bugtraq mailing list - 2010/02

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2010/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 21	² 16	³ 10	⁴ 8	⁵ 11	⁶	⁷
⁸ 22	⁹ 18	¹⁰ 9	¹¹ 10	¹² 9	¹³	¹⁴
¹⁵	¹⁶ 22	¹⁷	¹⁸ 14	¹⁹ 20	²⁰	²¹
²²	²³ 20	²⁴ 14	²⁵ 6	²⁶ 6	²⁷	²⁸

Messages by day:

February 1 (21 messages)

[SECURITY] [DSA 1982-1] New hybserv packages fix denial of service (white@...ian.org (Steffen Joeris))
eWebeditor ASP Version Multiple Vulnerabilities (info@...uritylab.ir)
[SECURITY] [DSA 1841-2] New git-core packages fix build failure (Thijs Kinkhorst <thijs@...ian.org>)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies ("Timothy D. Morgan" <tmorgan@...curity.com>)
iPhone certificate flaws (cryptopath@...il.com)
Advisory: jBCrypt < 0.3 character encoding vulnerability (Damien Miller <djm@...drot.org>)
Cross-Site History Manipulation (XSHM) ("Alex Roichman" <Alexr@...ckmarx.com>)
Tavanmand Portal (fckeditor) Remote Arbitrary File Upload Vulnerability (info@...uritylab.ir)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies ("Arian J. Evans" <arian.evans@...chronic.com>)
{PRL} Xerox Workcenter 4150 Remote Buffer Overflow (Francis Provencher <francisprovencher@...tekresearchlab.com>)
[TKADV2010-001] Oracle Solaris UCODE_GET_VERSION IOCTL Kernel NULL Pointer Dereference (Tobias Klein <tk@...pkit.de>)
Security Advisory for Bugzilla 3.0.10, 3.2.5, 3.4.4, and 3.5.2 (mkanat@...zilla.org)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies ("Timothy D. Morgan" <tmorgan@...curity.com>)
VMSA-2010-0002 VMware vCenter update release addresses multiple security issues in Java JRE (VMware Security Team <security@...are.com>)
Re: Cross-Site History Manipulation (XSHM) (Michal Zalewski <lcamtuf@...edump.cx>)
iDefense Security Advisory 02.01.10: RealNetworks RealPlayer CMediumBlockAllocator Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
XSS vulnerability in Drupal's MP3 Player contributed module (version 6.x-1.0-beta1) (Martin Barbella <martybarbella@...il.com>)
iDefense Security Advisory 02.01.10: Real Networks RealPlayer Compressed GIF Handling Integer Overflow (iDefense Labs <labs-no-reply@...fense.com>)
[CORE-2010-0106] Cisco Secure Desktop XSS/JavaScript Injection (Core Security Technologies Advisories <advisories@...esecurity.com>)
Joomla (com_gambling) SQL Injection Vulnerabilities (md.r00t.defacer@...il.com)
[ MDVSA-2010:030 ] kernel (security@...driva.com)

February 2 (16 messages)

iDefense Security Advisory 02.01.10: RealNetworks RealPlayer 11 HTTP Chunked Encoding Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies ("Timothy D. Morgan" <tmorgan@...curity.com>)
[SECURITY] [DSA 1983-1] New Wireshark packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[CORE-2009-1126] Corel Paint Shop Pro Photo X2 FPX Heap Overflow (CORE Security Technologies Advisories <advisories@...esecurity.com>)
RaakCms Multiple Vulnerabilities (info@...uritylab.ir)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies (Chris Travers <chris@...atrontech.com>)
[SECURITY] [DSA 1984-1] New libxerces2-java packages fix denial of service (Giuseppe Iuculano <iuculano@...ian.org>)
[SECURITY] [DSA 1985-1] New sendmail packages fix SSL certificate verification weakness (Giuseppe Iuculano <iuculano@...ian.org>)
360 Security Guard breg device drivers Privilege Escalation Vulnerabilitie (qiqiguaiguai@...il.com)
[security bulletin] HPSBUX02464 SSRT090210 rev.1 - HP Enterprise Cluster Master Toolkit (ECMT) running on HP-UX, Local (security-alert@...com)
Remote Vulnerability in AIX RPC.cmsd released by iDefense ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
Tinypug Multiple Vulnerabilities (admin@...report.ir)
[SECURITY] [DSA 1987-1] New lighttpd packages fix denial of service (Nico Golde <nion@...ian.org>)
OpenCart CSRF Vulnerability (ben@...ionsource.org)
[security bulletin] HPSBUX02479 SSRT090212 rev.1 - HP-UX running HP CIFS Server (Samba), Remote Unauthorized Access (security-alert@...com)
[SECURITY] [DSA 1986-1] New moodle packages fix several vulnerabilities (white@...ian.org (Steffen Joeris))

