full-disclosure mailing list - 2012/03

Messages by day:

March 1 (10 messages)

• [ MDVSA-2012:028 ] libxslt (security@...driva.com)
• Re: Anon war?- arrests (Julius Kivimäki <julius.kivimaki@...il.com>)
• Re: Anon war?- arrests (Julius Kivimäki <julius.kivimaki@...il.com>)
• Re: Anon war?- arrests (Julius Kivimäki <julius.kivimaki@...il.com>)
• phxEventManager 2.0 beta 5 search.php search_terms SQL Injection Vulnerability (David Guimaraes <skysbsb@...il.com>)
• Re: Anon war?- arrests (Christian Sciberras <uuf6429@...il.com>)
• Re: Anon war?- arrests (Valdis.Kletnieks@...edu)
• FlashFXP v4.1.8.1701 - Buffer Overflow Vulnerability ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• LDAP Account Manager Pro v3.6 (lamp) - Multiple Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• Endian UTM Firewall v2.4.x & v2.5.0 - Multiple Web Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)

• linode.com hacked? anyone else? (stuxnet@...abit.com)
• [SECURITY] [DSA 2423-1] movabletype-opensource security update (Florian Weimer <fw@...eb.enyo.de>)

• Security Implications of Predictable IPv6 Fragment Identification values (rev'ed IETF I-D) (Fernando Gont <fgont@...networks.com>)
• [SECURITY] [DSA 2424-1] libxml-atom-perl security update (Florian Weimer <fw@...eb.enyo.de>)
• Only two weeks left to Troopers12 (Florian Horsch <fhorsch@...w.de>)
• [SECURITY] [DSA 2425-1] plib security update (Florian Weimer <fw@...eb.enyo.de>)

• Symfony2 Local File Disclosure - Security Advisory - SOS-12-002 ("Lists" <lists@...seofsecurity.com>)
• %windir%\temp\sso\ssoexec.dll (or: how trustworthy is Microsoft's build process) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
• Path Traversal and O.S. Command Injection vulnerabilities in Polycom products (João Paulo Caldas Campello <joao.paulo@...pest.com.br>)
• Open-Realty CMS 2.5.8 (2.x.x) <= "select_users_template" Local File Inclusion Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
• Etano 1.x <= Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)

• [SECURITY] [DSA 2426-1] gimp security update (Florian Weimer <fw@...eb.enyo.de>)
• [SECURITY] [DSA 2427-1] imagemagick security update (Florian Weimer <fw@...eb.enyo.de>)
• Re: Full disclosure is arrest of Sabu (Ferenc Kovacs <tyra3l@...il.com>)
• Cookie based SQL Injection ("Adam Behnke" <adam@...osecinstitute.com>)
• Re: Cookie based SQL Injection (Valdis.Kletnieks@...edu)
• Re: Cookie based SQL Injection ("Zach C." <fxchip@...il.com>)
• Re: Cookie based SQL Injection (Benji <me@...ji.com>)
• Re: Full disclosure is arrest of Sabu (Laurelai <laurelai@...echan.org>)
• Re: Full disclosure is arrest of Sabu (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• Re: Full disclosure is arrest of Sabu ("Ivan .Heca" <ivanhec@...il.com>)

• Joining LulzSec (Fatherlaptop <fatherlaptop@...il.com>)
• gnome-terminal, xfce4-terminal, terminator and others write scrollback buffer to disk (Mark Krenz <mark@...o.com>)
• Sabu, the FBI informant? (Ramo <ramo@...dvikings.com>)
• Re: Sabu, the FBI informant? ("Ivan .Heca" <ivanhec@...il.com>)
• Re: Sabu, the FBI informant? (Laurelai <laurelai@...echan.org>)
• Re: gnome-terminal, xfce4-terminal, terminator and others write scrollback buffer to disk (coderman <coderman@...il.com>)
• Re: Sabu, the FBI informant? (Elly_Tran_Ha <hexmasta@...il.com>)
• Iciniti Store SQL Injection - Security Advisory - SOS-12-003 ("Lists" <lists@...seofsecurity.com>)
• Re: gnome-terminal, xfce4-terminal, terminator and others write scrollback buffer to disk (Mark Krenz <mark@...o.com>)
• Re: Iciniti Store SQL Injection - Security Advisory - SOS-12-003 (James Parson <james.w.parson@...il.com>)
• Pokemon.com has no respect for user's personal data (klondike <klondike@...cosoft.es>)
• HITB2011KUL - Satellite Telephony Security - Jim Geovedi ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• Re: Full disclosure is arrest of Sabu (Erik Falor <ewfalor@...il.com>)
• [Security-news] SA-CONTRIB-2012-030 - Data - Cross Site Scripting (XSS) (security-news@...pal.org)
• [SECURITY] [DSA 2429-1] mysql-5.1 security update (Florian Weimer <fw@...eb.enyo.de>)
• [Security-news] SA-CONTRIB-2012-031 - Multiple Modules Unsupported - UC PayDutchGroup - Information leakage and Multisite Search sql … (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-032 - Block Class - Cross Site scripting (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-034 - Node Recommendation Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-033 - Read More Link - Cross Site Scripting (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-035 - Webform Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] DRUPAL-PSA-2012-001 - localizations - Cross Site Scripting (security-news@...pal.org)

