bugtraq mailing list - 2010/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2010/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 11	² 3	³ 8	⁴	⁵
⁶ 6	⁷ 2	⁸ 22	⁹ 14	¹⁰ 14	¹¹	¹²
¹³ 29	¹⁴ 12	¹⁵ 31	¹⁶ 27	¹⁷ 12	¹⁸	¹⁹
²⁰ 10	²¹ 31	²² 6	²³	²⁴	²⁵	²⁶
²⁷ 19	²⁸	²⁹ 12	³⁰ 12	³¹ 3

Messages by day:

December 1 (11 messages)

CORE-2010-1109 - Multiple vulnerabilities in BugTracker.Net (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[ MDVSA-2010:245 ] krb5 (security@...driva.com)
[ MDVSA-2010:246 ] krb5 (security@...driva.com)
[eVuln.com] Multiple XSS in Alguest (bt@...ln.com)
Digitalus 1.10.0 Alpha2 Arbitrary File Upload vulnerability.txt (eidelweiss@...dowslive.com)
Secunia Research: Winamp NSV Table of Contents Parsing Integer Overflow (Secunia Research <remove-vuln@...unia.com>)
Re: D-Link DIR-300 authentication bypass (Karol Celiński <karol@...in.pl>)
Vulnerabilities in Fabrica Engine ("MustLive" <mustlive@...security.com.ua>)
[USN-1025-1] Bind vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA-2128-1] New libxml2 packages fix potential code execution (Giuseppe Iuculano <iuculano@...ian.org>)
[SECURITY] [DSA-2129-1] New krb5 packages fix checksum verification weakness (Stefan Fritsch <sf@...ian.org>)

December 2 (3 messages)

NGS00014 Patch Notification: Cisco IPSec VPN Implementation Group Name Enumeration ("Research@...Secure" <research1@...group.local>)
Flaw in Microsoft Windows SAM Processing Allows Continued Administrative Access Using Hidden Regular User Masquerading … (Steno Plasma <exploitdevelopmentdotcom@…)
New paper by Amit Klein (Trusteer): "Detecting virtualization over the web with IE9 (platform preview) and Semi-permanent … (Amit Klein <amit.klein@...steer.com>)

December 3 (8 messages)

[security bulletin] HPSBUX02609 SSRT100147 rev.1 - CIFS Server (Samba), Remote Execution of Arbitrary Code, Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBUX02610 SSRT100341 rev.1 - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code, Denial of Service (DoS) (security-alert@...com)
[eVuln.com] Cookie authentication bypass in Alguest (bt@...ln.com)
VMSA-2010-0018 VMware hosted products and ESX patches resolve multiple security issues (VMware Security team <security@...are.com>)
[eVuln.com] PHP Code Execution in Alguest (bt@...ln.com)
Re: Flaw in Microsoft Windows SAM Processing Allows Continued Administrative Access Using Hidden Regular User Masqueradi… ("StenoPlasma @ ExploitDevelopment" <Ste…)
Vulnerabilities in Register Plus Redux for WordPress ("MustLive" <mustlive@...security.com.ua>)
[ MDVSA-2010:247 ] kernel (security@...driva.com)

December 6 (6 messages)

'Pulse CMS Basic' Local File Inclusion Vulnerability (CVE-2010-4330) (Mark Stanislav <mark.stanislav@...il.com>)
rPSA-2010-0076-1 gnupg (rPath Update Announcements <announce-noreply@...th.com>)
OWASP Zed Attack Proxy version 1.1.0 (psiinon <psiinon@...il.com>)
DIMVA 2011 Call for Workshops Proposals (Lorenzo Cavallaro <lorenzo.cavallaro@...il.com>)
[www.eVuln.com] SQL Injection vulnerability in Alguest (bt@...ln.com)
Call for papers: 4th USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET) (Christopher Kruegel <chris@...ucsb.edu>)

December 7 (2 messages)

VMSA-2010-0019 VMware ESX third party updates for Service Console (VMware Security Team <security@...are.com>)
www.eVuln.com : XSS vulnerability in WWWThreads (php version) (bt@...ln.com)

December 8 (22 messages)