February 3 (10 messages)

[security bulletin] HPSBOV02505 SSRT100023 rev.1 - HP OpenVMS RMS, Local Escalation of Privilege (security-alert@...com)
AST-2010-001: T.38 Remote Crash Vulnerability ("Asterisk Security Team" <security@...erisk.org>)
[SECURITY] [DSA-1988-1] New qt4-x11 packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
[SECURITY] [DSA-1989-1] New fuse packages fix denial of service (Giuseppe Iuculano <iuculano@...ian.org>)
[ MDVSA-2010:031 ] wireshark (security@...driva.com)
[CSO10002] Attachment path traversal in Outlook Web Access ("Ricardo Martins - Chief Security Officers" <ricardo.martins@....pt>)
[Suspected Spam]Hackito Ergo Sum 2010 - Call For Paper - HES2010 CFP (Philippe Mailinglist <philippe.mailinglist@...il.com>)
[Hellcode Research]: AOL 9.5 File Parsing Buffer Overflow Vulnerability (karakorsankara@...mail.com)
CORE-2009-0625: Internet Explorer Dynamic OBJECT tag and URLMON sniffing vulnerabilities (Core Security Technologies Advisories <advisories@...esecurity.com>)
[DSECRG-09-011] HP StorageWorks 1_8 G2 Tape Autoloader - privilege escalation DOS (Alexandr Polyakov <alexandr.polyakov@...c.ru>)

February 4 (8 messages)

[SECURITY] [DSA-1990-1] New trac-git packages fix code execution (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBMA02504 SSRT090220 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting … (security-alert@...com)
[SECURITY] [DSA-1990-2] New trac-git package fixes regression (Stefan Fritsch <sf@...ian.org>)
[SECURITY] [DSA 1991-1] New squid/squid3 packages fix denial of service (white@...ian.org (Steffen Joeris))
Re: Multiple vulnerabilities in XAMPP (advisory #7) ("MustLive" <mustlive@...security.com.ua>)
[MajorSecurity Advisory #64]Apple Safari 4.0.4 Denial of Service (david@...orsecurity.info)
[ MDVSA-2010:032 ] rootcerts (security@...driva.com)
[SECURITY] [DSA 1992-1] New chrony packages fix denial of service (Nico Golde <nion@...ian.org>)

February 5 (11 messages)

CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03 (Peter Van Eeckhoutte <peter.ve@...elan.be>)
CORELAN-10-009 : Ipswitch IMAIL 11.01 multiple vulnerabilities (reversible encryption + weak ACL) (Security <security@...elan.be>)
CORE-2010-0104 - LANDesk OS command injection (CORE Security Technologies Advisories <advisories@...esecurity.com>)
JAHx101 - Huski retail mulitple SQL injection vulnerabilities (noreply@...tanotherhacker.com)
JAHx102 - HuskiCMS local file inclusion (noreply@...tanotherhacker.com)
Secunia Research: libmikmod Module Parsing Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Recon Call for Papers - July 9-11 2010 (Hugo Fortier <hfortier@...on.cx>)
Samba Remote Zero-Day Exploit (Kingcope <kcope2@...glemail.com>)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies ("Timothy D. Morgan" <tmorgan@...curity.com>)
Re: Samba Remote Zero-Day Exploit (Kingcope <kcope2@...glemail.com>)
[ MDVSA-2010:033 ] squid (security@...driva.com)

February 8 (22 messages)