• Stakeout: how the FBI tracked and busted a Chicago Anon ("Ivan .Heca" <ivanhec@...il.com>)
• Barracuda WAF 660 v7.6.0.028 - Cross Site Vulnerability ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• Barracuda CudaTel v2.0.029.1 - Multiple Web Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• Enterasys SecureStack Switch v6.x - Multiple Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• Pitrinec MacroToolworks 7.5 - Buffer Overflow Vulnerability ("research@...nerability-lab.com" <research@...nerability-lab.com>)
• [HITB-Announce] HITB2012AMS SIGINT - Call for Submissions (Hafez Kamal <aphesz@...kinthebox.org>)
• Re: Stakeout: how the FBI tracked and busted a Chicago Anon (Elly_Tran_Ha <hexmasta@...il.com>)
• Re: Stakeout: how the FBI tracked and busted a Chicago Anon (Laurelai <laurelai@...echan.org>)
• [SECURITY] [DSA 2428-1] freetype security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Stakeout: how the FBI tracked and busted a Chicago Anon (Elly_Tran_Ha <hexmasta@...il.com>)

• VMSA-2012-0002 VMware vCenter Chargeback Manager Information Leak and Denial of Service (VMware Security Team <security@...are.com>)
• VMSA-2012-0003 VMware VirtualCenter Update and ESX 3.5 patch update JRE (VMware Security Team <security@...are.com>)
• Re: Full disclosure is arrest of Sabu (Julius Kivimäki <julius.kivimaki@...il.com>)
• Re: Stakeout: how the FBI tracked and busted a Chicago Anon (_ <packetnull@...il.com>)
• Re: Stakeout: how the FBI tracked and busted a Chicago Anon (Sebastian Rakowski <seb3255@...il.com>)
• LSE-2012-03-01: PyPAM -- Python bindings for PAM - Double Free Corruption (Markus Vervier <markus.vervier@...xperts.de>)
• Re: Stakeout: how the FBI tracked and busted a Chicago Anon (Kyle Creyts <kyle.creyts@...il.com>)
• [Announcement] Call For Papers: OWASP InfoSec India Conference 2012 (d3v1l ! <d3v1l@...com>)
• List Charter (John Cartwright <johnc@...k.org.uk>)
• power of this list.. (RandallM <randallm@...mail.com>)
• LulzSec $ Sabu - lessons learned ("Mikhail A. Utin" <mutin@...monwealthcare.org>)
• Re: LulzSec $ Sabu - lessons learned (夜神　岩男 <supergiantpotato@...oo.co.jp>)
• EGRC (formerly EITC) 2012 Save The Date (June 12th-14th, 2012) (larry Cashdollar <larry0@...com>)
• Re: Stakeout: how the FBI tracked and busted a Chicago Anon (Dave <mrx@...pergander.org.uk>)

• Windows Credentials Editor (WCE) v1.3beta 32bit release (Amplia Security Research <research@...liasecurity.com>)
• The Mystery of the Duqu Framework (fd@...erted.net)
• Re: The Mystery of the Duqu Framework (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• Re: The Mystery of the Duqu Framework (Laurelai <laurelai@...echan.org>)
• Re: The Mystery of the Duqu Framework (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• Re: The Mystery of the Duqu Framework (Laurelai <laurelai@...echan.org>)
• Re: The Mystery of the Duqu Framework (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• Re: The Mystery of the Duqu Framework (Laurelai <laurelai@...echan.org>)
• Re: The Mystery of the Duqu Framework (夜神　岩男 <supergiantpotato@...oo.co.jp>)
• [SECURITY] [DSA 2430-1] python-pam security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: [SECURITY] [DSA 2430-1] python-pam security update (John Favorite <john.favorite@...il.com>)
• Re: The Mystery of the Duqu Framework (Laurelai <laurelai@...echan.org>)
• Re: The Mystery of the Duqu Framework (William Pitcock <nenolod@...teminplace.net>)
• Re: The Mystery of the Duqu Framework (Laurelai <laurelai@...echan.org>)
• Re: The Mystery of the Duqu Framework (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• Re: The Mystery of the Duqu Framework (William Pitcock <nenolod@...teminplace.net>)
• Re: The Mystery of the Duqu Framework (Christian Sciberras <uuf6429@...il.com>)

