bugtraq mailing list - 2011/03

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2011/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 20	² 9	³ 29	⁴ 5	⁵	⁶
⁷ 17	⁸ 12	⁹ 6	¹⁰ 15	¹¹ 5	¹²	¹³
¹⁴ 16	¹⁵ 20	¹⁶ 5	¹⁷ 15	¹⁸ 7	¹⁹	²⁰
²¹ 17	²² 15	²³ 27	²⁴ 20	²⁵ 5	²⁶	²⁷
²⁸ 13	²⁹ 10	³⁰ 19	³¹ 14

Messages by day:

March 1 (20 messages)

[USN-1074-2] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
vsftpd 2.3.2 remote denial-of-service (cxib@...urityreason.com)
weechat does not properly use gnutls and allow an attacker to bypass certificate verification (john.doe@...z.be)
[SECURITY] [DSA 2175-1] samba security update (Moritz Muehlenhoff <jmm@...ian.org>)
ZDI-11-094: (0 day) Hewlett-Packard StorageWorks File Migration Agent Remote Archive Tampering Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com…)
[security bulletin] HPSBUX02633 SSRT100387 rev.1 - HP-UX running Java, Remote Denial of Service (DoS) (security-alert@...com)
[USN-1078-1] Logwatch vulnerability (Steve Beattie <sbeattie@...ntu.com>)
SnapProof (cart.php) Cross Site Scripting (difficult-511@...mail.com)
Re: prestashop vuln: sql injection submitted to bugtraq@...urityfocus.com (antonio_s_martino@...oo.es)
[USN-1079-1] OpenJDK 6 vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)
Re: Re: prestashop vuln: sql injection submitted to bugtraq () securityfocus com ("Antonio S.M" <antonio_s_martino@...oo.es>)
HTB22862: Path disclosure in NextGEN Gallery wordpress plugin (advisory@...ridge.ch)
HTB22861: XSS in Question and Answer Forum wordpress plugin (advisory@...ridge.ch)
HTB22860: SQL Injection in WP Forum wordpress plugin (advisory@...ridge.ch)
HTB22859: SQL Injection in WP Forum wordpress plugin (advisory@...ridge.ch)
HTB22858: SQL Injection in WP Forum wordpress plugin (advisory@...ridge.ch)
HTB22849: Path disclosure in Mingle Forum wordpress plugin (advisory@...ridge.ch)
HTB22848: XSS in Mingle Forum wordpress plugin (advisory@...ridge.ch)
DDIVRT-2010-30 Alcatel-Lucent OmniVista 4760 NMS 'lang' Directory Traversal Vulnerability [ CVE-2011-0345 ] (ddivulnalert@...frontline.com)
[SECURITY] [DSA 2163-2] dajaxice regression fix (Thijs Kinkhorst <thijs@...ian.org>)

March 2 (9 messages)

[USN-1080-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-1081-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
[ MDVSA-2011:039 ] webkit (security@...driva.com)
[SECURITY] [DSA 2176-1] cups security update (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-1082-1] Pango vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
VidiScript (index.php) Cross Site Scripting (Root@...y.com)
PhotoPost PHP 4.8c (showgallery.php) Cross Site Scripting (Root@...y.com)
Prestashop Cartium 1.3.3 Multiple Cross Site Scripting (XSS) ("Antonio S.M" <antonio_s_martino@...oo.es>)
CubeCart 2.0.6 SQL injection / Cross Site Scripting (Root@...y.com)

March 3 (29 messages)