[CORE-2010-0121] Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers (CORE Security Technologies Advisories <advisories@...esecurity.com>)
Re: Samba Remote Zero-Day Exploit (paul.szabo@...ney.edu.au)
Re: Multiple vulnerabilities in XAMPP (advisory #7) ("MustLive" <mustlive@...security.com.ua>)
[Suspected Spam]Vulnerability in Tagcloud for DataLife Engine ("MustLive" <mustlive@...security.com.ua>)
[DSECRG-09-065] TVUPlayer PlayerOcx.ocx ActiveX - Insecure method (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
CORELAN-10-010 - GeFest Web HomeServer v1.0 Remote Directory Traversal Vulnerability (Security <security@...elan.be>)
Re: Samba Remote Zero-Day Exploit (paul.szabo@...ney.edu.au)
LDF (Default.asp) Sql Injection Vulnerability (Arash.Setayeshi@...il.com)
Re: [Full-disclosure] Samba Remote Zero-Day Exploit (paul.szabo@...ney.edu.au)
Re: Samba Remote Zero-Day Exploit ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[MajorSecurity Advisory #65]Motorola Milestone Smartphone Denial of Service (david@...orsecurity.info)
Re: Samba Remote Zero-Day Exploit (paul.szabo@...ney.edu.au)
mongoose Space Character Remote File Disclosure Vulnerability (info@...uritylab.ir)
Re: Samba Remote Zero-Day Exploit (Dan Kaminsky <dan@...para.com>)
[security bulletin] HPSBMA02487 SSRT100024 rev.1 - HP Operations Agent Running on Solaris 10, Remote Unauthorized Access (security-alert@...com)
[security bulletin] HPSBUX02503 SSRT100019 rev.1 - HP-UX Running Java, Remote Increase in Privilege, Denial of Service and Other (security-alert@...com)
RE: Samba Remote Zero-Day Exploit ("Michael Wojcik" <Michael.Wojcik@...rofocus.com>)
[ MDVSA-2010:034 ] kernel (security@...driva.com)
Re: [Full-disclosure] Samba Remote Zero-Day Exploit (Thierry Zoller <Thierry@...ler.lu>)
Re: [Full-disclosure] Samba Remote Zero-Day Exploit (Thierry Zoller <Thierry@...ler.lu>)
Re: Samba Remote Zero-Day Exploit (Kingcope <kcope2@...glemail.com>)
Re: Samba Remote Zero-Day Exploit (Dan Kaminsky <dan@...para.com>)

February 9 (18 messages)

Re: Samba Remote Zero-Day Exploit ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[Hacking Event] Night Da Hack 2010 : Call For Proposals (m.mahdjoub@...dream.com)
JDownloader Remote Code Execution (Matthias -apoc- Hecker <apoc@...serv.org>)
Re: Samba Remote Zero-Day Exploit (paul.szabo@...ney.edu.au)
Re: Samba Remote Zero-Day Exploit ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Aruba Advisory ID: AID-020810 TLS Protocol Session Renegotiation Security Vulnerability (Robbie Gill <rgill@...banetworks.com>)
Hacktics Advisory Feb09: XSS in Oracle E-Business Suite ("Ofer Maor" <ofer.maor@...sp.org>)
ACM CCS 2010: Call for Workshop Proposals (Christopher Kruegel <chris@...ucsb.edu>)
RE: Samba Remote Zero-Day Exploit ("Michael Wojcik" <Michael.Wojcik@...rofocus.com>)
Re: [Full-disclosure] Samba Remote Zero-Day Exploit (Krzysztof Halasa <khc@...waw.pl>)
RE: Samba Remote Zero-Day Exploit (David Jacoby <David.Jacoby@...esec.se>)
#HITB - Special Report: HITB2009 CTF Weapons of Mass Destruction (Hafez Kamal <aphesz@...kinthebox.org>)
Secunia Research: Microsoft PowerPoint File Path Handling Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
CORE-2009-0827: Microsoft Office Excel / Word OfficeArtSpgr Container Pointer Overwrite Vulnerability (CORE Security Technologies Advisories <advisories@...ese…)
ZDI-10-015: Microsoft Windows RLE Video Decompressor Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-017: Microsoft Office PowerPoint Viewer TextBytesAtom Record Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-10-02: Microsoft Office PowerPoint Viewer TextCharsAtom Record Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-016: Microsoft Windows ShellExecute Improper Sanitization Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

February 10 (9 messages)

stratsec Security Advisory SS-2010-003 - Microsoft SMB Client Pool Overflow (stratsec Research <research@...atsec.net>)
[USN-898-1] gnome-screensaver vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco IronPort Encryption Appliance (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Re: [WEB SECURITY] Trustwave's SpiderLabs Security Advisory TWSL2010-001 ("Arian J. Evans" <arian.evans@...chronic.com>)
Windows SMB NTLM Authentication Weak Nonce Vulnerability (Hernan Ochoa <hernan@...il.com>)
[security bulletin] HPSBMA02484 SSRT090076 rev.1 - HP Network Node Manager (NNM), Remote Execution of Arbitrary Commands (security-alert@...com)
[USN-897-1] MySQL vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Trustwave's SpiderLabs Security Advisory TWSL2010-001 (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
[security bulletin] HPSBMA02486 SSRT090049 rev.1 - HP OpenView Network Node Manager (OV NNM) Java Runtime Environment (JRE) and Java Devel… (security-alert@...com)

