bugtraq mailing list - 2011/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2011/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 4	⁴ 2	⁵ 11	⁶ 15	⁷ 10	⁸	⁹
¹⁰ 7	¹¹ 18	¹² 11	¹³ 6	¹⁴ 9	¹⁵	¹⁶
¹⁷ 16	¹⁸ 2	¹⁹ 4	²⁰ 6	²¹ 14	²²	²³
²⁴ 6	²⁵ 18	²⁶	²⁷ 20	²⁸ 6	²⁹	³⁰
³¹ 8

Messages by day:

January 3 (4 messages)

Announcing cross_fuzz, a potential 0-day in circulation, and more (Michal Zalewski <lcamtuf@...edump.cx>)
www.eVuln.com : SQL Injection in WikLink (bt@...ln.com)
[ACM, Ariadne Content Manager] unauth. SQL injection + user enumeration (Andrea Purificato <andrea.purificato@...il.com>)
Geeklog 1.7.1 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)

January 4 (2 messages)

Mathematica8 on Linux /tmp/MathLink vulnerability (paul.szabo@...ney.edu.au)
[DCA-00017] LinkSys BEFSR41 Multiple Stored Xss (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)

January 5 (11 messages)

www.eVuln.com : "id" SQL Injection in WikLink (bt@...ln.com)
VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap (VMware Security Team <security@...are.com>)
Plunging Through the Palo Alto Networks Firewall (Jeromie@...secinc.com)
[USN-1035-1] Evince vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Getting root, the hard way (Dan Rosenberg <dan.j.rosenberg@...il.com>)
[ MDVSA-2011:000 ] phpmyadmin (security@...driva.com)
BlogEngine.NET 1.6 Multiple Vulnerabilities (Deniz CEVIK <denizcev@...il.com>)
Multiple XSS Vulnerabilities in Openfire 3.6.4 Administrative Section ("Walikar Riyaz Ahemed Dawalmalik" <WalikarRiyazAD@...roland.com>)
Multiple CSRF Vulnerabilities in Openfire 3.6.4 Administrative Section ("Walikar Riyaz Ahemed Dawalmalik" <WalikarRiyazAD@...roland.com>)
Joomla! 1.0.x ~ 1.0.15 | Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
[ GLSA 201101-01 ] gif2png: User-assisted execution of arbitrary code (Tim Sammut <underling@...too.org>)

January 6 (15 messages)

[SECURITY] [DSA-2140-1] New libapache2-mod-fcgid packages fixes stack overflow (Stefan Fritsch <sf@...ian.org>)
Re: [ATHCON2011] CFP/ Call for Papers - AthCon IT Security Conference (Kyprianos Vasilopoulos <kyprianos@...con.org>)
[SECURITY] [DSA-2141-2] New nss packages fix protocol design flaw (Stefan Fritsch <sf@...ian.org>)
[SECURITY] [DSA-2141-1] New apache2 packages add backward compatibility option (Stefan Fritsch <sf@...ian.org>)
[SECURITY] [DSA-2141-1] New openssl packages fix protocol design flaw (Stefan Fritsch <sf@...ian.org>)
Authentication bypass in phpMySport (advisory@...ridge.ch)
Path disclousure in phpMySport (advisory@...ridge.ch)
SQL Injection in phpMySport (advisory@...ridge.ch)
SQL Injection in Phenotype CMS (advisory@...ridge.ch)
XSRF (CSRF) in PHP MicroCMS (advisory@...ridge.ch)
XSS vulnerability in WonderCMS (advisory@...ridge.ch)
SQL Injection in phpMySport (advisory@...ridge.ch)
SQL Injection in phpMySport (advisory@...ridge.ch)
XSS vulnerability in PHP MicroCMS (advisory@...ridge.ch)
[SECURITY] [DSA-2142-1] New dpkg packages fix directory traversal (Raphael Geissert <geissert@...ian.org>)

January 7 (10 messages)

[USN-1038-1] dpkg vulnerability (Kees Cook <kees@...ntu.com>)
[USN-1037-1] ifupdown update (Jamie Strandboge <jamie@...onical.com>)
[USN-1039-1] AppArmor update (Jamie Strandboge <jamie@...onical.com>)
[USN-1040-1] Django vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
GNU libc/regcomp(3) Multiple Vulnerabilities (cxib@...urityreason.com)
CUDA drivers/Linux security hole (gran@...ssic.chem.msu.su)
Re: Joomla! 1.0.x ~ 1.0.15 | Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
McAfee Commandline Updater (Technion <technion@...ware.net>)
call for participation (chpardhasaradhisarma@...il.com)
Web Hacking & Database Hijack Online Challenge ("Ivan Buetler" <ivan.buetler@...c.ch>)

January 10 (7 messages)

