bugtraq mailing list - 2010/08

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2010/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 21	³ 12	⁴ 8	⁵ 39	⁶ 14	⁷	⁸
⁹ 16	¹⁰ 14	¹¹ 14	¹² 10	¹³ 27	¹⁴	¹⁵
¹⁶ 23	¹⁷ 7	¹⁸ 6	¹⁹ 7	²⁰ 2	²¹	²²
²³ 21	²⁴ 19	²⁵ 48	²⁶ 32	²⁷ 4	²⁸	²⁹
³⁰ 20	³¹ 11

Messages by day:

August 2 (21 messages)

[ MDVSA-2010:143 ] gnupg2 (security@...driva.com)
[SECURITY] [DSA 2078-1] New kvirc packages fix arbitrary IRC command execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2078-1] New mapserver packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
Directory Traversal Vulnerability in FTP Commander Pro (advisory@...ridge.ch)
Spielothek 1.6.9 Joomla Component Multiple Blind SQL Injection (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
2nd. OWASP Ibero-American Web-Applications Security conference (IBWAS’10) - Call for Training (Carlos Serrão <carlos.j.serrao@...il.com>)
Directory Traversal Vulnerability in TurboFTP Server (advisory@...ridge.ch)
Directory Traversal Vulnerability in TurboFTP 6 Client (advisory@...ridge.ch)
[SECURITY] [DSA 2080-1] New ghostscript packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2082-1] New gmime2.2 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Directory Traversal Vulnerability in FTP Commander (advisory@...ridge.ch)
[SECURITY] [DSA 2081-1] New libmikmod packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Directory Traversal Vulnerability in FTP Commander Deluxe (advisory@...ridge.ch)
Directory Traversal Vulnerability in 32bit FTP Client (advisory@...ridge.ch)
Information Leakage and Full path disclosure vulnerabilities in WordPress ("MustLive" <mustliveua@...il.com>)
[DCA-0006] Baby ASP Web Server DoS (Rodrigo Escobar <ipax@...abs.com.br>)
[DCA-0005] Baby POP Server DoS (Rodrigo Escobar <ipax@...abs.com.br>)
[DCA-0008] Quick 'n Easy WEB Server DoS (Rodrigo Escobar <ipax@...abs.com.br>)
[DCA-0007] Quick 'n Easy FTP Server v3.2 (Rodrigo Escobar <ipax@...abs.com.br>)
[SECURITY] [DSA 2083-1] New moin packages fix cross-site scripting (Nico Golde <nion@...ian.org>)
[DCA-0004] Baby FTP Server DoS (Rodrigo Escobar <ipax@...abs.com.br>)

August 3 (12 messages)

[SECURITY] [DSA 2084-1] New tiff packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[DCA-0003] Simple Web Server DoS (Rodrigo Escobar <ipax@...abs.com.br>)
[DCA-00014] Dlink WBR-2310 Wireless Router DoS (Rodrigo Escobar <ipax@...abs.com.br>)
TWSL2010-003: Unauthorized access to root NFS export on EMC Celerra NAS appliance (Trustwave Advisories <trustwaveadvisories@...stwave.com>)
[security bulletin] HPSBMA02563 SSRT100165 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[R7-0034] VxWorks WDB Agent Debug Service Exposure (HD Moore <HD_Moore@...id7.com>)
[DCA-0009] - NetWordDLS Finger Server Denial of Service (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)
[R7-0035] VxWorks Authentication Library Weak Password Hashing (HD Moore <HD_Moore@...id7.com>)
68KB v1.0.0rc4 Remote File Include Vulnerability (g1xsystem@...dowslive.com)
Re: [R7-0035] VxWorks Authentication Library Weak Password Hashing (Solar Designer <solar@...nwall.com>)
[SECURITY] [DSA 2085-1] New lftp packages fix file overwrite vulnerability (Sebastien Delafond <seb@...ian.org>)
[USN-964-2] Likewise Open regression (Kees Cook <kees@...ntu.com>)

August 4 (8 messages)

[SECURITY] [DSA 2086-1] New avahi packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2087-1] New cabextract packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Heap Offset Overflow in Citrix ICA Clients (Context IS - Disclosure <disclosure@...textis.co.uk>)
Quick Easy FTP Server USER command Vulnerability ("黄超毅" <huang_chaoyi@...ustech.com.cn>)
Fwd: {Lostmon´s Group} Safari for windows Long link DoS (Lostmon lords <lostmon@...il.com>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances (Cisco Systems Product Security Incident Response Team <…)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall Services Module (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Fwd: {Lostmon´s Group} K-Meleon for windows about:neterror Stack Overflow DoS (Lostmon lords <lostmon@...il.com>)