LFI in Exponent CMS (advisory@...ridge.ch)
LFI in Exponent CMS (advisory@...ridge.ch)
XSS vulnerability in Zimplit CMS (advisory@...ridge.ch)
Re: [Full-disclosure] Linux kernel exploit (Marcus Meissner <meissner@...e.de>)
XSS vulnerability in Zimplit CMS (advisory@...ridge.ch)
[ MDVSA-2010:248 ] openssl (security@...driva.com)
Kryptos Logic Advisory: Winamp 5.6 Arbitrary Code Execution in MIDI Parser (Kryptos Logic Secure <secure@...ptoslogic.com>)
Multiple XSS in Solarwinds Orion NPM 10.1 (John Blakley <john.blakley@...il.com>)
[ MDVSA-2010:249 ] clamav (security@...driva.com)
www.eVuln.com : HTTP Response Splitting in WWWThreads (php version) (bt@...ln.com)
[security bulletin] HPSBMI02614 SSRT100344 rev.1 - HP webOS Contacts Application, Remote Execution of Arbitrary Code (security-alert@...com)
Secunia Research: QuickTime Track Dimensions Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[USN-1026-1] Python Paste vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1027-1] Quagga vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1028-1] ImageMagick vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Linux kernel exploit (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: [Full-disclosure] Linux kernel exploit ("Cal Leeming [Simplicity Media Ltd]" <cal.leeming@...plicitymedialtd.co.uk>)
Re: [Full-disclosure] Linux kernel exploit (Ryan Sears <rdsears@....edu>)
Re: [Full-disclosure] Linux kernel exploit (Kai <kai@...nn.net>)
iDefense Security Advisory 12.07.10: Apple QuickTime PICT Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...fense.com>)
[security bulletin] HPSBUX02611 SSRT090201 rev.1 - HP-UX Running Threaded Processes, Remote Denial of Service (DoS) (security-alert@...com)
[USN-1029-1] OpenSSL vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)

December 9 (14 messages)

Follow-up on HTTP Parameter Pollution (embyte <embyte@...lab.it>)
Google Website Optimizer security issue reportedly fixed (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Cross Site Scripting vulnerability in Diferior (advisory@...ridge.ch)
XSRF (CSRF) in CMScout (advisory@...ridge.ch)
[USN-1030-1] Kerberos vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
RE: [Full-disclosure] Linux kernel exploit (John Jacobs <flamdugen@...mail.com>)
[security bulletin] HPSBUX02612 SSRT100345 rev.1 - HP-UX Apache-based Web Server, Local Information Disclosure, Increase of Privilege, Rem… (security-alert@...com)
Re: [Full-disclosure] Linux kernel exploit (niklas|brueckenschlaeger <niklas@...eckenschlaeger.de>)
www.eVuln.com : Non-persistent XSS in WWWThreads (perl version) (bt@...ln.com)
[ MDVSA-2010:250 ] perl-CGI-Simple (security@...driva.com)
Re: [Full-disclosure] Linux kernel exploit (Vadim Grinco <vadim@...nco.eu>)
XSS vulnerability in Diferior (advisory@...ridge.ch)
Firefox 3.6.13 pseudo-URL SOP check bug (CVE-2010-3774) (Michal Zalewski <lcamtuf@...edump.cx>)
CA20101209-01: Security Notice for CA XOsoft ("Kotas, Kevin J" <Kevin.Kotas@...com>)

December 10 (14 messages)

Re: [Full-disclosure] Linux kernel exploit (Stefan Roas <sroas@...th.org>)
www.eVuln.com : Non-persistent XSS in BizDir (bt@...ln.com)
[USN-1019-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-1020-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login a… ("StenoPlasma @ www.ExploitDevelopment.c…)
[USN-1031-1] ClamAV vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)
[ MDVSA-2010:251 ] firefox (security@...driva.com)
www.eVuln.com : Non-persistent XSS in slickMsg (bt@...ln.com)
PHP 5.3.3 NumberFormatter::getSymbol Integer Overflow (cxib@...urityreason.com)
ManageEngine EventLog Analyzer Multiple Cross-site Scripting (XSS) Vulnerabilities (robkraus@...utionary.com)
ManageEngine EventLog Analyzer Syslog Remote Denial of Service Vulnerability (robkraus@...utionary.com)
[SECURITY] [DSA-2131-1] New exim4 packages fix remote code execution (Stefan Fritsch <sf@...ian.org>)
Re: Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Logi… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Novell Vibe 3 BETA OnPrem Stored Cross-site Scripting Vulnerability (robkraus@...utionary.com)

