bugtraq mailing list - 2010/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2010/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 3	²	³
⁴ 10	⁵ 14	⁶ 10	⁷ 7	⁸ 14	⁹	¹⁰
¹¹	¹² 9	¹³ 28	¹⁴ 33	¹⁵ 6	¹⁶	¹⁷
¹⁸ 19	¹⁹ 9	²⁰ 12	²¹ 17	²² 5	²³	²⁴
²⁵ 12	²⁶ 14	²⁷ 46	²⁸ 5	²⁹	³⁰	³¹

Messages by day:

October 1 (3 messages)

Re: XSRF (CSRF) in Zimplit (security curmudgeon <jericho@...rition.org>)
THOTCON 0x2 - Call For Papers is Open -> 10.01.10 (THOTCON Announce <announce@...tcon.org>)
[STANKOINFORMZASCHITA-10-01] Netbiter® webSCADA multiple vulnerabilities (info@...efence.ru)

October 4 (10 messages)

Multiple vulnerabilities in WordPress 2 and 3 ("MustLive" <mustlive@...security.com.ua>)
[ MDVSA-2010:193 ] qt-creator (security@...driva.com)
[ MDVSA-2010:194 ] git (security@...driva.com)
NetWin Surgemail XSS vulnerability (kerem.kocaer@...sec.se)
[ MDVSA-2010:191 ] mailman (security@...driva.com)
ZDI-10-189: Novell eDirectory Server Malformed Index Denial of Service Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-190: Novell iManager getMultiPartParameters Arbitrary File Upload Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com…)
Another new technique to bypass SEHOP. ( no 'xor pop pop ret' ) (geinblues@...il.com)
[ MDVSA-2010:192 ] apr-util (security@...driva.com)
[STANKOINFORMZASCHITA-10-02] ITS SCADA Authorization bypass (info@...efence.ru)

October 5 (14 messages)

[ MDVSA-2010:195 ] libesmtp (security@...driva.com)
OWASP ZAP (psiinon <psiinon@...il.com>)
[SECURITY] [DSA-2117-1] New apr-util packages fix denial of service (Stefan Fritsch <sf@...ian.org>)
[IMF 2011] Call for Papers (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
SQL injection vulnerability in Elxis CMS (advisory@...ridge.ch)
XSS vulnerability in Docebo Announcements (advisory@...ridge.ch)
[SECURITY] [DSA-2116-1] New freetype packages integer overflow (Stefan Fritsch <sf@...ian.org>)
XSS vulnerability in Elxis CMS (advisory@...ridge.ch)
XSS vulnerability in Elxis CMS (contacts) (advisory@...ridge.ch)
XSS vulnerability in Elxis CMS polls module (advisory@...ridge.ch)
[ MDVSA-2010:196 ] dovecot (security@...driva.com)
[security bulletin] HPSBTU02496 SSRT090245 rev.1 - HP Tru64 UNIX Running NTP, Denial of Service (DoS) (security-alert@...com)
MITKRB5-SA-2010-006 [CVE-2010-1322] KDC uninitialized pointer crash in authorization data handling (Tom Yu <tlyu@....edu>)
Vulnerabilities in CMS WebManager-Pro ("MustLive" <mustlive@...security.com.ua>)

October 6 (10 messages)

[ MDVSA-2010:197 ] postgresql (security@...driva.com)
[Suspected Spam]XSS in Squirrelmail plugin 'Virtual Keyboard' <= 0.9.1 (Moritz Naumann <security@...itz-naumann.com>)
[ GLSA 201010-01 ] Libpng: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
(CORE-2010-0701) Adobe Acrobat Reader Acrord32.dll Use After Free Vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
ESA-2010-018: RSA Security Advisory: RSA, The Security Division of EMC, announces a fix for a potential security vulnerability in RSAR … (<Security_Alert@....com>)
[USN-1001-1] LVM2 vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
ZDI-10-191: Adobe Reader ICC Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-999-1] Kerberos vulnerability (Kees Cook <kees@...ntu.com>)
ZDI-10-193: Adobe Acrobat Reader Multimedia Playing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-192: Adobe Acrobat Reader ICC mluc Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

October 7 (7 messages)