August 5 (39 messages)

[ MDVSA-2010:144 ] wireshark (security@...driva.com)
[Suspected Spam]CSRF, Information Leakage and Full path disclosure vulnerabilities in WordPress ("MustLive" <mustlive@...security.com.ua>)
iDefense Security Advisory 08.03.10: Citrix ICA Client ActiveX Memory Corruption Vulnerabillity (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 2088-1] New wget packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)
ZeusCart Ecommerce Shopping Cart Software Cross-Site scripting Vulnerability (SecPod Research <research@...pod.com>)
Secunia Research: MantisBT "Add Category" Script Insertion Vulnerability (Secunia Research <remove-vuln@...unia.com>)
SQL injection vulnerability in BXR (advisory@...ridge.ch)
XSS vulnerability in Prado Portal (advisory@...ridge.ch)
XSS vulnerability in DT Centrepiece (advisory@...ridge.ch)
Directory Traversal in FTP Explorer (advisory@...ridge.ch)
Directory Traversal in FTP Rush (advisory@...ridge.ch)
XSS vulnerability in DiamondList (advisory@...ridge.ch)
XSRF (CSRF) in DiamondList (advisory@...ridge.ch)
XSS vulnerability in BXR search (advisory@...ridge.ch)
XSS vulnerability in Open Blog (advisory@...ridge.ch)
Directory Traversal in SmartFTP (advisory@...ridge.ch)
XSS vulnerability in DiamondList (advisory@...ridge.ch)
XSS vulnerability in SiteLoom CMS (advisory@...ridge.ch)
XSS vulnerability in Amethyst (advisory@...ridge.ch)
XSS vulnerability in BXR (advisory@...ridge.ch)
XSS vulnerability in Open blog (advisory@...ridge.ch)
XSRF (CSRF) in Open blog (advisory@...ridge.ch)
Directory Traversal in Frigate 3 built-in FTP client (advisory@...ridge.ch)
XSS vulnerability in BXR (advisory@...ridge.ch)
XSRF (CSRF) in BXR (advisory@...ridge.ch)
XSS vulnerability in Amethyst (advisory@...ridge.ch)
XSS vulnerability in Amethyst (advisory@...ridge.ch)
XSRF (CSRF) in Amethyst (advisory@...ridge.ch)
XSS vulnerability in DT Centrepiece (advisory@...ridge.ch)
XSS vulnerability in DT Centrepiece (advisory@...ridge.ch)
Application Logic Error in DT Centrepiece (advisory@...ridge.ch)
Application Logic Error in DT Centrepiece (advisory@...ridge.ch)
[security bulletin] HPSBGN02501 SSRT071407 rev.1 - HP ProCurve 1800 Switches running SNMP, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBGN02562 SSRT090249 rev.1 - HP ProCurve Threat Management Services (TMS) zl Module J9155A and J9156A running TLS/SS… (security-alert@...com)
[security bulletin] HPSBGN02559 SSRT100192 rev.1 - HP ProCurve 2610 Switch In-band Agent, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBGN02561 SSRT100194 rev.1 - HP ProCurve 2610 Switches running DHCP, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBGN02560 SSRT100193 rev.1 - HP ProCurve 2626 and 2650 Switches, Remote Unauthorized Access (security-alert@...com)
[USN-968-1] Dell Latitude 2110 vulnerability (Kees Cook <kees@...ntu.com>)
Cisco Wireless Control System XSS ("Tom Neaves" <tom@...neaves.com>)

August 6 (14 messages)

ZDI-10-138: Novell iPrint Server Queue Name Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-140: Novell iPrint Client Browser Plugin operation Parameter Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Vulnerabilities in Dataface Web Application Framework ("MustLive" <mustlive@...security.com.ua>)
ZDI-10-141: Apple Webkit SVG ForeignObject Rendering Layout Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-142: Apple Webkit SVG First-Letter Style Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[SECURITY] [DSA-2089-1] New php5 packages fix several vulnerabilities (Raphael Geissert <geissert@...ian.org>)
TPTI-10-06: Novell iPrint Client Browser Plugin ExecuteRequest debug Parameter Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoi…)
[USN-969-1] PCSC-Lite vulnerability (Kees Cook <kees@...ntu.com>)
TPTI-10-05: Novell iPrint Client Browser Plugin Remote File Deletion Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-139: Novell iPrint Client Browser Plugin Parameter Name Remote Code Execution (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2010:145 ] libtiff (security@...driva.com)
ESA-2010-013: RSA, The Security Division of EMC, informs about potential security vulnerability in RSA enVision� versions prior to 3.7 … (security_alert@....com)
[ MDVSA-2010:146 ] libtiff (security@...driva.com)
Re: [CORE-2010-0405] Adobe Director Invalid Read (Core Security Technologies Advisories <advisories@...esecurity.com>)