[SECURITY] [DSA 2177-1] pywebdav security update (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBUX02638 SSRT100339 rev.1 - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code, Denial of Service (DoS), Aut… (security-alert@...com)
ZDI-11-103: Mozilla Firefox JSON.stringify Dangling Pointer Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[SECURITY] [DSA 2178-1] pango1.0 security update (Florian Weimer <fw@...eb.enyo.de>)
ZDI-11-102: PostgreSQL Plus Advanced Server DBA Management Server Remote Authentication Bypass Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com…)
[USN-1083-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 2179-1] dtc security update (Florian Weimer <fw@...eb.enyo.de>)
iDefense Security Advisory 03.01.11: Alcatel-Lucent OmniPCX Enterprise CS CGI Cookie Buffer Overflow Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
ZDI-11-095: Apple Webkit Error Message Mutation Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-096: Apple Safari WebKit Range Object Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-097: Apple Webkit setOuterText Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-1080-2] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
ZDI-11-098: Apple Safari Webkit Runin Box Promotion Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-099: Apple Webkit Font Glyph Layout Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-100: Apple Webkit Root HTMLBRElement Style Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-101: Apple iPhone Webkit Library Javascript Array sort Method Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
iDefense Security Advisory 03.02.11: Apple CoreGraphics Library Heap Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
[USN-1050-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: Prestashop Cartium 1.3.3 Multiple Cross Site Scripting (XSS) (mike@...ewat.ch)
HTB22863: XSS vulnerability in xtcModified (advisory@...ridge.ch)
HTB22857: Path disclosure in Tribiq CMS (advisory@...ridge.ch)
HTB22866: XSS vulnerability in xtcModified (advisory@...ridge.ch)
HTB22855: XSRF (CSRF) in Pragyan CMS (advisory@...ridge.ch)
HTB22856: XSS vulnerability in Pragyan CMS (advisory@...ridge.ch)
HTB22853: XSS vulnerability in Pragyan CMS (advisory@...ridge.ch)
HTB22865: XSS vulnerability in xtcModified (advisory@...ridge.ch)
HTB22837: Path disclosure in PrestaShop (advisory@...ridge.ch)
[ MDVSA-2011:040 ] pango (security@...driva.com)
[security bulletin] HPSBPI02640 SSRT100410 rev.1 - HP MFP Digital Sending Software Running on Windows, Authentication Bypass (security-alert@...com)

March 4 (5 messages)

[SECURITY] [DSA 2180-1] iceape security update (Moritz Muehlenhoff <jmm@...ian.org>)
[DCA-2011-0001] TP-LINK TL-WR740N Multiple Vulnerabilities - Stored XSS - Web Console and Upnp server DoS (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.co…)
[DCA-2011-0002]: TOTVS ERP Microsiga Protheus - Users Enumeration (Flavio do Carmo Junior aka waKKu <carmo.flavio@...abs.com.br>)
[DCA-2011-0003]: LMS Web Ensino - Multiple XSS, Session Fixation, CSRF and SQL Injection (Flavio do Carmo Junior aka waKKu <carmo.flavio@...abs.com.br>)
[SECURITY] [DSA 2181-1] subversion security update (Florian Weimer <fw@...eb.enyo.de>)

March 7 (17 messages)

Mutare Software EVM - CSRF and XSS Vulnerabilities ("Travis Lee" <travisle@...il.com>)
[SECURITY] [DSA 2182-1] logwatch security update (Florian Weimer <fw@...eb.enyo.de>)
'Quick Polls' Local File Inclusion & Deletion Vulnerabilities (CVE-2011-1099) (Mark Stanislav <mark.stanislav@...il.com>)
XSS in CubeCart <= 2.0.7 (Michele Spagnuolo <mikispag@...il.com>)
[DCA-2011-0006] Hiawatha 7.4 - Denial-of-Service (Rodrigo Escobar <ipax@...abs.com.br>)
[DCA-2011-0009] Weborf 0.12.4 Denial-of-Service (Rodrigo Escobar <ipax@...abs.com.br>)
[ MDVSA-2011:041 ] firefox (security@...driva.com)
[SECURITY] [DSA 2183-1] nbd security update (Raphael Geissert <geissert@...ian.org>)
[SECURITY] [DSA 2184-1] isc-dhcp security update (Florian Weimer <fw@...eb.enyo.de>)
RECON 2011 CFP (hfortier@...on.cx)
InSite Troubleshooting Cross-Site Scripting (vulns@...nach.com)
Kodak InSite Login Page Cross-Site Scripting (vulns@...nach.com)
[USN-1084-1] avahi vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1085-1] tiff vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[TEHTRI-Security] Security and iPhone iOS 4.3 Personal Hotspot feature (Laurent OUDOT at TEHTRI-Security <laurent.oudot-ml@...tri-security.com>)
[ MDVSA-2011:042 ] mozilla-thunderbird (security@...driva.com)
Plaintext injection in STARTTLS (multiple implementations) (Wietse Venema <wietse@...cupine.org>)

