3] New pidgin packages fix regression (Thijs Kinkhorst <thijs@...ian.org>)
Re: D-Link DIR-300 authentication bypass (asmo <asmo@...n-station.us>)
vBulletin 4.0.8 - Persistent XSS via Profile Customization (advisories@...ern0t.net)
Saved XSS vulnerability in Internet Explorer ("MustLive" <mustlive@...security.com.ua>)
Packet Storm - New Site (bugtraq@...ketstormsecurity.org)

November 16 (12 messages)

VMSA-2010-0016 VMware ESXi and ESX third party updates for Service Console and Likewise components (VMware Security team <security@...are.com>)
Eclipse IDE | Help Server Local Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
[ MDVSA-2010:235 ] freetype2 (security@...driva.com)
[ MDVSA-2010:237 ] perl-CGI (security@...driva.com)
Quick update on Google Chrome's Math.random() predictability by Amit Klein, Trusteer (Amit Klein <amit.klein@...steer.com>)
[security bulletin] HPSBPI02575 SSRT090255 rev.1 - HP LaserJet MFP Printers, HP Color LaserJet MFP Printers, Certain HP LaserJet Printers,… (security-alert@...com)
[ MDVSA-2010:234 ] cups (security@...driva.com)
LFI and XSS vulnerability in openEngine (SecPod Research <research@...pod.com>)
[ GLSA 201011-01 ] GNU C library: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[ MDVSA-2010:236 ] freetype2 (security@...driva.com)
[ MDVSA-2010:233 ] cups (security@...driva.com)
[ MDVSA-2010:232 ] cups (security@...driva.com)

November 17 (13 messages)

Information disclosure in IceBB (advisory@...ridge.ch)
Path disclosure in IceBB (advisory@...ridge.ch)
Cisco Security Response: Multiple Vulnerabilities in Cisco Unified Videoconferencing Products (Cisco Systems Product Security Incident Response Team <psirt@...c…)
Cisco Unified Videoconferencing multiple vulnerabilities - CVE-2010-3037 CVE-2010-3038 (Florent Daigniere <florent.daigniere@...stmatta.com>)
BBcode XSS in CLANSPHERE (advisory@...ridge.ch)
Path disclosure in CLANSPHERE (advisory@...ridge.ch)
XSS in CLANSPHERE (advisory@...ridge.ch)
SQL Injection in CLANSPHERE (advisory@...ridge.ch)
SQL injection in CompactCMS (advisory@...ridge.ch)
Information disclosure in IceBB (advisory@...ridge.ch)
nullcon Goa dwitiya (2.0) Call For Papers Closing on 30th November (nullcon <nullcon@...lcon.net>)
AWCM v2.2 Auth Bypass Vulnerabilities (eidelweiss@...dowslive.com)
SQL injection in IceBB (advisory@...ridge.ch)

November 18 (6 messages)

XSS in CompactCMS (advisory@...ridge.ch)
[ MDVSA-2010:238 ] openssl (security@...driva.com)
XSS in CompactCMS (advisory@...ridge.ch)
Re: Kernel 0-day (Felipe Martins <martins.felipe.security@...il.com>)
Multiple vulnerabilities in chCounter <= 3.1.3 (Soporte CERT <soporte@...t.unlp.edu.ar>)
[HITB-Announce] HITB2011AMS -- Call For Papers now Open (Hafez Kamal <aphesz@...kinthebox.org>)

November 19 (13 messages)

[eVuln.com] Cookie Auth Bypass in Hot Links SQL (bt@...ln.com)
[ MDVSA-2010:239 ] php (security@...driva.com)
VUPEN Security Research - Apple Safari Selections Handling Use-after-free Vulnerability (VUPEN-SR-2010-246) ("VUPEN Security Research" <advisories@...en.com>)
H2CSO (Hackers to CSO) debate second edition - Free Live Streaming ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[eVuln.com] URL and Title XSS in AxsLinks (bt@...ln.com)
Re: Kernel 0-day (Dan Rosenberg <dan.j.rosenberg@...il.com>)
VUPEN Security Research - Apple Safari Scrollbar Handling Use-after-free Vulnerability (VUPEN-SR-2010-245) ("VUPEN Security Research" <advisories@...en.com>)
Re: Saved XSS vulnerability in Internet Explorer (ecco <eccocce@...il.com>)
Vtiger CRM 5.2.0 Multiple Vulnerabilities (ascii <ascii@...amail.com>)
RE: Saved XSS vulnerability in Internet Explorer ("Hans Wolters" <j.wolters@...amide.nl>)
Re: D-Link DIR-300 authentication bypass (Karol Celiński <karol@...in.pl>)
Re: Saved XSS vulnerability in Internet Explorer ("MustLive" <mustlive@...security.com.ua>)
[USN-1018-1] OpenSSL vulnerability (Steve Beattie <sbeattie@...ntu.com>)

November 22 (9 messages)

New vulnerabilities in CMS SiteLogic ("MustLive" <mustlive@...security.com.ua>)
vBulletin 4.0.8 PL1 - XSS Filter Bypass within Profile Customization (advisories@...ern0t.net)
Apple Safari for Windows (4.0.2-4.0.5, 5.0-5.0.2) Math.random() predictability (Amit Klein <amit.klein@...steer.com>)
'Free Simple Software' SQL Injection Vulnerability (CVE-2010-4298) (Mark Stanislav <mark.stanislav@...il.com>)
H2HC Cancun - Free Entrance! ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[eVuln.com] report.cgi SQL inj in Hot Links SQL (CGI version) (bt@...ln.com)
[eVuln.com] url XSS in Hot Links Lite (bt@...ln.com)
[SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability (Mark Thomas <markt@...che.org>)
NGS00015 Patch Notification: ImageIO Memory Corruption ("Research@...Secure" <research@...secure.com>)