August 9 (16 messages)

cgTestimonial 2.2 Joomla Component Multiple Remote Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[SECURITY] [DSA 2090-1] New socat packages fix arbitrary code execution (Luciano Bello <luciano@...ian.org>)
Re: Pragyan CMS 2.6.4 Multiple SQL Injection Vulnerabilities (i.abhi27@...il.com)
QQ Computer Manager TSKsp.sys Driver Local Denial of Service Vulnerability (lilf <lilf@...soft.com>)
XSS vulnerability in allinta CMS (advisory@...ridge.ch)
XSS vulnerability in Eden Platform (advisory@...ridge.ch)
SQL injection vulnerability in allinta CMS (advisory@...ridge.ch)
XSS vulnerability in allinta CMS (advisory@...ridge.ch)
SQL injection vulnerability in allinta CMS (advisory@...ridge.ch)
XSS vulnerability in Eden Platform (advisory@...ridge.ch)
XSS vulnerability in allinta CMS (advisory@...ridge.ch)
ZDI-10-143: Novell Sentinel Log Manager Multiple Servlet Remote Code Execution Vulnerabilities (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Nagios XI 2009R1.2B Multiple CSRF (Adam Baldwin <adam_baldwin@...nuity-is.com>)
ZDI-10-144: Apple Webkit Rendering Counter Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-146: Apple Webkit Anchor Tag Mouse Click Event Dispatch Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-145: Novell ZENWorks Remote Management Agent Weak Authentication Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

August 10 (14 messages)

Teams 1_1028_100809_1711 Joomla Component Multiple Blind SQL Injection Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Amblog 1.0 Joomla Component Multiple SQL Injection Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[USN-967-1] w3m vulnerability (Steve Beattie <sbeattie@...ntu.com>)
[USN-965-1] OpenLDAP vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)
Secunia Research: Windows Movie Maker String Parsing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
ZDI-10-147: Microsoft Windows MPEG Layer-3 Audio Decoder Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
2Wire Broadband Router Session Hijacking Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Cross-Site Scripting vulnerability in Mozilla Firefox, Opera and other browsers ("MustLive" <mustlive@...security.com.ua>)
ToorCon 12 Call for Papers (h1kari@...rcon.org)
ZDI-10-148: Microsoft Cinepak Codec CVDecompress Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[CORE-2010-0623] Microsoft Windows CreateWindow function callback vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
Re: ESA-2010-013: RSA, The Security Division of EMC, informs about potential security vulnerability in RSA enVision� versions prior to … (Security_Alert@....com)
CORE-2010-0407: Microsoft Office Excel PivotTable Cache Data Record Buffer Overflow (CORE Security Technologies Advisories <advisories@...esecurity.com>)
ZDI-10-149: Adobe Flash Player LocalConnection Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

August 11 (14 messages)

iDefense Security Advisory 08.10.10: Microsoft Word RTF File Parsing Heap Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
VUPEN Security Research - Microsoft Internet Explorer "boundElements" Property Use-after-free Vulnerability (CVE-2010-25… ("VUPEN Security Research" <advisories@v…)
VUPEN Security Research - Microsoft Internet Explorer "OnPropertyChange_Src()" Use-after-free Vulnerability (CVE-2010-25… ("VUPEN Security Research" <advisories@v…)
VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability (CVE-2010-255… ("VUPEN Security Research" <advisories@v…)
VUPEN Security Research - Microsoft Internet Explorer Table Element Use-after-free Vulnerability (CVE-2010-2560) ("VUPEN Security Research" <advisories@...en.c…)
Microsoft Office Word HTML Linked Objects Memory Corruption Vulnerability - CVE-2010-1903 (Rodrigo Branco <rbranco@...ckpoint.com>)
PR10-07: Unauthenticated File Retrieval (traversal) within ColdFusion administration console (research <research@...checkup.com>)
Collisions in PDF signatures (Florian Zumbiehl <florz@...rz.de>)
ZDI-10-150: Microsoft Office Word sprmCMajority Record Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Cisco Security Advisory: Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 … (Cisco Systems Product Security Incident…)
Cisco Security Advisory: SQL Injection Vulnerability in Cisco Wireless Control System (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
ZDI-10-151: SAP Crystal Reports 2008 GIOP Message Size Integer Overflow Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
RE: Correction to: ZDI-10-151: SAP Crystal Reports 2008 GIOP Message Size Integer Overflow Remote Code Execution Vulner… (ZDI Disclosures <zdi-disclosures@...pin…)
Secunia Research: glpng PNG Processing Two Integer Overflow Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)