February 11 (10 messages)

[SECURITY] [DSA 1993-1] New otrs2 packages fix SQL injection (Raphael Geissert <geissert@...ian.org>)
[Onapsis Security Advisory 2010-003] SAP WebDynpro Runtime XSS/CSS Injection (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2010-004] SAP J2EE Authentication Phishing Vector (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2010-002] SAP J2EE Engine MDB Path Traversal (Onapsis Research Labs <research@...psis.com>)
[ MDVSA-2010:035 ] openoffice.org (security@...driva.com)
[SECURITY] [DSA 1994-1] New ajaxterm packages fix session hijacking (Raphael Geissert <geissert@...ian.org>)
[USN-899-1] Tomcat vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
RE: Trustwave's SpiderLabs Security Advisory TWSL2010-001 (David Byrne <DByrne@...stwave.com>)
[security bulletin] HPSBPI02507 SSRT100012 rev.2 - HP DreamScreen, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMA02488 SSRT100013 rev.1 - HP ProLiant Support Pack 8.30 for Windows, Remote Code Execution, Information Disclosur… (security-alert@...com)

February 12 (9 messages)

iDefense Security Advisory 02.09.10: Microsoft PowerPoint OEPlaceholderAtom Use-After-Free Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
SQL injection vulnerability in apemCMS (Maciej Gojny <vuln@...ko-security.com>)
ChemViewX v1.9.5 ActiveX Control Mutliple Stack Overflows (Paul Craig <paul.craig@...urity-assessment.com>)
(resend) RE: [WEB SECURITY] Trustwave's SpiderLabs Security Advisory TWSL2010-001 ("Chris Weber" <chris@...abasec.com>)
e-Sentinel Security Advisory - Ref: Session Hijacking iPhone Facebook Application ver 3.1.2 (bill.robson@...entinel.com)
iDefense Security Advisory 02.09.10: Microsoft PowerPoint OEPlaceholderAtom Invalid Array Indexing Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.09.10: Microsoft PowerPoint LinkedSlideAtom Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
cmsmadesimple Multiple Security Issues : XSS+ LFI (beenudel1986@...il.com)
[security bulletin] HPSBMA02486 SSRT090049 rev.2 - HP OpenView Network Node Manager (OV NNM) Java Runtime Environment (JRE) and Java Devel… (security-alert@...com)

February 16 (22 messages)

[ MDVSA-2010:036 ] webmin (security@...driva.com)
[SECURITY] [DSA-1996-1] New Linux 2.6.26 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
RE: Trustwave's SpiderLabs Security Advisory TWSL2010-001 (David Byrne <DByrne@...stwave.com>)
[SECURITY] [DSA-1997-1] New mysql-dfsg-5.0 packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
Joomla (Jw_allVideos) Remote File Download Vulnerability (info@...uritylab.ir)
[ MDVSA-2010:037 ] fetchmail (security@...driva.com)
[USN-900-1] Ruby vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module (version 6.x-1.0) (Martin Barbella <barbella@....upenn.edu>)
Chrome Password Manager Cross Origin Weakness (CVE-2010-0556) (VSR Advisories <advisories@...curity.com>)
[USN-901-1] Squid vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Multiple Stored XSS in XOOPS 2.4.4 Admin Section (beenudel1986@...il.com)
Enomaly ECP: Multiple vulnerabilities in VMcasting protocol & implementation. (sam.johnston@....net.au)
VMSA-2010-0003 ESX Service Console update for net-snmp (VMware Security Team <security@...are.com>)
[ MDVSA-2010:038 ] maildrop (security@...driva.com)
Re: Joomla (Jw_allVideos) Remote File Download Vulnerability (lafrancevi@...il.com)
MITKRB5-SA-2010-001 [CVE-2010-0283] krb5-1.7 KDC denial of service (Tom Yu <tlyu@....edu>)
VUPEN Security Research - OpenOffice Word Document Processing Heap Overflow Vulnerabilities ("VUPEN Security Research" <advisories@...en.com>)
Pogodny CMS SQL vulnerabilities (Maciej Gojny <vuln@...ko-security.com>)
IE address bar characters into a small feature (info@...uritylab.ir)
Insomnia : ISVA-100216.1 - Windows URL Handling Vulnerability ("Brett Moore" <brett.moore@...omniasec.com>)
Huawei HG510 CSRF, Auth Bypass, DoS (ivan.markovic@...sec.rs)
Trusteer Rapport Security Circumvention (barkley@....net)