December 13 (29 messages)

RE: Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login a… ("George Carlson" <gcarlson@...s.edu>)
LiteSpeed Web Server 4.0.17 w/ PHP Remote Exploit for FreeBSD ("HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>)
iDefense Security Advisory 12.10.10: RealNetworks RealPlayer Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login … ("Stefan Kanthak" <stefan.kanthak@...go.…)
[SECURITY] [DSA 2132-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Re: [Full-disclosure] Linux kernel exploit (firebits@...ktrack.com.br)
[USN-1032-1] Exim vulnerability (Kees Cook <kees@...ntu.com>)
TWSL-2010-008: Clear iSpot/Clearspot CSRF Vulnerabilities (Trustwave Advisories <trustwaveadvisories@...stwave.com>)
RE: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate … ("Thor (Hammer of God)" <thor@...merofgo…)
Exim security issue in historical release (nigel@...m.org)
RE: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate … ("Thor (Hammer of God)" <thor@...merofgo…)
[SECURITY] [DSA-2130-1] New BIND packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBUX02608 SSRT100333 rev.1 - HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and … (security-alert@...com)
iDefense Security Advisory 12.10.10: RealNetworks RealPlayer RealAudio Codec Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
iwconfig and recent patches? (Jeffrey Walton <noloader@...il.com>)
Re: Linux kernel exploit (Wolf <crate@...e.com>)
Call for Papers -- BADGERS 2011 (Federico Maggi <federico.maggi@...il.com>)
Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login … ("StenoPlasma @ ExploitDevelopment" <Ste…)
RE: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login … ("Michael Wojcik" <Michael.Wojcik@...rof…)
[CORE-2010-0728] Symantec Intel Handler Service Remote Denial-of-Service (Core Security Technologies Advisories <advisories@...esecurity.com>)
Re: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileg… (Andrea Lee <andrea@...trap.net>)
RE: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily Escalate P… ("David Gillett" <gillettdavid@...a.edu>)
Re: Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Dom… (jcoyle@...wholesale.com)
hidden admin user on every HP MSA2000 G3 (hpdisclosure@...nmail.de)
RE: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate … ("Thor (Hammer of God)" <thor@...merofgo…)
RE: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privil… (Kurt Dillard <kurtdillard@....com>)
Re: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate … (Ansgar Wiechers <bugtraq@...netcobalt.n…)
Re: Flaw in Microsoft Windows SAM Processing Allows Continued Administrative Access Using Hidden Regular User Masquerading After C… (Pavel Machek <pavel@....cz>)
www.eVuln.com : "url" BBCode XSS in slickMsg (bt@...ln.com)

December 14 (12 messages)

Re: [Full-disclosure] Linux kernel exploit (dan.j.rosenberg@...il.com)
Re: Linux kernel exploit (Stefan Roas <sroas@...th.org>)
[SECURITY] [DSA-2133-1] New collectd packages fix denial of service (Raphael Geissert <geissert@...ian.org>)
[ MDVSA-2010:252 ] perl-CGI-Simple (security@...driva.com)
VUPEN Security Research - RealPlayer Sound Data Handling Buffer Overflow Vulnerability (VUPEN-SR-2010-004) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - RealPlayer Audio Data Handling Buffer Overflow Vulnerability (VUPEN-SR-2010-003) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - RealPlayer AAC Data Handling Buffer Overflow Vulnerability (VUPEN-SR-2010-005) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - RealPlayer RealMedia Data Handling Heap Overflow Vulnerabilities (VUPEN-SR-2010-28, VUPEN-SR-2… ("VUPEN Security Research" <advisories@v…)
VUPEN Security Research - RealPlayer RA5 Data Handling Heap Overflow Vulnerability (VUPEN-SR-2010-31) ("VUPEN Security Research" <advisories@...en.com>)
Honggfuzz (Robert Święcki <robert@...ecki.net>)
[ MDVSA-2010:253 ] bind (security@...driva.com)
USBsploit 0.5b - added: Railgun[only] - process migration - EXE, PDF, LNK replacements - split usbsploit.rb (xpo xpo <smashxpo@...il.com>)