HP Data Protector Manager v6.11 / NULL Pointer Dereference Remote Denial of Service Vulnerabilities (Pepelux <pepeluxx@...il.com>)
Adobe Reader 9.3.4 Multiple Memory Corruption - Security Advisory - SOS-10-003 (Sense of Security <lists@...seofsecurity.com.au>)
Syhunt Advisory: Visual Synapse HTTP Server Directory Traversal Vulnerability ("Felipe M. Aragon" <felipe@...unt.com>)
[USN-1002-1] PostgreSQL vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1003-1] OpenSSL vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
IBWAS'10 CfP - Deadline Extension (Carlos SerrÃ£o <carlos.j.serrao@...il.com>)
[USN-1002-2] PostgreSQL vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)

October 8 (14 messages)

[ MDVSA-2010:198 ] kernel (security@...driva.com)
XSS in Oracle default fcgi-bin/echo (paul.szabo@...ney.edu.au)
Directory Traversal Vulnerability in FilterFTP (advisory@...ridge.ch)
XSS vulnerability in Expression CMS (advisory@...ridge.ch)
Directory Traversal Vulnerability in FTP Voyager (advisory@...ridge.ch)
XSS vulnerability in Lantern CMS (advisory@...ridge.ch)
XSS vulnerability in Lantern CMS (advisory@...ridge.ch)
XSS vulnerability in Expression CMS (advisory@...ridge.ch)
FIrefox: Bug 602181 â€“ password exposed in memory cache (Sim IJskes <sim@...kes.org>)
OverLook Cross-site Scripting Vulnerability (advisory@...toliasecurity.com)
Re: Multiple Cross Site Scripting (XSS) and SQL injection Vulnerabilities in XRMS, CVE-2008-3664 (gopherit@...rs.sourceforge.net)
LFI / RCE vlunerability in Joomla Community Builder Enhenced (CBE) Component (Delf Tonder <delf.tonder@....de>)
[TOOL RELEASE] Exploit Next Generation SQL Fingerprint v. ("Nelson Brito" <nbrito@...ure.org>)
[WARNING] A fake version of T50!!! ("Nelson Brito" <nbrito@...ure.org>)

October 12 (9 messages)

[SECURITY] [DSA 2118-1] New subversion packages fix authentication bypass (Nico Golde <nion@...ian.org>)
Joomla! 1.5.20 <= Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Vulnerabilities in AltConstructor ("MustLive" <mustlive@...security.com.ua>)
[SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)
Re: JE Guestbook 1.0 Joomla Component Multiple Remote Vulnerabilities (joomextensions@...il.com)
[ MDVSA-2010:199 ] subversion (security@...driva.com)
[CORE-2010-0624] MS OpenType CFF Parsing Vulnerability (Core Security Technologies Advisories <advisories@...esecurity.com>)
[ MDVSA-2010:199 ] subversion (security@...driva.com)

October 13 (28 messages)

Internet Explorer Uninitialized Memory Corruption Vulnerability - CVE-2010-3331 (Rodrigo Branco <rbranco@...ckpoint.com>)
[SECURITY] [DSA 2116-1] New poppler packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Collabtive Multiple Vulnerabilities (Advisory <advisory@...toliasecurity.com>)
ubuntu 10.04 xterm heap overflow,can it be exploit ? (watercloud watercloud <watercloud@...cus.org>)
DDIVRT-2009-28 Sun Solaris 10 rpc.cmsd Buffer Overflow and Denial of Service (CVE-2010-3509) (ddivulnalert@...fronline.com)
Secunia Research: Microsoft Excel Ghost Record Type Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Microsoft Excel Record Parsing Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 2120-1] New postgresql-8.3 packages fix privilege escalation (Florian Weimer <fw@...eb.enyo.de>)
Secunia Research: Microsoft Excel Extra Out of Boundary Record Vulnerability (Secunia Research <remove-vuln@...unia.com>)
IBWAS'10 CfTraining - Deadline Approaching (Carlos SerrÃ£o <carlos.j.serrao@...il.com>)
Secunia Research: Microsoft Excel Lotus 1-2-3 File Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Re: ubuntu 10.04 xterm heap overflow,can it be exploit ? (Dan Rosenberg <dan.j.rosenberg@...il.com>)
XSS vulnerability in Ronny CMS (advisory@...ridge.ch)
XSS vulnerability in PluXml (advisory@...ridge.ch)
XSS vulnerability in Ronny CMS (advisory@...ridge.ch)
Directory Traversal Vulnerability in FreshFTP (advisory@...ridge.ch)
XSS vulnerability in PluXml (advisory@...ridge.ch)
[ MDVSA-2010:200 ] wireshark (security@...driva.com)
XSS vulnerability in PluXml (advisory@...ridge.ch)
XSS vulnerability in PluXml (advisory@...ridge.ch)
Directory Traversal Vulnerability in AnyConnect (advisory@...ridge.ch)
XSS vulnerability in Ronny CMS (advisory@...ridge.ch)
XSRF (CSRF) in Lara (advisory@...ridge.ch)
[ MDVSA-2010:202 ] krb5 (security@...driva.com)
Directory Traversal Vulnerability in Robo-FTP (advisory@...ridge.ch)
Re: XSS in Oracle default fcgi-bin/echo (paul.szabo@...ney.edu.au)
RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo ("Thor (Hammer of God)" <thor@...merofgod.com>)
[ MDVSA-2010:201 ] freetype2 (security@...driva.com)