August 12 (10 messages)

[USN-970-1] GnuPG2 vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
ZDI-10-151: Microsoft Office Word 2007 plcffldMom Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-152: Apple WebKit RTL LineBox Overflow Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-153: Apple Webkit SVG Floating Text Element Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-154: Apple Webkit Button First-Letter Style Rendering Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Secunia Research: Opera "Download" Dialog File Execution Security Issue (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2010:148 ] pidgin (security@...driva.com)
[ MDVSA-2010:149 ] freetype2 (security@...driva.com)
[SECURITY] [DSA 2091-1] New squirrelmail packages fix cross-site request forgery (Luciano Bello <luciano@...ian.org>)
SQL Injection vulnerability in CMS WebManager-Pro ("MustLive" <mustlive@...security.com.ua>)

August 13 (27 messages)

Cisco Security Advisory: Cisco IOS Software TCP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: Amblog 1.0 Joomla Component Multiple SQL Injection Vulnerabilities (tibor.fogler@...il.com)
XSRF (CSRF) in Mystic (advisory@...ridge.ch)
XSS vulnerability in Mystic (advisory@...ridge.ch)
XSS vulnerability in Onyx (advisory@...ridge.ch)
XSS vulnerability in Onyx (advisory@...ridge.ch)
SQL injection vulnerability in SyntaxCMS (advisory@...ridge.ch)
XSS vulnerability in Edit-X CMS (advisory@...ridge.ch)
Directory Traversal in SoftX FTP Client (advisory@...ridge.ch)
XSS vulnerability in i-Web Suite (advisory@...ridge.ch)
SQL injection vulnerability in i-Web Suite (advisory@...ridge.ch)
SQL injection vulnerability in CMS Source (advisory@...ridge.ch)
XSS vulnerability in CMS Source (advisory@...ridge.ch)
XSS vulnerability in eazyCMS (advisory@...ridge.ch)
XSS vulnerability in eazyCMS (advisory@...ridge.ch)
XSS vulnerability in eazyCMS (advisory@...ridge.ch)
Local File Inclusion in CMS Source (advisory@...ridge.ch)
SQL injection vulnerability in CMS Source (advisory@...ridge.ch)
XSS vulnerability in CMS Source (advisory@...ridge.ch)
Local File Inclusion in CMS Source (advisory@...ridge.ch)
SQL injection vulnerability in CMS Source (advisory@...ridge.ch)
XSS vulnerability in CMS Source (advisory@...ridge.ch)
XSS vulnerability in eazyCMS (advisory@...ridge.ch)
[MajorSecurity SA-080]WordPress 3.0.1 - Cross Site Scripting Issue (david.kurz@...orsecurity.net)
Secunia Research: SWFTools Two Integer Overflow Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Re: Correction to: ZDI-10-151: SAP Crystal Reports 2008 GIOP Message Size Integer Overflow Remote Code Execution Vulner… (Steve Shockley <steve.shockley@...ckley…)
XSS vulnerability in Mystic (advisory@...ridge.ch)

August 16 (23 messages)

iDefense Security Advisory 08.10.10: Microsoft Office RTF Parsing Engine Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
ACollab Multiple Vulnerabilities (admin@...report.ir)
Easy FTP Server v1.7.0.11 DELE, STOR, RNFR, RMD, XRMD Command Buffer Overflow ("Glafkos Charalambous" <glafkos@...alavista.com>)
[ MDVSA-2010:150 ] libsndfile (security@...driva.com)
Re: XSS vulnerability in CruxCMS (security curmudgeon <jericho@...rition.org>)
Re: XSS vulnerability in WebPress (security curmudgeon <jericho@...rition.org>)
Re: XSS vulnerability in Theeta CMS (security curmudgeon <jericho@...rition.org>)
Re: XSS vulnerability in Eden Platform (security curmudgeon <jericho@...rition.org>)
Insecure secure cookie in Tornado (Nam Nguyen <namn@...emoon.com.vn>)
Jgrid 1.0 Joomla Component Local File Inclusion Vulnerability (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Re: Re: Amblog 1.0 Joomla Component Multiple SQL Injection Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[ MDVSA-2010:151 ] libmikmod (security@...driva.com)
XSS vulnerability in pimcore (advisory@...ridge.ch)
XSRF (CSRF) in CMSimple (advisory@...ridge.ch)
XSS vulnerability in CMSimple (advisory@...ridge.ch)
XSS vulnerability in CMSimple (advisory@...ridge.ch)
Xilisoft Video Converter Wizard 3 ogg file processing DoS (praveen_recker@...y.com)
XSS vulnerability in CMSimple (advisory@...ridge.ch)
[ MDVSA-2010:153 ] apache (security@...driva.com)
[ MDVSA-2010:154 ] cabextract (security@...driva.com)
[USN-971-1] OpenJDK vulnerabilities (Kees Cook <kees@...ntu.com>)
[ MDVSA-2010:152 ] apache (security@...driva.com)
CVE-2010-3014: Coda Filesystem Kernel Memory Disclosure (VSR Advisories <advisories@...curity.com>)