December 15 (31 messages)

Re: [Full-disclosure] Linux kernel exploit (Ariel Biener <ariel@...t.tau.ac.il>)
Re: Flaw in Microsoft Domain AccountCachingAllows Local Workstation Admins to TemporarilyEscalatePrivileges and Login as… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate P… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily Escalate Privile… (Michael Bauer <ravenmsb@...il.com>)
Re: hidden admin user on every HP MSA2000 G3 (nightfighter@...nmail.de)
Re: RE: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escal… ("StenoPlasma @ www.ExploitDevelopment.c…)
RE: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePr… ("Thor (Hammer of God)" <thor@...merofgo…)
Re: [Full-disclosure] Linux kernel exploit (Ryan Sears <rdsears@....edu>)
Re: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivi… (Marsh Ray <marsh@...endedsubset.com>)
www.eVuln.com : "post" - Non-persistent XSS in slickMsg ("www.eVuln.com Advisories" <bt@...ln.com>)
OSSTMM 3 Now Available! (Pete Herzog <lists@...com.org>)
iDefense Security Advisory 12.14.10: Microsoft Internet Explorer CSS Style Table Layout Uninitialized Memory Vulnerabil… (labs-no-reply <labs-no-reply@...p.vrsn.…)
minor browser UI nitpicking (Michal Zalewski <lcamtuf@...edump.cx>)
ASPR #2010-12-14-1: Remote Binary Planting in Windows Address Book ("ACROS Security Lists" <lists@...os.si>)
Re: hidden admin user on every HP MSA2000 G3 (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
Microsoft Internet Explorer Denial of Service Vulnerability (info@...uritylab.ir)
Kryptos Logic Advisory: IBM Tivoli Storage Manager (TSM) Local Root (Kryptos Logic Secure <secure@...ptoslogic.com>)
[security bulletin] HPSBOV02618 SSRT100354 rev.1 - HP OpenVMS Integrity Servers, Local Denial of Service (DoS), Gain Privileged Access (security-alert@...com)
Re: [Full-disclosure] minor browser UI nitpicking (Michal Zalewski <lcamtuf@...edump.cx>)
iDefense Security Advisory 12.14.10: Microsoft Internet Explorer HTML Object Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
[USN-1024-2] OpenJDK regression (Kees Cook <kees@...ntu.com>)
OpenBSD's IPSEC is Backdoored (musnt live <musntlive@...il.com>)
www.eVuln.com : "post" - Non-persistent XSS in slickMsg (bt@...ln.com)
[ MDVSA-2010:254 ] php (security@...driva.com)
[ MDVSA-2010:255 ] php-intl (security@...driva.com)
[security bulletin] HPSBMA02615 SSRT100228 rev.1 - HP Insight Diagnostics Online Edition Running on Linux and Windows, Remote Cross Site S… (security-alert@...com)
Re: OpenBSD's IPSEC is Backdoored (Michael Scheidell <michael.scheidell@...nap.com>)
OpenBSD Paradox (musnt live <musntlive@...il.com>)
Re: OpenBSD Paradox (Theo de Raadt <deraadt@....openbsd.org>)
[security bulletin] HPSBMA02616 SSRT100231 rev.1 - HP Insight Management Agents Running on Linux and Windows, Remote Full Path Disclosure (security-alert@...com)
www.eVuln.com : BBCode CSS XSS in slickMsg (bt@...ln.com)

December 16 (27 messages)