October 14 (33 messages)

[ MDVSA-2010:203 ] automake (security@...driva.com)
R7-0037: SAP BusinessObjects Axis2 Default Admin Password (HD Moore <HD_Moore@...id7.com>)
[security bulletin] HPSBUX02351 SSRT080058 rev.5 - HP-UX Running BIND, Remote DNS Cache Poisoning (security-alert@...com)
Re: ubuntu 10.04 xterm heap overflow,can it be exploit ? (dickey@....com)
USBsploit 0.3b (xpo xpo <smashxpo@...il.com>)
[security bulletin] HPSBPI02398 SSRT080166 rev.6 - Certain HP LaserJet Printers, HP Color LaserJet Printers, and HP Digital Senders, Remot… (security-alert@...com)
[security bulletin] HPSBMA02590 SSRT100182 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Arbitrary File D… (security-alert@...com)
[security bulletin] HPSBGN02589 SSRT100296 rev.1 - HP ProCurve Access Points, Access Controllers, and Mobility Controllers, Privilege Esca… (security-alert@...com)
VUPEN Security Research - Microsoft Office Word Bookmarks Invalid Pointer Vulnerability (CVE-2010-3216) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability (CVE-2010-2750) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Formula Substream Memory Corruption (CVE-2010-3234) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel RealTimeData Array Indexing Vulnerability (CVE-2010-3240) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word Return Value Handling Vulnerability (CVE-2010-3215) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word Short Sign Memory Corruption Vulnerability (CVE-2010-3221) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Record Array Indexing Vulnerability (CVE-2010-3236) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word Document Invalid Pointer Vulnerability (CVE-2010-3217) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word Document Stack Overflow Vulnerability (CVE-2010-3214) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word Document Heap Overflow Vulnerability (CVE-2010-3218) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word BKF Objects Array Indexing Vulnerability (CVE-2010-3219) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Extra PtgExtraArray Parsing Vulnerability (CVE-2010-3239) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Formula Record Buffer Overflow Vulnerability (CVE-2010-3231) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Negative Future Function Vulnerability (CVE-2010-3238) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word LVL Structure Heap Overflow Vulnerability (CVE-2010-3220) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Formula Record Dangling Pointer Vulnerability (CVE-2010-3235) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Ghost Record Type Parsing Vulnerability (CVE-2010-3242) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Word Document Buffer Overflow Vulnerability (CVE-2010-2748) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Out-of-Bounds Memory Write Vulnerability (CVE-2010-3241) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Oracle Products HTTP Request Remote Buffer Overflow Vulnerability (CVE-2010-2390) ("VUPEN Security Research" <advisories@...en.com>)
Shmoocon 2011 Call for Papers (Bruce Potter <gdead@...oo.com>)
CORE-2010-0517 - Microsoft Office HtmlDlgHelper class memory corruption (CORE Security Technologies Advisories <advisories@...esecurity.com>)
VUPEN Security Research - Microsoft Office Word Uninitialized Pointer Vulnerability (CVE-2010-2747) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Merge Cell Record Invalid Pointer Vulnerability (CVE-2010-3237) ("VUPEN Security Research" <advisories@...en.co…)
[ MDVSA-2010:204 ] avahi (security@...driva.com)

October 15 (6 messages)

H2HC 2009 Videos Available! ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[ MDVSA-2010:205 ] freeciv (security@...driva.com)
RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo (paul.szabo@...ney.edu.au)
[USN-1004-1] Django vulnerability (Jamie Strandboge <jamie@...onical.com>)
RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo (paul.szabo@...ney.edu.au)

October 18 (19 messages)