• Re: The Mystery of the Duqu Framework (coderman <coderman@...il.com>)
• Re: The Mystery of the Duqu Framework (coderman <coderman@...il.com>)
• Re: The Mystery of the Duqu Framework (Valdis.Kletnieks@...edu)
• Re: The Mystery of the Duqu Framework (coderman <coderman@...il.com>)
• Re: The Mystery of the Duqu Framework (coderman <coderman@...il.com>)
• Re: The Mystery of the Duqu Framework (William Pitcock <nenolod@...teminplace.net>)
• Re: Welcome Back IRL (coderman <coderman@...il.com>)
• Re: Circumventing NAT via UDP hole punching. (coderman <coderman@...il.com>)
• Re: power of this list.. (coderman <coderman@...il.com>)
• Re: The Mystery of the Duqu Framework (夜神　岩男 <supergiantpotato@...oo.co.jp>)
• [SECURITY] [DSA 2431-1] libdbd-pg-perl security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: The Mystery of the Duqu Framework (Alberto Fabiano <alberto@...puter.org>)
• Re: The Mystery of the Duqu Framework (Alberto Fabiano <alberto@...puter.org>)
• Re: The Mystery of the Duqu Framework (coderman <coderman@...il.com>)
• coverity (coderman <coderman@...il.com>)
• Re: Circumventing NAT via UDP hole punching. (Valdis.Kletnieks@...edu)
• Multiple vulnerabilities in EJBCA ("MustLive" <mustlive@...security.com.ua>)

• Re: coverity (Jeffrey Walton <noloader@...il.com>)
• Aurora WebOPAC SQL Injection - Security Advisory - SOS-12-004 ("Lists" <lists@...seofsecurity.com>)
• Why a Computer Programming *History* Class is Needed Re: The Mystery of the Duqu Framework (dr_250@...hmail.com)
• audio may be NSFW...just something I've been playing with (Andrew King <aking1012.com@...il.com>)
• [SECURITY] [DSA 2432-1] libyaml-libyaml-perl security update (Moritz Muehlenhoff <jmm@...ian.org>)

• [Announcement] ClubHack Magazine Issue 26, March 2012 Released (Abhijeet Patil <getabhijeetpatil@...il.com>)
• [iputils] Integer overflow in iputils ping/ping6 tools (Christophe Alladoum <Christophe.Alladoum@....fr>)
• QR code and the jester (Fatherlaptop <fatherlaptop@...il.com>)
• Re: QR code and the jester (not here <zpamh0l3@...il.com>)
• GrrCON 2012: Grand Rapids, MI - Sept 27-28 (<cfp@...con.org>)
• pentesting market (Krzysztof Marczyk <krzysztof.marczyk@...tware.com.pl>)
• Re: QR code and the jester (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• Re: [iputils] Integer overflow in iputils ping/ping6 tools (Marcus Meissner <meissner@...e.de>)
• Multiple vulnerabilities in ZyXel GS1510 web front end (upsploit advisories <upsploitadvisories@...ploit.com>)
• Re: [iputils] Integer overflow in iputils ping/ping6 tools ("James Condron" <james@...o-internet.org.uk>)
• Re: [iputils] Integer overflow in iputils ping/ping6 tools (Jeffrey Walton <noloader@...il.com>)

• Re: [iputils] Integer overflow in iputils ping/ping6 tools (Gage Bystrom <themadichib0d@...il.com>)
• Re: [iputils] Integer overflow in iputils ping/ping6 tools (paul.szabo@...ney.edu.au)
• Re: The Mystery of the Duqu Framework (evilrabbi <evilrabbi@...il.com>)
• Re: The Mystery of the Duqu Framework (Marco Ermini <marco.ermini@...il.com>)
• Re: [iputils] Integer overflow in iputils ping/ping6 tools (Darius Jahandarie <djahandarie@...il.com>)
• Re: [iputils] Integer overflow in iputils ping/ping6 tools (Frankie Cutlass <frankiecutlass12@...il.com>)
• Re: [iputils] Integer overflow in iputils ping/ping6 tools (Ferenc Kovacs <tyra3l@...il.com>)
• Drupal 7.x Search Module - Full Path Disclosure (Ursu Mihail <mishka.ursu@...oo.com>)
• Re: Drupal 7.x Search Module - Full Path Disclosure (David Flores <dmousex@...il.com>)
• Re: Drupal 7.x Search Module - Full Path Disclosure (Ferenc Kovacs <tyra3l@...il.com>)
• Re: Drupal 7.x Search Module - Full Path Disclosure (Christian Sciberras <uuf6429@...il.com>)
• Re: Drupal 7.x Search Module - Full Path Disclosure (Roger <rnodal@...il.com>)
• Cisco Security Advisory: Cisco ASA 5500 Series Adaptive Security Appliance Clientless VPN ActiveX Control Remote Code … (Cisco Systems Product Security Incident…)
• Cisco Security Advisory: Cisco Firewall Services Module Crafted Protocol Independent Multicast Message Denial of Servi… (Cisco Systems Product Security Incident…)
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Cata… (Cisco Systems Product Security Incident…)
• [Security-news] SA-CONTRIB-2012-036 - Multiple Modules Unsupported (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-037 - Slidebox - access bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-038 - Views Language Switcher Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-039 - Language Icons - Cross Site Scripting (XSS) (security-news@...pal.org)
• Re: [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution (InterN0T Advisories <advisories@...ern0t.net>)
• Re: [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution (InterN0T Advisories <advisories@...ern0t.net>)
• [Security-news] SA-CONTRIB-2012-041 - Fancy Slide - Cross Site Scripting (XSS) (security-news@...pal.org)
• Oracle Exadata Infiniband Switch default logins and world readable shadow file (larry Cashdollar <larry0@...com>)