August 17 (7 messages)

Windows Kerberos Authentication Bypass (Tommaso Malgherini <mamaragan@...il.com>)
CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack (Jan Lehnardt <jan@...che.org>)
Triologic Media Player 8 (.m3u) Local Universal Unicode Buffer Overflow [SEH] (glafkos@...alavista.com)
[USN-972-1] FreeType vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Geolocation spoofing and other UI woes (Michal Zalewski <lcamtuf@...edump.cx>)
[SECURITY] [DSA 2092-1] New lxr-cvs packages fix cross-site scripting (Sebastien Delafond <seb@...ian.org>)
[USN-973-1] KOffice vulnerabilities (Jamie Strandboge <jamie@...onical.com>)

August 18 (6 messages)

[SECURITY] [DSA 1919-2] New smarty packages fix regression (Thijs Kinkhorst <thijs@...ian.org>)
Re: Geolocation spoofing and other UI woes (Michal Zalewski <lcamtuf@...edump.cx>)
Medium security hole in Rekonq web browser (Tim Brown <timb@...-dimension.org.uk>)
ACROS Security: Remote Binary Planting in Apple iTunes for Windows (ASPR #2010-08-18-1) ("Mitja Kolsek" <mitja.kolsek@...os.si>)
Web Tool Announcement: ismymailsecure.com (Holger Rabbach <hrabbach@...ssroad-networks.com>)
Better Security Through Sacrificing Maidens (Pete Herzog <lists@...com.org>)

August 19 (7 messages)

MUSE v4.9.0.006 (.m3u) Local Buffer Overflow Exploit (glafkos@...alavista.com)
MUSE v4.9.0.006 (.pls) Local Universal Buffer Overflow [SEH] (glafkos@...alavista.com)
[security bulletin] HPSBST02536 SSRT100057 rev.2 - HP StorageWorks Storage Mirroring, Remote Unauthorized Access (security-alert@...com)
[security bulletin] HPSBMA02424 SSRT080125 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[SECURITY] [DSA 2093-1] New ghostscript packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
NSOADV-2010-005: SonicWALL E-Class SSL-VPN ActiveX Control format string overflow (NSO Research <nso-research@...iriu.de>)
Flock Browser 3.0.0.3989 Malformed Bookmark XSS and script insertion (Lostmon lords <lostmon@...il.com>)

August 20 (2 messages)

[security bulletin] HPSBMA02477 SSRT090177 rev.5 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial o… (security-alert@...com)
Re: ACROS Security: Remote Binary Planting in Apple iTunes for Windows (ASPR #2010-08-18-1) (larry@...ryseltzer.com)

August 23 (21 messages)

Re: Web Tool Announcement: ismymailsecure.com (Chuck Swiger <cswiger@....com>)
phpMyAdmin 3.3.5 / 2.11.10 <= Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
[SECURITY] [DSA 2094-1] New Linux 2.6.26 packages fix several issues (dann frazier <dannf@...ian.org>)
Directory Traversal in AutoFTP Manager (advisory@...ridge.ch)
Directory Traversal in 3D FTP Client (advisory@...ridge.ch)
Ruxcon 2010 Final Call For Papers (cfp@...con.org.au)
Directory Traversal in FTPGetter (advisory@...ridge.ch)
Nagios XI Login XSS (Adam Baldwin <adam_baldwin@...nuity-is.com>)
Secunia Research: Novell iPrint Client "call-back-url" Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2010:158 ] squirrelmail (security@...driva.com)
[Bkis-04-2010] Multiple Vulnerabilities in OpenBlog ("Bkis" <minhbq@...v.com.vn>)
Re: [MajorSecurity SA-080]WordPress 3.0.1 - Cross Site Scripting Issue ("MustLive" <mustlive@...security.com.ua>)
XSS vulnerability in MAXdev (advisory@...ridge.ch)
Biblioteca 1.0 Beta Joomla Component Multiple SQL Injection Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[ MDVSA-2010:155 ] mysql (security@...driva.com)
[SECURITY] [DSA 2095-1] New lvm2 packages fix denial of service (Giuseppe Iuculano <iuculano@...ian.org>)
Google Chrome: HTTP AUTH Dialog Spoofing through Realm Manipulation (Restated) (Aditya K Sood <0kn0ck@...niche.org>)
Re: 2Wire Broadband Router Session Hijacking Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Secunia Research: Mono libgdiplus Image Processing Three Integer Overflows (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2010:157 ] freetype2 (security@...driva.com)
[ MDVSA-2010:156 ] freetype2 (security@...driva.com)