Re: [SquirrelMail-Security] XSS in Squirrelmail plugin 'Virtual Keyboard' <= 0.9.1 (Paul Lesniewski <paul@...irrelmail.org>)
Re: [SquirrelMail-Security] XSS in Squirrelmail plugin 'Virtual Keyboard' <= 0.9.1 (Moritz Naumann <security@...itz-naumann.com>)
Re: [Full-disclosure] XSS in Oracle default fcgi-bin/echo (Riyaz Walikar <riyazwalikar@...il.com>)
Re: RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo (an@...com)
rPSA-2010-0058-1 bzip2 bzip2-extras (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2010-0059-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2010-0060-1 httpd mod_ssl (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2010-0063-1 perl (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2010-0064-1 libtiff (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2010-0065-1 krb5 krb5-server krb5-services krb5-workstation (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2010-0066-1 samba samba-client samba-server samba-swat (rPath Update Announcements <announce-noreply@...th.com>)
Secunia Research: RealPlayer QCP Sample Chunk Parsing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Xilisoft Video Converter Ultimate Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Accounting Pro 2003 Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Rafe 7 Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Brilliant Accounting System (59) Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Sahar Money Manager Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Holoo Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Antivirus detection after malware execution (jason@...bz.net)

October 19 (9 messages)

Re: [Full-disclosure] XSS in Oracle default fcgi-bin/echo (paul.szabo@...ney.edu.au)
Re: RE: [Full-disclosure] XSS in Oracle default fcgi-bin/echo (paul.szabo@...ney.edu.au)
H2HC Cancun - Registrations are open ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass (Roberto Suggi Liverani <roberto.suggi@...urit…)
[USN-1005-1] poppler vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1006-1] WebKit vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
The GNU C library dynamic linker expands $ORIGIN in setuid library search path (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Insecure SMS authorization scheme at LiqPAY micro-payments of PrivatBank (Ukraine) ("MustLive" <mustlive@...security.com.ua>)
VSR Advisories: Linux RDS Protocol Local Privilege Escalation (VSR Advisories <advisories@...curity.com>)

October 20 (12 messages)

[SECURITY] [DSA 2121-1] New TYPO3 packages fix several vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)
SQL injection in DeluxeBB (advisory@...ridge.ch)
Path disclosure in Tribiq CMS (advisory@...ridge.ch)
SQL Injection in 4site CMS (advisory@...ridge.ch)
XSS vulnerability in sNews (advisory@...ridge.ch)
XSS vulnerability in sNews (advisory@...ridge.ch)
Re: VSR Advisories: Linux RDS Protocol Local Privilege Escalation (Dan Rosenberg <drosenberg@...curity.com>)
Re: Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass (Mike Duncan <Mike.Duncan@...a.gov>)
Re: [Full-disclosure] Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy B… (Dan Kaminsky <dan@...para.com>)
[CORE-2010-0819] LibSMI smiGetNode Buffer Overflow When Long OID Is Given In Numerical Form (CORE Security Technologies Advisories <advisories@...esecurity.com…)
Re: [Full-disclosure] Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) … (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass (Michal Zalewski <lcamtuf@...edump.cx>)

October 21 (17 messages)

[USN-1007-1] NSS vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Java Multiple Issues (Early Warning <seclist@...dedsecurity.com>)
[security bulletin] HPSBMA02592 SSRT100300 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows Running Adobe Flash, Rem… (security-alert@...com)
Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple XSS Vulnerabilities (SecPod Research <research@...pod.com>)
[USN-997-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[ MDVSA-2010:208 ] pidgin (security@...driva.com)
[SecurityArchitect-009]: Microsoft Windows Mobile Double Free Vulnerability (karakorsankara@...mail.com)
[USN-998-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass (Roberto Suggi Liverani <roberto.suggi@sec…)
Micro CMS Persistent XSS Vulnerability. (SecPod Research <research@...pod.com>)
[ MDVSA-2010:207 ] glibc (security@...driva.com)
Re: [Full-disclosure] Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP… (Early Warning <seclist@...dedsecurity.c…)
Pecio CMS XSS Vulnerability (SecPod Research <research@...pod.com>)
SEC Consult SA-20101021-0 :: Multiple critical vulnerabilities in Sawmill log analysis software (Johannes Greil <research@...-consult.com>)
[security bulletin] HPSBMA02591 SSRT100299 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Cross Site Reque… (security-alert@...com)
[security bulletin] HPSBMA02596 SSRT100271 rev.1 - HP AssetCenter and HP AssetManager for AIX, HP-UX, Linux, Solaris and Windows , Remote … (security-alert@...com)
Re: Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass (Mike Duncan <Mike.Duncan@...a.gov>)