Openwall GNU/*/Linux 3.0 is out, marks 10 years of the project (Solar Designer <solar@...nwall.com>)
[security bulletin] HPSBST02620 SSRT100356 rev.1 - HP StorageWorks Modular Smart Array P2000 G3, Remote Unauthorized Access (security-alert@...com)
VUPEN Security Research - Microsoft Office Publisher Memory Corruption Vulnerability (VUPEN-SR-2010-041) ("VUPEN Security Research" <advisories@...en.com>)
Re: D-Link DIR-300 authentication bypass (Karol Celiński <karol@...in.pl>)
VUPEN Security Research - Microsoft Internet Explorer Animation Use-after-free Vulnerability (VUPEN-SR-2010-199) ("VUPEN Security Research" <advisories@...en.co…)
[security bulletin] HPSBMA02545 SSRT100139 rev.1 - HP Power Manager (HPPM) Running on Linux and Windows, Remote Execution of Arbitrary Cod… (security-alert@...com)
[security bulletin] HPSBMA02617 SSRT100338 rev.1 - HP Discovery & Dependency Mapping Inventory (DDMI) Running on Windows, Remote Cross SIt… (security-alert@...com)
VUPEN Security Research - Microsoft Office Publisher Record Array Indexing Vulnerability (VUPEN-SR-2010-201) ("VUPEN Security Research" <advisories@...en.com>)
[ MDVSA-2010:256 ] git (security@...driva.com)
VUPEN Security Research - Microsoft Office Publisher Size Value Heap Corruption Vulnerability (VUPEN-SR-2010-200) ("VUPEN Security Research" <advisories@...en.c…)
VUPEN Security Research - Microsoft Office Publisher "pubconv.dll" Array Indexing Vulnerability (VUPEN-SR-2010-206) ("VUPEN Security Research" <advisories@...en…)
www.eVuln.com : "error" Non-persistent XSS in slickMsg (bt@...ln.com)
Call for Paper @ Swiss Cyber Storm 3 ("Ivan Buetler" <ivan.buetler@...c.ch>)
[security bulletin] HPSBUX02351 SSRT080058 rev.6 - HP-UX Running BIND, Remote DNS Cache Poisoning (security-alert@...com)
[security bulletin] HPSBUX02451 SSRT090137 rev.4 - HP-UX Running BIND, Remote Denial of Service (DoS) (security-alert@...com)
RE: [Full-disclosure] OpenBSD Paradox (Larry Seltzer <larry@...ryseltzer.com>)
Updated online binary planting exposure test continues operation ("ACROS Security Lists" <lists@...os.si>)
'Pointter PHP Micro-Blogging Social Network' Unauthorized Privilege Escalation (CVE-2010-4333) (Mark Stanislav <mark.stanislav@...il.com>)
XSS vulnerability in BLOG:CMS (advisory@...ridge.ch)
XSS vulnerability in BEdita (advisory@...ridge.ch)
XSRF (CSRF) in BEdita (advisory@...ridge.ch)
Stored Cross Site Scripting vulnerability in BEdita (advisory@...ridge.ch)
XSRF (CSRF) in BLOG:CMS (advisory@...ridge.ch)
'Pointter PHP Content Management System' Unauthorized Privilege Escalation (CVE-2010-4332) (Mark Stanislav <mark.stanislav@...il.com>)
PR10-06: Cross-domain redirect on PGP Universal Web Messenger (research <research@...checkup.com>)
XSS vulnerability in BLOG:CMS (advisory@...ridge.ch)
cross site scripting vulnerability in BLOG:CMS (advisory@...ridge.ch)

December 17 (12 messages)

[USN-1033-1] Eucalyptus vulnerability (Kees Cook <kees@...ntu.com>)
[ MDVSA-2010:257 ] kernel (security@...driva.com)
www.eVuln.com : "titl","url" - Non-persistent XSS in Social Share (bt@...ln.com)
Re: D-Link DIR-300 authentication bypass (Narendra Choyal <narendrachoyal@...il.com>)
Re: XSS vulnerability in Lantern CMS (security curmudgeon <jericho@...rition.org>)
Re: XSS vulnerability in Expression CMS (security curmudgeon <jericho@...rition.org>)
www.eVuln.com : "link" and "linkdescription" XSS in Social Share (bt@...ln.com)
Alt-N WebAdmin Source Code Disclosure (wsn1983@...il.com)
Making Security Suck Less (Pete Herzog <lists@...com.org>)
[ GLSA 201012-01 ] Chromium: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
Apple Quicktime Memory Corruption - CVE-2010-3801 (Rodrigo Branco <rbranco@...ckpoint.com>)
Embedded Video WordPress Plugin Cross Site Vulnerability (XSS) - CVE-2010-4277 (Rodrigo Branco <rbranco@...ckpoint.com>)

December 20 (10 messages)