August 24 (19 messages)

[ MDVSA-2010:159 ] gv (security@...driva.com)
Re: Google Chrome: HTTP AUTH Dialog Spoofing through Realm Manipulation (Restated) (Tim <tim-security@...tinelchicken.org>)
[ MDVSA-2010:159 ] gv (security@...driva.com)
ZDI-10-156: IBM Lotus Notes Autonomy KeyView Word Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-158: IBM Lotus Notes Autonomy KeyView WK3 Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2010:159 ] gv (security@...driva.com)
[security bulletin] HPSBGN02569 SSRT100200 rev.1 - HP MagCloud iPad App, Remote Unauthorized Access to Data (security-alert@...com)
Re: 2Wire Broadband Router Session Hijacking Vulnerability (Mike Duncan <Mike.Duncan@...a.gov>)
TPTI-10-08: Novell iPrint Client Browser PluginGetDriverFile Uninitialized Pointer Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pin…)
[security bulletin] HPSBST02536 SSRT100057 rev.3 - HP StorageWorks Storage Mirroring, Local Unauthorized Access (security-alert@...com)
ZDI-10-155: Cisco WebEx Player ARF String Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Re: Google Chrome: HTTP AUTH Dialog Spoofing through Realm Manipulation (Restated) (Aditya K Sood <0kn0ck@...niche.org>)
[ MDVSA-2010:160 ] cacti (security@...driva.com)
Re: Google Chrome: HTTP AUTH Dialog Spoofing through Realm Manipulation (Restated) (Tim <tim-security@...tinelchicken.org>)
London DEFCON - DC4420 - August meet - Wednesday 25th August 2010 (Major Malfunction <majormal@...ate-radio.org>)
Re: Google Chrome: HTTP AUTH Dialog Spoofing through Realm Manipulation (Restated) (Aditya K Sood <0kn0ck@...niche.org>)
ZDI-10-159: IBM Lotus Notes Autonomy KeyView WK3 Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
WinAppDbg 1.4 is out! (Mario Vilas <mvilas@...il.com>)
t2′10 Challenge to be released 2010-08-28 10:00 EEST (Tomi Tuominen <tomi.tuominen@...fi>)

August 25 (48 messages)