November 23 (6 messages)

ESA-2010-019: RSA, The Security Division of EMC, is reissuing this advisory regarding a potential cross-site scripting vulnerability th… (<Security_Alert@....com>)
[SECURITY] [DSA-2125-1] New openssl packages fix buffer overflow (Stefan Fritsch <sf@...ian.org>)
Juniper VPN client rdesktop clickhack (niekt0 <niekt0@...teria.sk>)
Microsoft Visual Studio vulnerability (<jabea@...ea.net>)
[eVuln.com] sitename XSS in Hot Links Lite (bt@...ln.com)
ZyXEL P-660R-T1 V2 XSS (Usman Saeed <usman@...re.net>)

November 24 (5 messages)

The Unbearable Lightness Of Non-Fixing: A Short Study in Security Reactiveness And Proactiveness ("ACROS Security Lists" <lists@...os.si>)
Mozilla Firefox 3.6.12 Denial of Service Vulnerability (info@...ya.info)
[eVuln.com] Multiple XSS in MCG GuestBook (bt@...ln.com)
[eVuln.com] email XSS in SimpLISTic (bt@...ln.com)
Re: Mozilla Firefox 3.6.12 Denial of Service Vulnerability (Michal Zalewski <lcamtuf@...edump.cx>)

November 25 (17 messages)

[ MDVSA-2010:240 ] mono (security@...driva.com)
[eVuln.com] SQL injections in FreeTicket (bt@...ln.com)
[USN-1022-1] APR-util vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2010:241 ] gnucash (security@...driva.com)
TSSA-2010-01 Ghostscript library Ins_MINDEX() integer overflow and heap corruption (Advisories Toucan-System <advisories@...can-system.com>)
[USN-1021-1] Apache vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[security bulletin] HPSBUX02579 SSRT100203 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remote Information Disclosure, Unauthorized (security-alert@...com)
XSS vulnerability in Wolf CMS (advisory@...ridge.ch)
XSS vulnerability in Wolf CMS (advisory@...ridge.ch)
XSRF (CSRF) in Frog CMS (advisory@...ridge.ch)
XSS vulnerability in Frog CMS (advisory@...ridge.ch)
XSS vulnerability in Frog CMS (advisory@...ridge.ch)
XSS vulnerability in Wolf CMS (advisory@...ridge.ch)
CVE-2010-2408 | Persistent Log Out Redirection Vulnerability in Oracle I-Recruitment OA.jsp (0kn0ck@...niche.org)
Re: [DCA-00015] YOPS Web Server Remote Command Execution (zed@...127.karelia.ru)
NoScript (2.0.5.1 < less ) - Bypass "Reflective XSS" through Union SQL Poisoning Trick (SQLXSSI) (0kn0ck@...niche.org)
[Suspected Spam]Vulnerabilities in Register Plus for WordPress ("MustLive" <mustlive@...security.com.ua>)

November 26 (6 messages)

Re: NoScript (2.0.5.1 < less ) - Bypass "Reflective XSS" through Union SQL Poisoning Trick (SQLXSSI) (g.maone@...ormaction.com)
XSRF (CSRF) in Wolf CMS (advisory@...ridge.ch)
XSS vulnerability in Frog CMS (advisory@...ridge.ch)
[eVuln.com] SQL injection Auth Bypass in Easy Banner Free (bt@...ln.com)
[eVuln.com] URL XSS in Easy Banner Free (bt@...ln.com)
Re: [Full-disclosure] Simple kernel attack using socketpair. easy, 100% reproductiblle, works under guest. no way to pr… (Dan Rosenberg <dan.j.rosenberg@...il.co…)

November 29 (9 messages)

jQuery Lightweight Rich Text Editor (lwrte) Plugin uploader.php Arbitrary File Upload ("underground stockholm" <underground-stockholm@...ramail.com>)
AOL Instant Messenger Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Google Desktop Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
SQL injection and Path Disclosure Auth Bypass in 4images 1.7.X (u6q@...mail.com)
[SECURITY] [DSA-2127-1] New wireshark packages fix denial of service (Stefan Fritsch <sf@...ian.org>)
[ MDVSA-2010:242 ] wireshark (security@...driva.com)
Vulnerabilities in Joomla ("MustLive" <mustlive@...security.com.ua>)
n.runs-SA-2010.003 - Hewlett Packard LaserJet MFP devices - Directory Traversal in PJL interface (<security@...ns.com>)
[ MDVSA-2010:243 ] libxml2 (security@...driva.com)

November 30 (11 messages)

FreeBSD Security Advisory FreeBSD-SA-10:10.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
VMSA-2010-0017 VMware ESX third party update for Service Console kernel (VMware Security Team <security@...are.com>)
[CVE-2010-3449] Apache Archiva CSRF Vulnerability (Deng Ching <oching@...che.org>)
Pandora FMS Authentication Bypass and Multiple Input Validation Vulnerabilities (Juan Galiana Lara <jgaliana@...its.com>)
[eVuln.com] Multiple XSS inj in Wernhart Guestbook (bt@...ln.com)
[eVuln.com] Multiple SQL injections in Wernhart Guestbook (bt@...ln.com)
[SECURITY] [DSA 2126-1] New Linux 2.6.26 packages fix several issues (dann frazier <dannf@...ian.org>)
[ MDVSA-2010:244 ] phpmyadmin (security@...driva.com)
'Orbis CMS' Arbitrary Script Execution Vulnerability (CVE-2010-4313) (Mark Stanislav <mark.stanislav@...il.com>)
[USN-1024-1] OpenJDK vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021] (Tom Yu <tlyu@....edu>)

239 messages

Powered by blists - more mailing lists