OpenBSD CARP Hash Vulnerability (Sam Banks <wolfie@...ogeny.ac.nz>)
Default SSL Keys in Multiple Routers (cheffner@...ttys0.com)
[SECURITY] [DSA 2134-1] Upcoming changes in advisory format (Moritz Muehlenhoff <jmm@...ian.org>)
MyBB 1.6 <= Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Secunia Research: RealPlayer "cook" Uninitialised Memory Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: RealPlayer AAC Spectral Data Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004 (Sense of Security <lists@...seofsecurity.com.au>)
www.eVuln.com : "postid" SQL Injection in Social Share (bt@...ln.com)
Secunia Research: RealPlayer "cook" Arbitrary Free Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: SAP Crystal Reports Print ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)

December 21 (31 messages)

Secunia Research: Microsoft Office PICT Filter Integer Truncation Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Microsoft Office Document Imaging Endian Conversion Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Microsoft Office FlashPix Property Set Parsing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
SQL injection in Hycus CMS (advisory@...ridge.ch)
SQL injection in Injader CMS (advisory@...ridge.ch)
Path disclosure in GetSimple CMS (advisory@...ridge.ch)
XSS vulnerability in Habari (advisory@...ridge.ch)
SQL Injection in HTML-EDIT CMS (advisory@...ridge.ch)
nSense-2010-005: Winamp (Henri Lindberg <henri+lists@...nse.fi>)
Path disclosure in Habari (advisory@...ridge.ch)
XSS vulnerability in Habari (advisory@...ridge.ch)
XSS in HTML-EDIT CMS (advisory@...ridge.ch)
XSS vulnerability in Injader CMS (advisory@...ridge.ch)
Path disclosure in HTML-EDIT CMS (advisory@...ridge.ch)
XSS vulnerability in ImpressCMS (advisory@...ridge.ch)
Secunia Research: Microsoft Office FlashPix Tile Data Two Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
www.eVuln.com : Authentication Bypass by SQL Injection in Social Share (bt@...ln.com)
[security bulletin] HPSBST02619 SSRT100281 rev.1 - HP StorageWorks Storage Mirroring, Remote Execution of Arbitrary Code (security-alert@...com)
SQL injection in Hycus CMS (advisory@...ridge.ch)
nSense-2010-004: Sybase Afaria (Henri Lindberg <henri+lists@...nse.fi>)
PR10-14 Unauthenticated command execution within Mitel's AWC (Mitel Audio and Web Conferencing) (research <research@...checkup.com>)
Secunia Research: Microsoft Office TIFF Image Converter Endian Conversion Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[waraxe-2010-SA#077] - Multiple Vulnerabilities in Calibre 0.7.34 (come2waraxe@...oo.com)
SQL injection in Hycus CMS (advisory@...ridge.ch)
LFI in Hycus CMS (advisory@...ridge.ch)
SQL injection in Injader CMS (advisory@...ridge.ch)
Re: OpenBSD CARP Hash Vulnerability (Jeffrey Walton <noloader@...il.com>)
XSS vulnerability in Injader CMS (advisory@...ridge.ch)
SQL injection in Hycus CMS (advisory@...ridge.ch)
Secunia Research: Microsoft Office TIFF Image Converter Two Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2010:258 ] mozilla-thunderbird (security@...driva.com)

December 22 (6 messages)

VSR Advisories: Citrix Access Gateway Command Injection Vulnerability (VSR Advisories <advisories@...curity.com>)
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-04 (research <research@...checkup.com>)
[SECURITY] [DSA-2136-1] New tor packages fix potential code execution (Raphael Geissert <geissert@...ian.org>)
VMSA-2010-0020 VMware ESXi 4.1 Update Installer SFCB Authentication Flaw (VMware Security Team <security@...are.com>)
[SECURITY] [DSA 2135-1] New xpdf packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
www.eVuln.com : HTTP Response Splitting in Social Share (bt@...ln.com)

December 27 (19 messages)