[SECURITY] [DSA 2096-1] New zope-ldapuserfolder packages fix authentication bypass (Sebastien Delafond <seb@...ian.org>)
[ MDVSA-2010:161 ] vte (security@...driva.com)
TPTI-10-11: Adobe Shockwave tSAC Chunk Pointer Offset Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-10-10: Adobe Shockwave tSAC Chunk Invalid Seek Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-10-09: Adobe Shockwave CSWV Chunk Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-10-14: Adobe Shockwave Director rcsL Chunk Pointer Offset Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-10-12: Adobe Shockwave TextXtra Allocator Integer Overflow Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-10-13: Adobe Shockwave Director tSAC Chunk Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-10-15: Adobe Shockwave Director mmap Trusted Chunk Size Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-160: Adobe Shockwave Player Director File FFFFFF45 Record Processing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.…)
ZDI-10-161: Adobe Shockwave Director PAMI Chunk Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-162: Adobe Shockwave Director rcsL Chunk Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-163: Adobe Shockwave Director tSAC Chunk Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-164: Adobe Shockwave Player Director File FFFFFF88 Record Processing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.…)
Nagios XI users.php SQL Injection (Adam Baldwin <adam_baldwin@...nuity-is.com>)
iDefense Security Advisory 08.24.10: Adobe Shockwave Player Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
DLL hijacking on Linux (Tim Brown <timb@...-dimension.org.uk>)
TeamViewer <= 5.0.8703 DLL Hijacking Exploit (dwmapi.dll) (glafkos@...alavista.com)
Re: Web Tool Announcement: ismymailsecure.com (Kari Hurtta <hurtta+bugtraq@...ja.mh.fmi.fi>)
Re: Web Tool Announcement: ismymailsecure.com (Holger Rabbach <hrabbach@...ssroad-networks.com>)
Re: Web Tool Announcement: ismymailsecure.com (Kari Hurtta <hurtta+bugtraq@...ja.mh.fmi.fi>)
GFI WebMonitor Admin UI Remote Script Code Injection (Oliver Karow <oliver.karow@....de>)
Re: Web Tool Announcement: ismymailsecure.com (Holger Rabbach <hrabbach@...ssroad-networks.com>)
Adobe Device Central CS5 DLL Hijacking Exploit (qtcf.dll) (glafkos@...alavista.com)
Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@ci…)
Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
ZDI-10-165: Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Firefox <= 3.6.8 DLL Hijacking Exploit [dwmapi.dll] (glafkos@...alavista.com)
[USN-977-1] MoinMoin vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Adobe On Location CS4 DLL Hijacking Exploit (ibfs32.dll) (glafkos@...alavista.com)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2881 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2868 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2864 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2869 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Premier Pro CS4 DLL Hijacking Exploit (ibfs32.dll) (glafkos@...alavista.com)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2880 (Rodrigo Branco <rbranco@...ckpoint.com>)
Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2882 (Rodrigo Branco <rbranco@...ckpoint.com>)
[USN-976-1] Tomcat vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Secunia Research: KDE Okular PDB Parsing RLE Decompression Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Deepin TFTP Server Directory Traversal Vulnerability ("黄超毅" <huang_chaoyi@...ustech.com.cn>)
Adobe Illustrator CS4 DLL Hijacking Exploit (aires.dll) (glafkos@...alavista.com)
ZDI-10-157: IBM Lotus Notes Autonomy KeyView Office Shape Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Re: WinAppDbg 1.4 is out! (Aleksandr Yampolskiy <ayampolskiy@...t.com>)
Adobe InDesign CS4 DLL Hijacking Exploit (ibfs32.dll) (glafkos@...alavista.com)
Re: WinAppDbg 1.4 is out! (Mario Vilas <mvilas@...il.com>)
Re: Web Tool Announcement: ismymailsecure.com (Tim <tim-security@...tinelchicken.org>)
[Positive Technologies Research] Open Source WebEngine and Web Crawler v.0.2 is out! (aanisimov@...ecurity.com)
Re: Web Tool Announcement: ismymailsecure.com (Tim <tim-security@...tinelchicken.org>)

August 26 (32 messages)

Re: DLL hijacking on Linux (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
Skype <= 4.2.0.169 DLL Hijacking Exploit (wab32.dll) (glafkos@...alavista.com)
Re: Web Tool Announcement: ismymailsecure.com (Brian Behlendorf <brian@...lendorf.com>)
XSS vulnerability in CompuCMS (advisory@...ridge.ch)
Apple CoreGraphics (Preview) Memory Corruption Vulnerability - CVE-2010-1801 (Rodrigo Branco <rbranco@...ckpoint.com>)
XSS vulnerability in Auto CMS (advisory@...ridge.ch)
XSS vulnerability in Webmatic (advisory@...ridge.ch)
XSS vulnerability in Webmatic (advisory@...ridge.ch)
SQL injection vulnerability in TCMS (advisory@...ridge.ch)
XSS vulnerability in TCMS (advisory@...ridge.ch)
SQL injection vulnerability in TCMS (advisory@...ridge.ch)
SQL injection vulnerability in CompuCMS (advisory@...ridge.ch)
Details of cisco-sa-20081022-asa security advisory? (Fernando Gont <fernando.gont@...il.com>)
Local File Inclusion in TCMS (advisory@...ridge.ch)
Multiple vulnerabilities in eSitesBuilder ("MustLive" <mustlive@...security.com.ua>)
SQL injection vulnerability in CompuCMS (advisory@...ridge.ch)
XSS vulnerability in CompuCMS (advisory@...ridge.ch)
XSS vulnerability in TCMS (advisory@...ridge.ch)
XSS vulnerability in CompuCMS (advisory@...ridge.ch)
XSRF (CSRF) in Webmatic (advisory@...ridge.ch)
SQL injection vulnerability in TCMS (advisory@...ridge.ch)
SQL injection vulnerability in TCMS (advisory@...ridge.ch)
SQL injection vulnerability in TCMS (advisory@...ridge.ch)
File Content Disclosure in TCMS (advisory@...ridge.ch)
SQL injection vulnerability in CompuCMS (advisory@...ridge.ch)
SQL injection vulnerability in CompuCMS (advisory@...ridge.ch)
[HITB-Announce] HITB2010 SIGNINT Sessions (Hafez Kamal <aphesz@...kinthebox.org>)
Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
BlastChat Chat Client Component version 3.3 <= Cross Script Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
ZDI-10-166: RealNetworks RealPlayer Malformed IVR Object Index Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-167: RealNetworks RealPlayer FLV Parsing Multiple Integer Overflow Vulnerabilities (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
BugTracker.net 3.4.3 SQL Injection (Mark van Tilburg <markvantilburg@...il.com>)