• Informations about old Sun-java-System-Web-Server/7.0 (Cédric Jeanneret <disclosure@...gu.ch>)
• Re: [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution (Greg Knaddison <greg.knaddison@...uia.com>)
• Earth to Facebook ("J. Oquendo" <sil@...iltrated.net>)
• SEC Consult SA-20120315-0 :: Multiple permanent XSS vulnerabilities in EMC Documentum eRoom (SEC Consult Vulnerability Lab <research@...-consult.com>)
• ZDI-12-044 : Microsoft Remote Desktop Protocol Channel Abort Condition Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• [SECURITY] [DSA 2433-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
• AST-2012-002: Remote Crash Vulnerability in Milliwatt Application ("Asterisk Security Team" <security@...erisk.org>)
• AST-2012-003: Stack Buffer Overflow in HTTP Manager ("Asterisk Security Team" <security@...erisk.org>)
• nSense-2012-001: Citrix License Server (Henri Lindberg <henri+fulldisclosure@...nse.fi>)

• [Announcement] ClubHack Mag - Call for Articles (Abhijeet Patil <getabhijeetpatil@...il.com>)
• VMSA-2012-0004 VMware View privilege escalation and cross-site scripting (VMware Security Team <security@...are.com>)
• VMSA-2012-0005 VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, ESXi and ESX address seve… (VMware Security Team <security@...are.c…)
• [ MDVSA-2012:029 ] pidgin (security@...driva.com)
• Re: Oracle Exadata Infiniband Switch default logins and world readable shadow file (Alex Buie <abuie@...services.com>)
• Microsoft Bing - Editor Flash Component Vulnerability (Research <research@...nerability-lab.com>)
• JPM Article Script 6 - SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
• ms12-020 PoC (kyle kemmerer <krkemmerer@...il.com>)
• is my ISP lying or stupid? ("Jerry dePriest" <jerryde@...net>)
• Re: is my ISP lying or stupid? (Julius Kivimäki <julius.kivimaki@...il.com>)
• Re: ms12-020 PoC ("Exibar" <exibar@...lair.com>)
• Re: is my ISP lying or stupid? (rancor <therancor@...il.com>)
• Re: ms12-020 PoC (Ian Hayes <cthulhucalling@...il.com>)
• Re: ms12-020 PoC (root <root_@...ertel.com.ar>)
• Re: ms12-020 PoC ("Exibar" <exibar@...lair.com>)
• [ MDVSA-2012:030 ] systemd (security@...driva.com)
• Re: ms12-020 PoC (kyle kemmerer <krkemmerer@...il.com>)
• Re: is my ISP lying or stupid? ("James Condron" <james@...o-internet.org.uk>)
• Re: [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution (InterN0T Advisories <advisories@...ern0t.net>)
• Re: is my ISP lying or stupid? (Valdis.Kletnieks@...edu)
• Re: [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution (Greg Knaddison <greg.knaddison@...uia.com>)

• Re: is my ISP lying or stupid? (Nick FitzGerald <nick@...us-l.demon.co.uk>)
• Re: is my ISP lying or stupid? (gold flake <ptinstructor@...il.com>)
• Re: Oracle Exadata Infiniband Switch default logins and world readable shadow file (larry Cashdollar <larry0@...com>)
• Re: is my ISP lying or stupid? (Peter Maxwell <peter@...icient.co.uk>)
• [ MDVSA-2012:031 ] firefox (security@...driva.com)
• Re: is my ISP lying or stupid? ("Thor (Hammer of God)" <thor@...merofgod.com>)