March 8 (12 messages)

VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console pac… (VMware Security Team <security@...are.c…)
HTB22872: Path disclosure in Cool Video Gallery wordpress plugin (advisory@...ridge.ch)
HTB22873: XSS in Inline Gallery wordpress plugin (advisory@...ridge.ch)
HTB22871: File Content Disclosure in GRAND Flash Album Gallery wordpress plugin (advisory@...ridge.ch)
HTB22870: SQL Injection in GRAND Flash Album Gallery wordpress plugin (advisory@...ridge.ch)
[ MDVSA-2011:043 ] libtiff (security@...driva.com)
[HITB-Announce] HITB Magazine Call for Articles (Hafez Kamal <aphesz@...kinthebox.org>)
HTB22869: SQL Injection in 1 Flash Gallery wordpress plugin (advisory@...ridge.ch)
HTB22868: XSS in 1 Flash Gallery wordpress plugin (advisory@...ridge.ch)
HTB22867: XSS in PhotoSmash wordpress plugin (advisory@...ridge.ch)
Cross-Site Scripting vulnerabilities in Icinga (sschurtz@...nline.de)
[security bulletin] HPSBUX02641 SSRT100412 rev.1 - HP OpenView Network Node Manager (OV NNM) for HP-UX, Linux, Solaris, and Windows runnin… (security-alert@...com)

March 9 (6 messages)

AthCon 2011 Announcement (kyprianos@...con.org)
NSOADV-2011-003: Majordomo2 'help' Command Directory Traversal (Patch Bypass) (NSO Research <nso-research@...iriu.de>)
[ MDVSA-2011:044 ] wireshark (security@...driva.com)
[USN-1086-1] Linux kernel (EC2) vulnerabilities (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 2185-1] proftpd-dfsg security update (Moritz Mühlenhoff <jmm@...ian.org>)
RecordPress Multiple Vulnerabilities (irancrash@...il.com)

March 10 (15 messages)

[DCA-2011-0007] Air Contacts Lite (iPhone / iPod App Denial Of Service) (Rodrigo Escobar <ipax@...abs.com.br>)
HTB22880: XSS vulnerability in CosmoShop (advisory@...ridge.ch)
HTB22875: XSS in Lazyest Gallery wordpress plugin (advisory@...ridge.ch)
HTB22878: XSS vulnerability in CosmoShop (advisory@...ridge.ch)
[SECURITY] [DSA 2187-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
HTB22874: Path disclosure in Lazyest Gallery wordpress plugin (advisory@...ridge.ch)
HTB22879: Multiple XSS vulnerabilities in CosmoShop (advisory@...ridge.ch)
[SECURITY] [DSA 2186-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
Cross-Site Scripting vulnerability in Nagios (sschurtz@...nline.de)
[SECURITY] [DSA 2188-1] webkit security update (Giuseppe Iuculano <iuculano@...ian.org>)
Call for Papers: Passwords^11 (Per Thorsheim <per@...rsheim.net>)
HTB22881: SQL injection vulnerability in CosmoShop (advisory@...ridge.ch)
Re: Cross-Site Scripting vulnerability in Nagios (sschurtz@...nline.de)
[security bulletin] HPSBMA02629 SSRT100381 rev.3 - HP Power Manager (HPPM) Running on Linux and Windows, Cross Site Request Forgery (CSRF)… (security-alert@...com)
Re: HTB22875: XSS in Lazyest Gallery wordpress plugin (lazyest@...mosoft.nl)

March 11 (5 messages)