February 18 (14 messages)

Re: Enomaly ECP: Multiple vulnerabilities in VMcasting protocol & implementation. (lars@...maly.com)
Pixel Portal Sql Injection Vulnerability (info@...uritylab.ir)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances (Cisco Systems Product Security Incident Response Team <…)
Cross-Site Scriting on Portwise SSL VPN v4.6 (research <research@...checkup.com>)
Secunia Research: Mozilla Firefox Memory Corruption Vulnerability (Secunia Research <remove-vuln@...unia.com>)
ZDI-10-018: IBM Cognos Server Backdoor Account Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Cisco Security Advisory: Cisco Firewall Services Module Skinny Client Control Protocol Inspection Denial of Service Vuln… (Cisco Systems Product Security Incident…)
[ MDVSA-2010:040 ] gnome-screensaver (security@...driva.com)
[ MDVSA-2010:034-1 ] kernel (security@...driva.com)
Circumventing Critical Security in Windows XP (barkley@....net)
[ MDVSA-2010:039 ] netpbm (security@...driva.com)
[SECURITY] [DSA 1999-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-895-1] Firefox 3.0 and Xulrunner 1.9 vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[ MDVSA-2010:041 ] pidgin (security@...driva.com)

February 19 (20 messages)

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Security Agent (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SECURITY] [DSA 1998-1] New kdelibs packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2010:034-2 ] kernel (security@...driva.com)
RE: [WEB SECURITY] Trustwave's SpiderLabs Security Advisory TWSL2010-001 ("Ivan Buetler" <ivan.buetler@...c.ch>)
Re: Re: Joomla (Jw_allVideos) Remote File Download Vulnerability (info@...uritylab.ir)
BugCon 2010 Call For Papers (saintarmin@...mail.com)
RE: Trusteer Rapport Security Circumvention ("Amit Klein" <amit.klein@...steer.com>)
Kusaba X <= 0.9 XSS/CSRF vulnerabilities (systemx00@...il.com)
TLS/SSL Hardening & Compatibility Report 2010 (Thierry Zoller <Thierry@...ler.lu>)
[USN-896-1] Firefox 3.5 and Xulrunner 1.9.1 vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
SphereCMS Blind SQL Injection Vulnerability (admin@...report.ir)
[SECURITY] [DSA 2000-1] New ffmpeg packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-890-5] XML-RPC for C and C++ vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
AST-2010-002: Dialplan injection vulnerability ("Asterisk Security Team" <security@...erisk.org>)
Re: Circumventing Critical Security in Windows XP (Ansgar Wiechers <bugtraq@...netcobalt.net>)
[SECURITY] [DSA-2001-1] New php5 packages fix multiple vulnerabilities (Raphael Geissert <geissert@...ian.org>)
[SECURITY] [DSA-2002-1] New polipo packages fix denial of service (Stefan Fritsch <sf@...ian.org>)
[ MDVSA-2010:042 ] firefox (security@...driva.com)
SQL injection vulnerability in Amelia CMS (Maciej Gojny <vuln@...ko-security.com>)
Re: [Onapsis Security Advisory 2010-004] SAP J2EE Authentication Phishing Vector (david.durham@...annstores.com)

February 23 (20 messages)