October 22 (5 messages)

[USN-1008-1] libvirt vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-1008-2] Virtinst update (Jamie Strandboge <jamie@...onical.com>)
[security bulletin] HPSBMA02593 SSRT100237 rev.1 - HP Virtual Connect Enterprise Manager (VCEM) for Windows, Remote Arbitrary File Downloa… (security-alert@...com)
[SECURITY] [DSA 2122-1] New glibc packages fix local privilege escalation (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2010:209 ] libsmi (security@...driva.com)

October 25 (12 messages)

[ MDVSA-2010:210 ] firefox (security@...driva.com)
[USN-1008-3] libvirt update (Jamie Strandboge <jamie@...onical.com>)
[ MDVSA-2010:212 ] glibc (security@...driva.com)
Vulnerabilities in W-Agora ("MustLive" <mustlive@...security.com.ua>)
[USN-1009-1] GNU C Library vulnerabilities (Kees Cook <kees@...ntu.com>)
IPv6 security myths (Fernando Gont <fernando.gont@...il.com>)
Aardvark Topsite XSS vulnerability (Yam Mesicka <yammesicka@...il.com>)
[ MDVSA-2010:211 ] mozilla-thunderbird (security@...driva.com)
The GNU C library dynamic linker will dlopen arbitrary DSOs during setuid loads. (Tavis Ormandy <taviso@...xchg8b.com>)
Re: MULTIPLE REMOTE SQL INJECTION VULNERABILITIES---MIM:InfiniX v1.2.003---> (robi@....org)
How Visual Studio Makes Your Applications Vulnerable to Binary Planting ("ACROS Security Lists" <lists@...os.si>)
[USN-959-2] PAM vulnerability (Kees Cook <kees@...ntu.com>)

October 26 (14 messages)

[security bulletin] HPSBGN02333 SSRT080031 rev.2 - HP Software Update HPeDiag Running on Windows, Remote Disclosure of Information and Exe… (security-alert@...com)
RE: [Full-disclosure] Windows Vista/7 lpksetup dll hijack ("ACROS Security Lists" <lists@...os.si>)
RE: RE: [Full-disclosure] Windows Vista/7 lpksetup dll hijack ("Thor (Hammer of God)" <thor@...merofgod.com>)
[security bulletin] HPSBMA02598 SSRT100314 rev.1 - HP Insight Control Virtual Machine Management for Windows, Remote Cross Site Scripting … (security-alert@...com)
[security bulletin] HPSBMA02597 SSRT100198 rev.1 - HP Version Control Repository Manager (VCRM) for Windows, Remote Cross Site Scripting (… (security-alert@...com)
Re: Web challenges from RootedCON'2010 CTF - Contest -> Solutions and Write-ups (Roman Medina-Heigl Hernandez <roman@...labs.com>)
Re: IPv6 security myths (Fernando Gont <fernando.gont@...il.com>)
[security bulletin] HPSBMA02599 SSRT100235 rev.1 - HP Virtual Server Environment for Windows, Remote Arbitrary File Download (security-alert@...com)
[security bulletin] HPSBMA02603 SSRT100319 rev.1 - HP Insight Control Power Management for Windows, Remote Cross Site Scripting (XSS), Cro… (security-alert@...com)
[security bulletin] HPSBMA02601 SSRT100316 rev.1 - HP Insight Control Server Migration for Windows, Remote Cross Site Scripting (XSS), Pri… (security-alert@...com)
RE: How Visual Studio Makes Your Applications Vulnerable to Binary Planting ("Michael Wojcik" <Michael.Wojcik@...rofocus.com>)
RE: RE: [Full-disclosure] Windows Vista/7 lpksetup dll hijack (Jann Horn <jannhorn@...glemail.com>)
RE: RE: [Full-disclosure] Windows Vista/7 lpksetup dll hijack ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: [vonage.com #25400427] RE: How Visual Studio Makes Your Applications Vulnerable to Binary Planting ("Mitja Kolsek" <mitja.kolsek@...os.si>)

October 27 (46 messages)