Re: HTB22874: Path disclosure in Lazyest Gallery wordpress plugin (lazyest@...mosoft.nl)
Medium severity flaw in QNX Neutrino RTOS (Tim Brown <timb@...-dimension.org.uk>)
Swiss Cyber Storm 3 2011 Announcement ("Ivan Buetler" <ivan.buetler@...c.ch>)
[SECURITY] [DSA 2190-1] wordpress security update (Giuseppe Iuculano <iuculano@...ian.org>)
DC4420 - London DEFCON - March meet - Tuesday 22nd March 2011 (Major Malfunction <majormal@...ate-radio.org>)

March 14 (16 messages)

VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free ("VUPEN Security Research" <advisories@...en.com>)
Joomla! 1.6.0 | Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
VUPEN Security Research - Apple Safari WebKit Scroll Event Handling Remote Use-after-free ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Apple Safari WebKit Block Dimensions Handling Integer Overflow ("VUPEN Security Research" <advisories@...en.com>)
Privacy, Security, Trust (PST 2011) - 2nd Call for Papers (Deadline: March 20) ("Serguei A. Mokhov on behalf of PST-11" <mokhov@....concordia.ca>)
Checkpoint VPN - Priviledge Escalation (Thierry Zoller <Thierry@...ler.lu>)
bbPress 1.0.2 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Joomla! 1.6.0 | SQL Injection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
BoutikOne Multiples SQL Injection Vulnerability (cdx.security@...il.com)
ClubHACK Magazine: Call for Articles (abhijeet@...bhack.com)
[DSECRG-11-009] SAP NetWaver XI SOAP Adapter - XSS (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[USN-1087-1] libvpx vulnerability (Micah Gersten <micah@...onical.com>)
[DSECRG-11-010] SAP NetWeaver logon.html - XSS (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DCA-2011-0004] - Trend WebReputation API Bypass (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)
[SECURITY] [DSA 2191-1] proftpd security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBMA02644 SSRT100284 rev.1 - HP Client Automation Enterprise (HPCA) Running on Windows, Remote Execution of Arbitrar… (security-alert@...com)

March 15 (20 messages)

VMSA-2011-0005 VMware vCenter Orchestrator remote code execution vulnerability (VMware Security Team <security@...are.com>)
[USN-1085-2] tiff regression (Kees Cook <kees@...ntu.com>)
[USN-1079-2] OpenJDK 6 vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)
[SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass (Mark Thomas <markt@...che.org>)
HTB22877: Path disclosure in xt:Commerce (advisory@...ridge.ch)
HTB22888: File Content Disclosure in LotusCMS (advisory@...ridge.ch)
HTB22882: Path disclosure in OXID eShop (advisory@...ridge.ch)
HTB22883: XSS vulnerability in LotusCMS (advisory@...ridge.ch)
HTB22884: XSS vulnerability in LotusCMS (advisory@...ridge.ch)
HTB22885: XSS vulnerability in LotusCMS (advisory@...ridge.ch)
HTB22886: XSRF (CSRF) in LotusCMS (advisory@...ridge.ch)
HTB22887: XSS vulnerability in LotusCMS (advisory@...ridge.ch)
ESA-2011-007: EMC Avamar sensitive information disclosure vulnerability (<Security_Alert@....com>)
ESA-2011-009: RSA, The Security Division of EMC, announces a fix for potential security vulnerability in RSA Access Manager Server (<Security_Alert@....com>)
ESA-2011-006: EMC Avamar privilege escalation vulnerability (<Security_Alert@....com>)
[RT-SA-2011-001] nostromo nhttpd directory traversal leading to arbitrary command execution (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2011-002] SugarCRM list privilege restriction bypass (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[SECURITY] [DSA 2192-1] chromium-browser security update (Giuseppe Iuculano <iuculano@...ian.org>)
MITKRB5-SA-2011-003 [CVE-2011-0284] KDC double-free when PKINIT enabled (Tom Yu <tlyu@....edu>)
[USN-1088-1] Kerberos vulnerability (Steve Beattie <sbeattie@...ntu.com>)

March 16 (5 messages)