• Re: Earth to Facebook (crazy frog crazy frog <i.m.crazy.frog@...il.com>)
• Apache Tomcat Remote Exploit (PUT request) and Account Scanner ("HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>)
• PenTest Market - All about pentesting business (Krzysztof Marczyk <krzysztof.marczyk@...tware.com.pl>)
• Re: ms12-020 PoC (Julius Kivimäki <julius.kivimaki@...il.com>)
• Re: ms12-020 PoC (Nahuel Grisolía <nahuel.grisolia@...il.com>)
• Re: ms12-020 PoC (Thomas Richards <g13net@...il.com>)
• Re: ms12-020 PoC (Chris L <inchcombec@...il.com>)
• Re: ms12-020 PoC (Nahuel Grisolía <nahuel.grisolia@...il.com>)
• Re: is my ISP lying or stupid? (Dave <iryshman@...il.com>)
• Re: ms12-020 PoC (Adrián <adlt@....es>)
• Re: ms12-020 PoC (Shawn <citypw@...il.com>)
• ms12-020 new poc (yuri goncalves soares <yuri@....com.br>)
• c0c0n 2012 - Call For Papers and Call For Workshops (Yashartha Chaturvedi <yashartha@...il.com>)
• Re: is my ISP lying or stupid? (Peter Maxwell <peter@...icient.co.uk>)
• Re: Earth to Facebook (Ferenc Kovacs <tyra3l@...il.com>)
• Re: Fw: Earth to Facebook (upsploit advisories <upsploitadvisories@...ploit.com>)
• Re: ms12-020 new poc (Mario Vilas <mvilas@...il.com>)
• Re: is my ISP lying or stupid? (Valdis.Kletnieks@...edu)
• Re: Earth to Facebook (Jeffrey Walton <noloader@...il.com>)
• Re: is my ISP lying or stupid? (James Condron <james@...o-internet.org.uk>)
• Re: ms12-020 PoC ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: ms12-020 PoC ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: ms12-020 PoC ("James Condron" <james@...o-internet.org.uk>)
• Re: ms12-020 new poc (Huzeyfe ÖNAL(BGA) <huzeyfe@...eoverip.net>)
• Re: ms12-020 PoC ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Android wipe unreliable (Jan Schejbal <jan.mailinglisten@...glemail.com>)
• Re: is my ISP lying or stupid? (Lee <ler762@...il.com>)
• Re: Earth to Facebook ("Zach C." <fxchip@...il.com>)
• Re: Fw: Earth to Facebook (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: Fw: Earth to Facebook (upsploit advisories <upsploitadvisories@...ploit.com>)
• Re: Fw: Earth to Facebook ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: Fw: Earth to Facebook (upsploit advisories <upsploitadvisories@...ploit.com>)
• Re: ms12-020 PoC (Nahuel Grisolia <nahuel.grisolia@...il.com>)

• Re: Android wipe unreliable (Jeffrey Walton <noloader@...il.com>)
• Re: Android wipe unreliable (Robert Kim App and Facebook Marketing <evdo.hsdpa@...il.com>)
• DC4420 - London DEFCON - March Meet - Tuesday 20th March 2012 (Major Malfunction <majormal@...ate-radio.org>)
• LiteSpeed <= 4.1.11 Admin panel XSS (pathric due <bugybu@...il.com>)
• Re: Fw: Earth to Facebook (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: The Mystery of the Duqu Framework (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)

• Re: The Mystery of the Duqu Framework (Mario Vilas <mvilas@...il.com>)
• Re: The Mystery of the Duqu Framework (Valdis.Kletnieks@...edu)
• Re: The Mystery of the Duqu Framework (Andrew King <aking1012.com@...il.com>)
• [SECURITY] [DSA 2436-1] libapache2-mod-fcgid security update (Thijs Kinkhorst <thijs@...ian.org>)
• [SECURITY] [DSA 2434-1] nginx security update (Luciano Bello <luciano@...ian.org>)
• CVE-2012-1201 Testtrack for Linux Racecondition ("Simon ." <bofh666ftw@...glemail.com>)
• [SECURITY] [DSA 2435-1] gnash security update (Gabriele Giacone <1o5g4r8o@...il.com>)
• Android FTPServer 1.9.0 Remote DoS (Thomas Richards <g13net@...il.com>)
• FreePBX remote command execution, xss ("Martin Tschirsich" <tschirsi@....informatik.tu-darmstadt.de>)
• Penetration testing business (Krzysztof Marczyk <krzysztof.marczyk@...tware.com.pl>)
• [ MDVSA-2012:032 ] mozilla (security@...driva.com)
• CA20120320-01: Security Notice for CA ARCserve Backup ("Kotas, Kevin J" <Kevin.Kotas@...com>)

• Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1 (Security <security@...ynamics.com>)
• Re: is my ISP lying or stupid? (_ <packetnull@...il.com>)
• Shakacon 2012 - CFP Deadline Approaching ("Shakacon" <info@...kacon.org>)
• [ MDVSA-2012:033 ] libpng (security@...driva.com)
• Seeker Advisory: Insecure Redirect in .NET Form Authentication - Redirect From Login Mechanism (ReturnURL Parameter) ("Irene Abezgauz" <irene@...kersec.com>)
• DarkComet - syrian revolution trojan analysis and author interview ("Adam Behnke" <adam@...osecinstitute.com>)
• Re: is my ISP lying or stupid? (Giles Coochey <giles@...chey.net>)
• Re: is my ISP lying or stupid? ("Thor (Hammer of God)" <thor@...merofgod.com>)
• [Security-news] SA-CONTRIB-2012-042 - Wishlist Cross Site Scripting (XSS) (security-news@...pal.org)
• [SECURITY] [DSA 2437-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)

• atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour (William Pitcock <nenolod@...eferenced.org>)
• Minify and related plugins DOM-Based XSS Vulnerability (Ayoub Aboukir <ay.aboukir@...il.com>)
• [CVE-2012-0047] Apache Wicket XSS vulnerability via pageMapName request parameter (Martin Grigorov <mgrigorov@...che.org>)
• [CVE-2012-1089] Apache Wicket serving of hidden files vulnerability (Martin Grigorov <mgrigorov@...che.org>)
• CVE-2012-0037: OpenOffice.org data leakage vulnerability (Rob Weir <robweir@...che.org>)
• [SECURITY] [DSA 2438-1] raptor security update (Moritz Muehlenhoff <jmm@...ian.org>)
• CarolinaCon-8 (May 2012): General Announcement - Chosen Presenters and Topics - Side Event List (Vic Vandal <vvandal@...l.com>)
• [SECURITY] [DSA 2439-1] libpng security update (Moritz Muehlenhoff <jmm@...ian.org>)

• [ MDVSA-2012:034 ] libzip (security@...driva.com)
• [ MDVSA-2012:035 ] file (security@...driva.com)
• 'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670) (Mark Stanislav <mark.stanislav@...il.com>)
• 'phpMoneyBooks' Local File Inclusion (CVE-2012-1669) (Mark Stanislav <mark.stanislav@...il.com>)
• [ANNOUNCE] Apache Traffic Server releases for security incident CVE-2012-0256 (Leif Hedstrom <zwoop@...che.org>)
• Re: is my ISP lying or stupid? (Alex Buie <abuie@...services.com>)
• Apple IOS security issue pre-advisory record (john doe <ninjaobsessed@...il.com>)
• Re: Apple IOS security issue pre-advisory record (adam <adam@...sy.net>)
• [ MDVSA-2012:036 ] libsoup (security@...driva.com)
• [ MDVSA-2012:037 ] cyrus-imapd (security@...driva.com)
• Re: Apple IOS security issue pre-advisory record (john doe <ninjaobsessed@...il.com>)
• Re: Apple IOS security issue pre-advisory record (Gary Baribault <gary@...ibault.net>)
• Re: Apple IOS security issue pre-advisory record (adam <adam@...sy.net>)
• Re: Apple IOS security issue pre-advisory record (Dave <mrx@...pergander.org.uk>)
• Re: Apple IOS security issue pre-advisory record (Michal Zalewski <lcamtuf@...edump.cx>)

• Re: Apple IOS security issue pre-advisory record (Valdis.Kletnieks@...edu)
• Re: Apple IOS security issue pre-advisory record (Dave <mrx@...pergander.org.uk>)
• Re: Apple IOS security issue pre-advisory record (Dave <mrx@...pergander.org.uk>)
• Re: Apple IOS security issue pre-advisory record (rackow@....gov)
• Permanent XSS on the nuit du hack webmail service (klondike <klondike@...cosoft.es>)
• Re: Oracle based personal data dumping attack on the nuit du hack CTF (klondike <klondike@...cosoft.es>)
• Re: Apple IOS security issue pre-advisory record (Valdis.Kletnieks@...edu)
• Re: Apple IOS security issue pre-advisory record (Dave <mrx@...pergander.org.uk>)
• Re: Apple IOS security issue pre-advisory record (john doe <ninjaobsessed@...il.com>)
• Re: Apple IOS security issue pre-advisory record (Valdis.Kletnieks@...edu)
• CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) (VSR Advisories <advisories@...curity.com>)
• Re: Apple IOS security issue pre-advisory record (Dave <mrx@...pergander.org.uk>)
• [SECURITY] [DSA 2440-1] libtasn1-3 security update (Florian Weimer <fw@...eb.enyo.de>)

• Shopping For Zero-Days: A Price List For Hackers' Secret Software Exploits (Jeffrey Walton <noloader@...il.com>)
• [SECURITY] [DSA 2441-1] gnutls26 security update (Florian Weimer <fw@...eb.enyo.de>)
• Brute Force vulnerability in WordPress ("MustLive" <mustlive@...security.com.ua>)
• Re: Brute Force vulnerability in WordPress (InterN0T Advisories <advisories@...ern0t.net>)
• Re: Brute Force vulnerability in WordPress (Christopher Truncer <CTruncer@...istophertruncer.com>)