Sigma Portal Denial of Service Vulnerability (info@...uritylab.ir)
Re: XSS vulnerability in ImpressCMS (sato-san@...resscms.org)
Re: [IMF 2011] 2nd Call - Deadline Extended - Addenunm (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
[security bulletin] HPSBST02619 SSRT100281 rev.2 - HP StorageWorks Storage Mirroring, Remote Execution of Arbitrary Code (security-alert@...com)
[ MDVSA-2010:251-2 ] firefox (security@...driva.com)
Secunia Research: Microsoft Word LFO Parsing Double-Free Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Pligg XSS and SQL Injection (mike@...ewat.ch)
[SECURITY] [DSA 2137-1] Security update for libxml2 (Moritz Muehlenhoff <jmm@...ian.org>)
[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS 3.0.0 (come2waraxe@...oo.com)
Asan Portal (IdehPardaz) Multiple Vulnerabilities (info@...uritylab.ir)
Multiple Vulnerabilities in OpenClassifieds 1.7.0.3 (mike@...ewat.ch)
MyBB 1.6 <= SQL Injection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Django admin list filter data extraction / leakage (Adam Baldwin <adam_baldwin@...nuity-is.com>)
[ MDVSA-2010:259 ] pidgin (security@...driva.com)
Security Advisory - FlexVision Listener Vulnerability (Victor Ribeiro Hora <victor@...pest.com.br>)
[IMF 2011] 2nd Call - Deadline Extended (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
Microsoft Windows Fax Services Cover Page Editor (.cov) Memory Corruption poc (ipsdix@...il.com)
Social Engine 4.x (Music Plugin) Arbitrary File Upload Vulnerability (MyDoom2009@...il.com)
[ MDVSA-2010:251-1 ] firefox (security@...driva.com)

December 29 (12 messages)

[security bulletin] HPSBST02620 SSRT100356 rev.2 - HP StorageWorks Modular Smart Array P2000 G3, Remote Unauthorized Access (security-alert@...com)
HotWeb Rentals "PageId" SQL Injection Vulnerability ("non customers" <non-customers@...ramail.com>)
YEKTAWEB CMS XSS Vulnerability (faghani@...c.ir)
BBcode XSS in KaiBB (advisory@...ridge.ch)
SQL injection in KaiBB (advisory@...ridge.ch)
SQL injection in KaiBB (advisory@...ridge.ch)
Path disclosure in KaiBB (advisory@...ridge.ch)
Fedora 14 - Format string attack in allegro-tools package (rafaldworaczek@...zta.fm)
Pre Jobo .NET "Password" SQL Injection Vulnerability ("non customers" <non-customers@...ramail.com>)
Chilkat Software FTP2 ActiveX Component (ChilkatFtp2.DLL 2.6.1.1) Remote Code Execution poc (ipsdix@...il.com)
[SECURITY] [DSA 2138-1] Security update for wordpress (Giuseppe Iuculano <iuculano@...ian.org>)
[waraxe-2010-SA#079] - Reflected XSS in Coppermine 1.5.10 (come2waraxe@...oo.com)

December 30 (12 messages)

OS X 10.6.5 kernel crash upon wlan roaming with disabled mandatory MCS (Attilla de Groot <attilla@...illa.nl>)
Path disclousure in OpenCart (advisory@...ridge.ch)
CSRF (Cross-Site Request Forgery) in Open blog (advisory@...ridge.ch)
CA ARCserve D2D r15 Web Service Apache Axis2 World Accessible Servlet Code Execution Vulnerability Poc (ipsdix@...il.com)
[ MDVSA-2010:260 ] libxml2 (security@...driva.com)
Path disclousure in ocPortal (advisory@...ridge.ch)
SQL Injection in LightNEasy (advisory@...ridge.ch)
Information disclosure in LightNEasy (advisory@...ridge.ch)
SQL Injection in LightNEasy (advisory@...ridge.ch)
LFI in LightNEasy (advisory@...ridge.ch)
Path disclosure in LightNEasy (advisory@...ridge.ch)
Path disclousure in Nibbleblog (advisory@...ridge.ch)

December 31 (3 messages)

[SECURITY] [DSA 2139-1] New phpmyadmin packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
HP Photo Creative v 2.x audio.Record.1 ActiveX Control (ContentMan.dll 1.0.0.4272) Remote Stack Based Buffer Overflow poc (ipsdix@...il.com)
CA20101231-01: Security Notice for CA ARCserve D2D ("Williams, James K" <James.Williams@...com>)

284 messages

Powered by blists - more mailing lists