[DSECRG-11-011] SAP Crystal Reports 2008 - Multiple XSS (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DSECRG-11-013] SAP NetWeaver Runtime - multiple XSS (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DSECRG-11-012] SAP NetWeaver Integration Directory - multiple XSS (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DSECRG-11-014] SAP GUI (sapgui) - DLL hijacking (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[ MDVSA-2011:045 ] postfix (security@...driva.com)

March 17 (15 messages)

[SECURITY] [DSA 2193-1] libcgroup security update (Thijs Kinkhorst <thijs@...ian.org>)
HTB22894: XSS in Sodahead Polls wordpress plugin (advisory@...ridge.ch)
HTB22893: XSS in Sodahead Polls wordpress plugin (advisory@...ridge.ch)
HTB22892: Path disclosure in Smen Social Button wordpress plugin (advisory@...ridge.ch)
HTB22891: XSS in Rating-Widget wordpress plugin (advisory@...ridge.ch)
HTB22890: XSS in Rating-Widget wordpress plugin (advisory@...ridge.ch)
HTB22889: XSS in Rating-Widget wordpress plugin (advisory@...ridge.ch)
[PRE-SA-2011-02] Information disclosure vulnerability in the OSF partition handling code of the Linux kernel (Timo Warns <Warns@...-sense.de>)
[Announcement] ClubHACK Magazine Issue 14-March 2011 released (abhijeet@...bhack.com)
AST-2011-003: ("Asterisk Security Team" <security@...erisk.org>)
AST-2011-004: ("Asterisk Security Team" <security@...erisk.org>)
Deferral Announcement for the March 2011 Cisco IOS Software Security Advisories (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[ MDVSA-2011:046 ] pure-ftpd (security@...driva.com)
[USN-1079-3] OpenJDK 6 vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)
[TEHTRI-Security] Quick BlackBerry Security Check (Laurent OUDOT at TEHTRI-Security <laurent.oudot-ml@...tri-security.com>)

March 18 (7 messages)

[SECURITY] [DSA 2194-1] libvirt security update (Thijs Kinkhorst <thijs@...ian.org>)
[ MDVSA-2011:047 ] proftpd (security@...driva.com)
OWASP AppSec USA 2011 Call for Papers (Adam Baso <adam@...otheory.com>)
XOOPS 2.5.0 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
libzip 0.9.3 _zip_name_locate NULL Pointer Dereference (incl PHP 5.3.5) (cxib@...urityreason.com)
[ MDVSA-2011:048 ] krb5 (security@...driva.com)
[SECURITY] [DSA 2186-2] vimperator regression fix (Moritz Muehlenhoff <jmm@...ian.org>)

March 21 (17 messages)

[USN-1089-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-1090-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
Tugux CMS (nid) BLIND sql injection vulnerability (eidelweiss@...dowslive.com)
Buffer overflow in libtiff in Imagemagick (zgmzgm@...l.ustc.edu.cn)
XSS vulnerability in Web Poll Pro (Hector.x90@...il.com)
Re: HTB22884: XSS vulnerability in LotusCMS (admin@...uscms.org)
Privacy, Security, Trust (PST 2011) - Call for Papers (EXTENDED Deadline: April 3, 2011) ("Serguei A. Mokhov on behalf of PST-11" <mokhov@....concordia.ca>)
ZDI-11-106: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Vulnerabilities in some SCADA server softwares (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 2196-1] maradns security update (Raphael Geissert <geissert@...ian.org>)
[SECURITY] [DSA 2195-1] php5 security update (Raphael Geissert <geissert@...ian.org>)
[ MDVSA-2011:051 ] kernel (security@...driva.com)
ZDI-11-105: Hewlett-Packard Client Automation radexecd.exe Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Douran Portal File Download/Source Code Disclosure Vulnerability (support@...xtm.com)
[ MDVSA-2011:049 ] vsftpd (security@...driva.com)
Heap overflow in RealPlayer 14.0.1.633 (Luigi Auriemma <aluigi@...istici.org>)
[ MDVSA-2011:050 ] pidgin (security@...driva.com)