• Re: Brute Force vulnerability in WordPress ("Zach C." <fxchip@...il.com>)
• Re: Brute Force vulnerability in WordPress ("Thor (Hammer of God)" <thor@...merofgod.com>)
• PcwRunAs Password Obfuscation Design Flaw (otr@...kcay.de)
• Re: Oracle based personal data dumping attack on the nuit du hack CTF (Damien Cauquil <d.cauquil@...dream.com>)
• Re: Apple IOS security issue pre-advisory record (IA64 LOL <ia64lol@...il.com>)
• Re: Apple IOS security issue pre-advisory record (Charlie Derr <cderr@...ons-rock.edu>)
• vBulletin vBShout Module <= 6.0.5 (vbshout.php?message=) - Reflected Cross-Site Scripting ( XSS ) & HTML Injection (d3v1l <d3v1l.securityshell@...il.com>)
• Re: Oracle based personal data dumping attack on the nuit du hack CTF (majinboo <majinboo@...kerzvoice.net>)
• Re: Apple IOS security issue pre-advisory record (Valdis.Kletnieks@...edu)
• The Best of PenTest (Maciej Kozuszek <maciej.kozuszek@...tware.com.pl>)
• Mexican Drug Cartels and Cyberspace ("Adam Behnke" <adam@...osecinstitute.com>)
• Re: Mexican Drug Cartels and Cyberspace (Valdis.Kletnieks@...edu)
• Re: Mexican Drug Cartels and Cyberspace (metasansana@...il.com)
• Re: Mexican Drug Cartels and Cyberspace (Dave <mrx@...pergander.org.uk>)
• Re: Mexican Drug Cartels and Cyberspace (Valdis.Kletnieks@...edu)
• Re: Mexican Drug Cartels and Cyberspace ("Thor (Hammer of God)" <thor@...merofgod.com>)
• [ MDVSA-2012:038 ] openssl (security@...driva.com)
• Re: Apple IOS security issue pre-advisory record (fulldisclosure@...aeros007.org)
• Re: Apple IOS security issue pre-advisory record ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: Apple IOS security issue pre-advisory record (Aaron Toponce <aaron.toponce@...il.com>)
• Re: Apple IOS security issue pre-advisory record (coderman <coderman@...il.com>)
• [SECURITY] [DSA 2442-1] openarena security update (Florian Weimer <fw@...eb.enyo.de>)
• Congress Capitulates To TSA; Refuses To Let Bruce Schneier Testify ("Ivan .Heca" <ivanhec@...il.com>)

• [PRE-SA-2012-02] Incorrect loop construct and numeric overflow in libzip (Timo Warns <Warns@...-Sense.DE>)
• FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution (foo net <foonet@...mail.com>)
• [SECURITY] [DSA 2443-1] linux-2.6 security update (dann frazier <dannf@...ian.org>)
• Please do not take down the Sality botnet (lawabidingcitizen@....hush.com)
• [ MDVSA-2012:039 ] libtasn1 (security@...driva.com)
• WordPress plugin 'WordPress Integrator 1.32' XSS vulnerability (Stefan Schurtz <sschurtz@...nline.de>)
• Re: WordPress plugin 'WordPress Integrator 1.32' XSS vulnerability (Christian Sciberras <uuf6429@...il.com>)
• Re: Full-Disclosure SALTY (Fatherlaptop <fatherlaptop@...il.com>)
• [ MDVSA-2012:040 ] gnutls (security@...driva.com)
• Re: Oracle based personal data dumping attack on the nuit du hack CTF (klondike <klondike@...cosoft.es>)
• [ MDVSA-2012:041 ] expat (security@...driva.com)
• Re: CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) (VSR Advisories <advisories@...curity.com>)