August 27 (4 messages)

[USN-974-2] Linux kernel regression (Jamie Strandboge <jamie@...onical.com>)
[USN-979-1] okular vulnerability (Steve Beattie <sbeattie@...ntu.com>)
wp-10-0001: Multiple Browser Wildcard Cerficate Validation Weakness (Richard Moore <rich@...tpoint.ltd.uk>)
Flash Player 9 DLL Hijacking Exploit (schannel.dll) (info@...uritylab.ir)

August 30 (20 messages)

[SECURITY] [DSA 2097-1] New phpmyadmin packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 2098-1] New typo3-src packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
[ MDVSA-2010:163 ] phpmyadmin (security@...driva.com)
The Smarter Safer Better Seminar Series (Pete Herzog <lists@...com.org>)
Cisco Security Advisory: Cisco IOS XR Software Border Gateway Protocol Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: SQL injection vulnerability in TCMS (security curmudgeon <jericho@...rition.org>)
QtWeb Browser version 3.3 build 043 Insecure DLL Hijacking Vulnerability (wintab32.dll) (YGN Ethical Hacker Group <lists@...g.net>)
[ MDVSA-2010:164 ] phpmyadmin (security@...driva.com)
ekoparty Security Conference 2010 Announcements (Federico Kirschbaum <fedek@...obyte.com.ar>)
Notepad++ version 5.7 Insecure DLL Hijacking Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
[SECURITY] [DSA 2099-1] New OpenOffice.org packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Microsoft Windows wscript.exe (XP) DLL Hijacking Exploit (wshfra.dll) (info@...uritylab.ir)
Maxthon Browser version 2.5.15.1000 Insecure DLL Hijacking Vulnerability (dwmapi.dll) (YGN Ethical Hacker Group <lists@...g.net>)
EC2ND 2010, Call for Participation (Konrad Rieck <konrad.rieck@...berlin.de>)
[0day] Apple QuickTime "_Marshaled_pUnk" backdoor param arbitrary code execution (Reversemode <advisories@...ersemode.com>)
R7-0036: FCKEditor.NET File Upload Code Execution (HD Moore <HD_Moore@...id7.com>)
{Lostmon - Groups} Safari for windows Invalid SGV text style Webkit.dll DoS (Lostmon lords <lostmon@...il.com>)
[ MDVSA-2010:165 ] libHX (security@...driva.com)
Re: [Full-disclosure] QtWeb Browser version 3.3 build 043 Insecure DLL Hijacking Vulnerability (wintab32.dll) (security curmudgeon <jericho@...rition.org>)
[SECURITY] [DSA 2100-1] New openssl packages fix double free (Moritz Muehlenhoff <jmm@...ian.org>)

August 31 (11 messages)

[security bulletin] HPSBUX02552 SSRT100062 rev.1 - HP-UX running Software Distributor (sd), Local Privilege Increase, Unauthorized Access (security-alert@...com)
[security bulletin] HPSBMA01212 SSRT5998 rev.4 - HP System Management Homepage Running PHP, Remote Denial of Service (DoS), Cross Site Scr… (security-alert@...com)
[USN-980-1] bogofilter vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-981-1] libwww-perl vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
django in combination with mod wsgi on apache on default debian and ubuntu installations does not place any bounds on the maximu… (dave b <db.pub.mail@...il.com>)
[security bulletin] HPSBMA02571 SSRT100034 rev.1 - HP Insight Diagnostics Online Edition, Remote Cross Site Scripting (XSS) (security-alert@...com)
Tortoise SVN DLL Hijacking Vulnerability (nikhil_uitrgpv@...oo.co.in)
[ MDVSA-2010:166 ] libgdiplus (security@...driva.com)
ZDI-10-168: Apple QuickTime ActiveX _Marshaled_pUnk Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ApPHP Calendar XSS - CSRF (edgard.chammas@...amand.edu.lb)
KeePass version 2.12 <= Insecure DLL Hijacking Vulnerability (dwmapi.dll) (YGN Ethical Hacker Group <lists@...g.net>)

375 messages

Powered by blists - more mailing lists