March 22 (15 messages)

Re: Vulnerabilities in some SCADA server softwares ("J. Oquendo" <sil@...iltrated.net>)
Re: Vulnerabilities in some SCADA server softwares (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 2197-1] quagga security update (Florian Weimer <fw@...eb.enyo.de>)
NGS00057 Patch Notification: Apple Mac OS X ImageIO Integer Overflow ("Research@...Secure" <research@...secure.com>)
NGS00052 Patch Notification: Apple Mac OS X Image RAW Multiple Buffer Overflows ("Research@...Secure" <research@...secure.com>)
ZDI-11-107: Libtiff ThunderCode Decoder THUNDER_2BITDELTAS Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
iDefense Security Advisory 03.21.11: Apple OfficeImport Framework Excel Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
NGS00014 Technical Advisory: Cisco IPSec VPN Implementation Group Name Enumeration ("Research@...Secure" <research@...secure.com>)
CMS Balitbang 3.3 Arbitary File Upload Vulnerability (eidelweiss@...dowslive.com)
NGS00016 Technical Advisory: Immunity Debugger Buffer Overflow ("Research@...Secure" <research@...secure.com>)
NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability (NSO Research <nso-research@...iriu.de>)
ZDI-11-108: Mac OS X Compact Font Format Decoder Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-109: (Pwn2Own) Apple Safari OfficeArtBlip Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Apple HFS+ Information Disclosure Vulnerability (VSR Advisories <advisories@...curity.com>)
[security bulletin] HPSBMA02647 SSRT100383 rev.1 - HP Discovery & Dependency Mapping Inventory (DDMI) Running on Windows, Insecure SNMP Co… (security-alert@...com)

March 23 (27 messages)

Re: Vulnerabilities in some SCADA server softwares (Michal Zalewski <lcamtuf@...edump.cx>)
SCADA Trojans: Attacking the Grid + Advantech vulnerabilities (Reversemode <advisories@...ersemode.com>)
[SECURITY] [DSA 2198-1] tex-common security update (Nico Golde <nion@...ian.org>)
ZDI-11-110: (0day) IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.…)
XSS in Oracle default fcgi-bin/echo (paul.szabo@...ney.edu.au)
Joomla! 1.6.0 | Information Disclosure/Full Path Disclosure Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
[ MDVSA-2011:052 ] php (security@...driva.com)
[ MDVSA-2011:053 ] php (security@...driva.com)
Re: Buffer overflow in libtiff in Imagemagick ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
RE: Vulnerabilities in some SCADA server softwares (Jim Harrison <Jim@...tools.org>)
PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: Vulnerabilities in some SCADA server softwares (R Michael Williams <rmwstealth@...cast.net>)
RE: Vulnerabilities in some SCADA server softwares (Jim Harrison <jim@...tools.org>)
ZDI-11-112: (0 day) Hewlett-Packard Data Protector Media Operations DBServer.exe Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingp…)
Re: Vulnerabilities in some SCADA server softwares (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Vulnerabilities in some SCADA server softwares ("J. Oquendo" <sil@...iltrated.net>)
PHP-Nuke 8.x <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
PHP-Nuke 8.x <= "chng_uid" Blind SQL Injection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: Vulnerabilities in some SCADA server softwares (Theo de Raadt <deraadt@....openbsd.org>)
Re: Vulnerabilities in some SCADA server softwares (Theo de Raadt <deraadt@....openbsd.org>)
Re: Vulnerabilities in some SCADA server softwares ("J. Oquendo" <sil@...iltrated.net>)
ZDI-11-111: (0Day) Hewlett-Packard Virtual SAN Appliance hydra.exe Login Request Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingp…)
Re: Vulnerabilities in some SCADA server softwares (Mike Hoskins <michoski@...co.com>)
Re: Vulnerabilities in some SCADA server softwares (Simple Nomad <thegnome@...c.org>)
Re: Vulnerabilities in some SCADA server softwares (Luigi Auriemma <aluigi@...istici.org>)
Re: Vulnerabilities in some SCADA server softwares (Kent Borg <kentborg@...g.org>)
CORE-2011-0208: VLC Vulnerabilities handling .AMV and .NSV files (CORE Security Technologies Advisories <advisories@...esecurity.com>)