XSS vulnerability in Zomplog (advisory@...ridge.ch)
SQL injection in BloofoxCMS registration plugin (advisory@...ridge.ch)
LFI in Novaboard (advisory@...ridge.ch)
XSRF (CSRF) in Zomplog (advisory@...ridge.ch)
ACDSee Photo Manager Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
rPSA-2010-0075-1 sudo (rPath Update Announcements <announce-noreply@...th.com>)
Secunia Research: Winamp VP6 Content Parsing Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
rPSA-2010-0072-1 curl (rPath Update Announcements <announce-noreply@...th.com>)
FlipAlbum Vista Pro Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Internet Download Manager Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
[DSECRG-09-029] Oracle BI Publisher Enterprise 10 - Response Splitting (DSecRG <research@...crg.com>)
Nessus Client Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Orbit Downloader Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
SQL injection in Energine (advisory@...ridge.ch)
rPSA-2010-0073-1 lftp (rPath Update Announcements <announce-noreply@...th.com>)
LFI in DZCP (advisory@...ridge.ch)
Authentication bypass in phpLiterAdmin (advisory@...ridge.ch)
XSS vulnerability in BlogBird platform (advisory@...ridge.ch)
[security bulletin] HPSBMI02582 SSRT100269 rev.1 - Palm webOS Camera Application, Unauthorized Write Access (security-alert@...com)
[DSECRG-09-032] Oracle Application Server - Linked XSS vulnerability (DSecRG <research@...crg.com>)
Cisco Security Advisory: CiscoWorks Common Services Arbitrary Code Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
Stored XSS vulnerability in Zomplog (advisory@...ridge.ch)
rPSA-2010-0070-1 cpio tar (rPath Update Announcements <announce-noreply@...th.com>)
AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
XSS vulnerability in Zomplog (advisory@...ridge.ch)
[security bulletin] HPSBMI02580 SSRT100254 rev.1 - Palm webOS, Code execution vulnerability in Palm webOS service API (security-alert@...com)
SQL injection in DBHcms (advisory@...ridge.ch)
WinMerge Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
Breaking The SetDllDirectory Protection Against Binary Planting ("ACROS Security Lists" <lists@...os.si>)
Information disclosure in BloofoxCMS (advisory@...ridge.ch)
Information disclosure in BloofoxCMS (advisory@...ridge.ch)
CVE-2010-3700: Spring Security bypass of security constraints (s2-security <s2-security@...are.com>)
USBsploit 0.4b - added: Auto[run|play] USB infection & PDF (xpo xpo <smashxpo@...il.com>)
Re: Nessus Client Insecure Library Loading Vulnerability (Renaud Deraison <deraison@...sus.org>)
"Back with another one of those block rockin' beats" (Henri Lindberg <henri+lists@...nse.fi>)
[security bulletin] HPSBST02595 SSRT1000303 rev.1 - HP Storage Essentials Using LDAP, Remote Unauthenticated Access (security-alert@...com)
[security bulletin] HPSBST02595 SSRT1000303 rev.1 - HP Storage Essentials Using LDAP, Remote Unauthenticated Access (security-alert@...com)
[security bulletin] HPSBMA02533 SSRT080049 rev.1 - HP LoadRunner Web Tours 9.10 Remote Denial of Service (security-alert@...com)
[security bulletin] HPSBMI02573 SSRT100227 rev.1 - Palm webOS, webOS Doc Viewer, Execution of Arbitrary Code (security-alert@...com)
Secunia PSI Insecure Library Loading Vulnerability (apa-iutcert@...c.ir)
MyCart 2.0 Multiple Remote Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Path disclosure in MyBB (advisory@...ridge.ch)
rPSA-2010-0071-1 automake (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2010-0074-1 ImageMagick (rPath Update Announcements <announce-noreply@...th.com>)
XSS vulnerability in BlogBird platform (advisory@...ridge.ch)
XSS in NinkoBB (advisory@...ridge.ch)

October 28 (5 messages)

[USN-1011-1] Firefox vulnerability (Jamie Strandboge <jamie@...onical.com>)
Re: Secunia PSI Insecure Library Loading Vulnerability (Jakob Balle <jb@...unia.com>)
[ MDVSA-2010:213 ] xulrunner (security@...driva.com)
nSense-2010-002: Teamspeak 2 Windows client (Henri Lindberg <henri+lists@...nse.fi>)
[USN-1011-2] Thunderbird vulnerability (Jamie Strandboge <jamie@...onical.com>)

273 messages

Powered by blists - more mailing lists