[DSECRG-09-039] Symantec Antivirus 10.0 ActiveX - buffer Overflow. (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
RE: [WEB SECURITY] Trustwave's SpiderLabs Security Advisory TWSL2010-001 (David Byrne <DByrne@...stwave.com>)
SEC Consult SA-20100208-0 :: Backdoor and Vulnerabilities in Xerox WorkCentre Printers Web Interface (SEC Consult Research <research@...-consult.com>)
Secunia Research: Bournal Insecure Temporary Files Security Issue (Secunia Research <remove-vuln@...unia.com>)
CA20100222-01: Security Notice for CA Service Desk ("Kotas, Kevin J" <Kevin.Kotas@...com>)
Secunia Research: Bournal ccrypt Information Disclosure Security Issue (Secunia Research <remove-vuln@...unia.com>)
[USN-902-1] Pidgin vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2010:044 ] mysql (security@...driva.com)
Multiple Adobe Products - XML External Entity And XML Injection Vulnerabilities (Roberto Suggi Liverani <roberto.suggi@...urity-assessment.com>)
[SECURITY] [DSA 2003-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Re: Circumventing Critical Security in Windows XP (Jeroen <nowhereman@...nen.org>)
jQuery Validate 1.6.0 Demo Code Advisory (CodeScan Labs Advisories <advisories@...escan.com>)
Hacktics Advisory Feb10: Persistent XSS in Microsoft SharePoint Portal ("Ofer Maor" <ofer.maor@...sp.org>)
Easy FTP Server 1.7.0.2 Remote BoF (jonbutler88@...glemail.com)
ZDI-10-019: Mozilla Firefox showModalDialog Cross-Domain Scripting Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
London DEFCON February meet - DC4420 - Wed 24th Feb 2010 (Major Malfunction <majormal@...ate-radio.org>)
[ MDVSA-2010:043 ] libtheora (security@...driva.com)
Request for feedback on TCP security (IETF effort) (Fernando Gont <fernando.gont@...il.com>)
Official Portal 2007 Multiple Vulnerabilities (info@...uritylab.ir)
Chuck Norris Botnet and Broadband Routers (Gadi Evron <ge@...uxbox.org>)

February 24 (14 messages)

[ MDVSA-2010:045 ] php (security@...driva.com)
[TKADV2010-003] avast! 4.8 and 5.0 aavmker4.sys Kernel Memory Corruption (Tobias Klein <tk@...pkit.de>)
[ MDVSA-2010:046 ] ncpfs (security@...driva.com)
Re: Chuck Norris Botnet and Broadband Routers ("Adrian P." <ap@...citizen.org>)
Kojoney (SSH honeypot) remote DoS (Nicob <nicob@...ob.net>)
CA20100223-01: Security Notice for CA eHealth Performance Manager ("Kotas, Kevin J" <Kevin.Kotas@...com>)
ZDI-10-021: Novell NetStorage xsrvd Long Pathname Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2010:047 ] fuse (security@...driva.com)
VUPEN Security Research - Symantec Products "SYMLTCOM.dll" Buffer Overflow Vulnerability ("VUPEN Security Research" <advisories@...en.com>)
ZDI-10-020: EMC HomeBase SSL Service Arbitrary File Upload Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Rbot Owner Reaction Command Execution (Matthias -apoc- Hecker <apoc@...serv.org>)
[USN-904-1] Squid vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
SQL injection vulnerability in LiveChatNow (Support TEAM <support@...ko-security.com>)
ESA-2010-003: EMC HomeBase Server Arbitrary File Upload Vulnerability (<Security_Alert@....com>)

February 25 (6 messages)

iDefense Security Advisory 02.23.10: Multiple Vendor NOS Microsystems getPlus Downloader Input Validation Vulnerability (iDefense Labs <labs-no-reply@...fense.c…)
Form-based HTTP Authentication Proof of Concept ("Timothy D. Morgan" <tmorgan@...curity.com>)
NSOADV-2010-003: DATEV ActiveX Control remote command execution (NSO Research <nso-research@...iriu.de>)
[ MDVSA-2010:048 ] roundcubemail (security@...driva.com)
Hacktics Advisory Feb10: XSS in IBM WebSphere Portal & Lotus WCM ("Ofer Maor" <ofer.maor@...sp.org>)
SQL injection vulnerability in WebAdministrator Lite CMS (Maciej Gojny <vuln@...ko-security.com>)

February 26 (6 messages)

[ MDVSA-2010:049 ] sudo (security@...driva.com)
SyScan'10 CALL FOR PAPERS ("thomas@...can.org" <thomas@...can.org>)
[ MDVSA-2010:050 ] apache-mod_security (security@...driva.com)
getPlus insufficient domain name validation vulnerability (Akita Software Security <lists@...tasecurity.nl>)
AST-2010-003: Invalid parsing of ACL rules can compromise security ("Asterisk Security Team" <security@...erisk.org>)
ARISg5 (version 5.0) cross site scripting vulnerability ("Yaniv Miron" <lament@...ack.org>)

236 messages

Powered by blists - more mailing lists