March 24 (20 messages)

[SECURITY] [DSA 2199-1] iceape security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2200-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
HTB22898: XSRF (CSRF) in Ripe website manager (advisory@...ridge.ch)
HTB22900: Multiple XSS vulnerabilities in SyndeoCMS (advisory@...ridge.ch)
[SECURITY] [DSA 2201-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
HTB22902: XSS in SyndeoCMS (advisory@...ridge.ch)
[SECURITY] [DSA 2202-1] apache2 security update (Stefan Fritsch <sf@...ian.org>)
HTB22895: XSS vulnerability in Ripe website manager (advisory@...ridge.ch)
Re: Vulnerabilities in some SCADA server softwares ("J. Oquendo" <sil@...iltrated.net>)
HTB22897: SQL injection vulnerability in Ripe website manager (advisory@...ridge.ch)
Re: Vulnerabilities in some SCADA server softwares (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
Re: Vulnerabilities in some SCADA server softwares (Jamie Riden <jamie.riden@...il.com>)
Re: Vulnerabilities in some SCADA server softwares (Simple Nomad <thegnome@...c.org>)
HTB22899: Path disclosure in SyndeoCMS (advisory@...ridge.ch)
Re: Vulnerabilities in some SCADA server softwares (bugtraq@...security.net)
HTB22896: SQL injection vulnerability in Ripe website manager (advisory@...ridge.ch)
HTB22901: SQL injection in SyndeoCMS (advisory@...ridge.ch)
Re: Vulnerabilities in some SCADA server softwares (Kent Borg <kentborg@...g.org>)
Re: Vulnerabilities in some SCADA server softwares (CJC <parttimesecurityguy@...il.com>)
Re: Vulnerabilities in some SCADA server softwares (Michal Zalewski <lcamtuf@...edump.cx>)

March 25 (5 messages)

[USN-1091-1] Firefox and Xulrunner vulnerabilities (Micah Gersten <micah@...onical.com>)
ESA-2011-010: EMC Data Protection Advisor Collector arbitrary code execution with elevated privileges vulnerability (<Security_Alert@....com>)
NGS00051 Patch Notification: Cisco VPN Client Privilege Escalation ("Research@...Secure" <research@...secure.com>)
Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: Vulnerabilities in some SCADA server softwares (Willy Tarreau <w@....eu>)

March 28 (13 messages)

[USN-1092-1] Linux Kernel vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Unidesk ReportingService Forceful Browsing Vulnerability (np@...uritypentest.com)
[USN-1093-1] Linux Kernel vulnerabilities (Marvell Dove) (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 2203-1] nss security update (Moritz Muehlenhoff <jmm@...ian.org>)
SimplisCMS 1.0.3.0 SQL injection / Cross Site Scripting (root@...y.com)
[SECURITY] [DSA 2204-1] imp4 security update (white@...ian.org (Steffen Joeris))
[security bulletin] HPSBMA02649 SSRT100430 rev.1 - HP Diagnostics, Remote Cross Site Scripting (XSS) (security-alert@...com)
SimplisCMS 1.0.3.0 Remote File Disclosure Vulnerability (root@...y.com)
TSSA-2011-01 xpdf : multiple vulnerabilities allow remote code execution (Advisories Toucan-System <advisories@...can-system.com>)
Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability - SOS-11-003 ("Lists" <lists@...seofsecurity.com.au>)
[AntiSnatchOr] OpenCMS <= 7.5.3 multiple vulnerabilities (Michele Orru <antisnatchor@...il.com>)
[ MDVSA-2011:054 ] java-1.6.0-openjdk (security@...driva.com)
ZDI-11-113: Zend Server Java Bridge Design Flaw Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

March 29 (10 messages)