• SEC Consult SA-20120328-0 :: F5 FirePass SSL VPN unauthenticated remote root through SQL injection - CVE-2012-1777 (SEC Consult Vulnerability Lab <research@sec…)
• SEC Consult SA-20120328-1 :: Microsoft ASP.NET Forms Authentication Bypass - follow-up advisory - CVE-2011-3416 (SEC Consult Vulnerability Lab <research@...-co…)
• Re: PcwRunAs Password Obfuscation Design Flaw ("b" <b@...isoryalerts.com>)
• Re: CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) (Solar Designer <solar@...nwall.com>)
• Re: Please do not take down the Sality botnet (Jason Hellenthal <jhellenthal@...aix.net>)
• [ MDVSA-2012:042 ] wireshark (security@...driva.com)
• Re: PcwRunAs Password Obfuscation Design Flaw ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: PcwRunAs Password Obfuscation Design Flaw (Jeffrey Walton <noloader@...il.com>)
• Local File Inclusion Vulnerability in TomatoCart (Netsparker Advisories <advisories@...itunasecurity.com>)
• Cisco Security Advisory: Cisco IOS Software Command Authorization Bypass (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Cisco IOS Software RSVP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Cisco IOS Software Smart Install Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
• Cisco Security Advisory: Cisco IOS Software Reverse SSH Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
• Cisco Security Advisory: Cisco IOS Software Zone-Based Firewall Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Cisco IOS Internet Key Exchange Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco IOS Software Traffic Optimization Features (Cisco Systems Product Security Incident Response Team <p…)
• Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Cisco IOS Software Multicast Source Discovery Protocol Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@cis…)
• Re: PcwRunAs Password Obfuscation Design Flaw (Valdis.Kletnieks@...edu)
• XSS and BF vulnerabilities in WordPress ("MustLive" <mustlive@...security.com.ua>)
• [Security-news] SA-CONTRIB-2012-043 - MultiBlock - Cross Site Scripting (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-044 - Contact Forms - Cross Site Scripting (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-045 - AddToAny - Cross Site Scripting (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-047 - Ubercart Views - Information disclosure (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-046 - Bundle Copy - Arbitrary Code execution (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-048 - Contact Save - Cross Site Scripting (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-049 - ShareThis - Multiple Vulnerablies (security-news@...pal.org)
• Re: Brute Force vulnerability in WordPress ("MustLive" <mustlive@...security.com.ua>)
• [Security-news] SA-CONTRIB-2012-050 - CDN2 Video - Unsupported (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-053 - Organic Groups - Access Bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-054 - Chaos tool suite - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-051 - Activity - Multiple Vulnerablities (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-052 - Node Limit Number - Cross Site Request Forgery (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-055 - Fusion theme - Cross Site Scripting (XSS) (security-news@...pal.org)
• Re: Brute Force vulnerability in WordPress (Christian Sciberras <uuf6429@...il.com>)
• Re: [Security-news] SA-CONTRIB-2012-051 - Activity - Multiple Vulnerablities ("Justin C. Klein Keane" <justin@...irish.net>)
• [Spanish-Offtopic] - Desarrollo de Exploits (runlvl <runlvl@...il.com>)

• [SECURITY] [DSA 2444-1] tryton-server security update (Florian Weimer <fw@...eb.enyo.de>)
• Re: Please do not take down the Sality botnet (Borys Madry <e448953_74@...pl>)
• B2Evolution CMS 4.1.3 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Barracuda Cloud CC v3.04.015 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Skype 5.8x 5.5x - Corruption & Persistent Vulnerability (Research <research@...nerability-lab.com>)
• Apple Website Service - SQL Injection Vulnerabilities (Research <research@...nerability-lab.com>)
• OWASP AppSec Research EU CFP/CFT (OWASP AppSec EU <appseceu@...sp.org>)
• Re: PcwRunAs Password Obfuscation Design Flaw ("b" <b@...isoryalerts.com>)
• Re: PcwRunAs Password Obfuscation Design Flaw (Christian Sciberras <uuf6429@...il.com>)
• Re: PcwRunAs Password Obfuscation Design Flaw (夜神　岩男 <supergiantpotato@...oo.co.jp>)
• [ MDVSA-2012:043 ] nginx (security@...driva.com)
• [ MDVSA-2012:044 ] cvs (security@...driva.com)
• Cross-site scripting vulnerability in Invision Power Board version 3.2.3 (Netsparker Advisories <advisories@...itunasecurity.com>)
• Multiple PTK DFlabs failures to restrict access to sensitive data (SecBugs <secbugs@...il.com>)
• Re: [Security-news] SA-CONTRIB-2012-051 - Activity - Multiple Vulnerablities (Greg Knaddison <greg.knaddison@...uia.com>)
• New XSS vulnerabilities in Register Plus Redux for WordPress ("MustLive" <mustlive@...security.com.ua>)

• VMSA-2012-0006 VMware ESXi and ESX address several security issues (VMware Security Team <security@...are.com>)
• Bitsmith PS Knowbase 3.2.3 - Buffer Overflow Vulnerability (Research <research@...nerability-lab.com>)
• [ MDVSA-2012:045 ] gnutls (security@...driva.com)
• PHP 5.4/5.3 deprecated eregi() memory_limit bypass (Maksymilian Arciemowicz <cxib@...ecurity.com>)

• Landshop v0.9.2 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• [SECURITY] [DSA 2445-1] typo3-src security update (Florian Weimer <fw@...eb.enyo.de>)
• [SECURITY] [DSA 2442-2] openarena regression (Florian Weimer <fw@...eb.enyo.de>)
• [SECURITY] [DSA 2398-2] curl regression (Florian Weimer <fw@...eb.enyo.de>)
• Compromised VPN provider out there? ("T" <fulldisc@....hu>)
• IPv6 stable privacy addresses (Fernando Gont <fgont@...networks.com>)
• Re: Android wipe unreliable (Jeffrey Walton <noloader@...il.com>)

388 messages

Powered by blists - more mailing lists