Solaris 10 Port Stealing Vulnerability ("Chris O'Regan" <chris@...s.concordia.ca>)
"Simple PHP Newsletter" Remote Admin Password Change With install path (cseye_ut@...oo.com)
"Simple PHP Newsletter" Remote Admin Password Change With install path (cseye_ut@...oo.com)
HTB22905: Path disclosure in Wordpress (advisory@...ridge.ch)
[SECURITY] [DSA 2205-1] gdm3 security update (Florian Weimer <fw@...eb.enyo.de>)
"WESPA PHP Newsletter v3.0" Remote Admin Password Change With install path (cseye_ut@...oo.com)
HTB22904: Path disclosure in bbPress (advisory@...ridge.ch)
XSS Vulnerability in Tracks 1.7.2 (Netsparker Advisories <advisories@...itunasecurity.com>)
"WESPA PHP Newsletter v3.0" Remote Admin Password Change With install path (cseye_ut@...oo.com)
HTB22903: XSS in Spitfire CMS (advisory@...ridge.ch)

March 30 (19 messages)

Re: "Simple PHP Newsletter" Remote Admin Password Change With install path (Patrick Kelley <psworn@...il.com>)
Re: HTB22905: Path disclosure in Wordpress (Christian Sciberras <uuf6429@...il.com>)
[SECURITY] [DSA 2206-1] New mahara packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
VMSA-2011-0006 VMware vmrun utility local privilege escalation (VMware Security Team <security@...are.com>)
[USN-1098-1] vsftpd vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1096-1] Subversion vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
DataDynamics Report Library CoreHandler XSS (david.daly@...nach.com)
[USN-1097-1] Tomcat vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2011:055 ] openldap (security@...driva.com)
[SECURITY] [DSA 2207-1] tomcat5.5 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-1094-1] Libvirt vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-1095-1] Quagga vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2011:056 ] openldap (security@...driva.com)
ESA-2011-012: Security update for EMC NetWorker Module for Microsoft Applications (<Security_Alert@....com>)
Cisco Security Advisory: Cisco Secure Access Control System Unauthorized Password Change Vulnerability (Cisco Systems Product Security Incident Response Team <p…)
Cisco Security Advisory: Cisco Network Access Control Guest Server System Software Authentication Bypass Vulnerability (Cisco Systems Product Security Incident …)
Cisco Security Advisory: Cisco Network Access Control Guest Server System Software Authentication Bypass Vulnerability (Cisco Systems Product Security Incident …)
Re: HTB22905: Path disclosure in Wordpress (Patrick Kelley <psworn@...il.com>)
Re: HTB22905: Path disclosure in Wordpress (Patrick Kelley <psworn@...il.com>)

March 31 (14 messages)

[SECURITY] [DSA 2208-1] bind9 security update (Florian Weimer <fw@...eb.enyo.de>)
Re: Re: HTB22905: Path disclosure in Wordpress (mike@...ewat.ch)
'Andy's PHP Knowledgebase' SQL Injection Vulnerability (CVE-2011-1546) (Mark Stanislav <mark.stanislav@...il.com>)
RE: Solaris 10 Port Stealing Vulnerability ("Chris O'Regan" <chris@...s.concordia.ca>)
[USN-1099-1] GDM vulnerability (Steve Beattie <sbeattie@...ntu.com>)
[SECURITY] [DSA 2208-2] bind9 security update (Florian Weimer <fw@...eb.enyo.de>)
HTB22907: Directory Traversal in Collabtive (advisory@...ridge.ch)
HTB22906: XSS vulnerabilities in Collabtive (advisory@...ridge.ch)
HTB22910: XSRF (CSRF) in Feng Office (advisory@...ridge.ch)
HTB22909: Path disclosure in Tine 2.0 (advisory@...ridge.ch)
HTB22908: XSRF (CSRF) in Collabtive (advisory@...ridge.ch)
HTB22931: XSS vulnerability in InTerra Blog Machine (advisory@...ridge.ch)
[USN-1100-1] OpenLDAP vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: Solaris 10 Port Stealing Vulnerability (Casper.Dik@...cle.COM)

321 messages

Powered by blists - more mailing lists