[ MDVSA-2011:002 ] wireshark (security@...driva.com)
Silicon Graphics Inc (SGI) - IRIX - Local Kernel Memory Disclosure/Denial of Service (Digit Security Research <research@...it-security.com>)
[ MDVSA-2011:003 ] MHonArc (security@...driva.com)
NewvCommon.ocx ActiveX Remote Code Execution Vulnerability (wsn1983@...il.com)
www.eVuln.com : "fold" and "site" SQL Injections in WikLink (bt@...ln.com)
NewV: NewvCommon.ocx arbitrary command execution via the Runcommand attribute (yuguo.cn@...il.com)
NewvCommon.ocx ActiveX Insecure Method Vulnerability (wsn1983@...il.com)

January 11 (18 messages)

[ MDVSA-2011:004 ] php-phar (security@...driva.com)
SQL injection vulnerability in Energine (advisory@...ridge.ch)
XSRF (CSRF) in VaM Shop (advisory@...ridge.ch)
Stored XSS vulnerability in diafan.CMS (advisory@...ridge.ch)
Path disclosure in Energine (advisory@...ridge.ch)
XSRF (CSRF) in Energine (advisory@...ridge.ch)
XSS vulnerability in VaM Shop (advisory@...ridge.ch)
XSS vulnerability in VaM Shop (advisory@...ridge.ch)
XSS vulnerability in VaM Shop (advisory@...ridge.ch)
XSRF (CSRF) in diafan.CMS (advisory@...ridge.ch)
XSS vulnerability in diafan.CMS (advisory@...ridge.ch)
XSRF (CSRF) in Cambio (advisory@...ridge.ch)
XSRF (CSRF) in whCMS (advisory@...ridge.ch)
ASPR #2011-01-11-1: Remote Binary Planting in Multiple F-Secure Products ("ACROS Security Lists" <lists@...os.si>)
[security bulletin] HPSBMA02621 SSRT100352 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[SECURITY] [DSA 2122-2] New glibc packages fix privilege escalation (Florian Weimer <fw@...eb.enyo.de>)
[TOOL RELEASE] T50 Sukhoi PAK FA Mixed Packet Injector v2.45r-H2HC ("Nelson Brito" <nbrito@...ure.org>)
[security bulletin] HPSBMA02557 SSRT100025 rev.2 - HP OpenView Network Node Manager (OV NNM) Running on Windows, Remote Execution of Arbit… (security-alert@...com)

January 12 (11 messages)

iDefense Security Advisory 01.10.11: HP Network Node Manager Command Injection Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
[USN-1042-1] PHP vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)
2011 Rocky Mountain Information Security Conference Call for Papers (alex.wood@...a-denver.org)
[USN-1009-2] GNU C Library vulnerability (Kees Cook <kees@...ntu.com>)
SECURITY ADVISORY IBM Cognos 8 Business Intelligence 8.4.1 ("Spala Ferenc" <spala.ferenc@...cellar.hu>)
[USN-1043-1] Little CMS vulnerability (Steve Beattie <sbeattie@...ntu.com>)
Call for Papers: DIMVA 2011 - Extended Deadline Jan 21 (Konrad Rieck <konrad.rieck@...berlin.de>)
[Onapsis Security Advisory 2011-001] SAP Management Console Unauthenticated Service Restart (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-002] SAP Management Console Information Disclosure (Onapsis Research Labs <research@...psis.com>)
[security bulletin] HPSBMA02621 SSRT100352 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[SECURITY] [DSA-2141-4] New lighttpd packages fix regression (Stefan Fritsch <sf@...ian.org>)

January 13 (6 messages)

[ MDVSA-2011:005 ] evince (security@...driva.com)
CONFidence 2011 - Call for Papers - 24-25.05.2011 Krakow, Poland (Andrzej Targosz <andrzej.targosz@...idea.org.pl>)
[security bulletin] HPSBMA02624 SSRT100195 rev.1 - HP LoadRunner, Remote Execution of Arbitrary Code (security-alert@...com)
Final Penultimate last Call for Papers for CanSecWest 2011 (deadline Jan. 17th, conf March 9-11) (Dragos Ruiu <dr@....net>)
[USN-1042-2] PHP5 regression (Steve Beattie <sbeattie@...ntu.com>)
[MajorSecurity SA-081]Contao CMS 2.9.2 - Persistent Cross Site Scripting Issue (david.kurz@...orsecurity.net)

January 14 (9 messages)

Drupal 5.x, 6.x <= Stored Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
[SECURITY] [DSA-2143-1] New mysql-dfsg-5.0 packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
[security bulletin] HPSBUX02608 SSRT100333 rev.2 - HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and … (security-alert@...com)
[ MDVSA-2011:007 ] wireshark (security@...driva.com)
[ MDVSA-2011:006 ] subversion (security@...driva.com)
[ MDVSA-2011:006 ] subversion (security@...driva.com)
Remote Code Execution in ICQ 7 (Daniel Seither <post@...oc.de>)
[ MDVSA-2011:008 ] perl-CGI (security@...driva.com)
[ MDVSA-2011:009 ] gif2png (security@...driva.com)

January 17 (16 messages)

[SECURITY] [DSA 2144-1] Security update for wireshark (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 201101-04 ] aria2: Directory traversal (Tobias Heinlein <keytoaster@...too.org>)
[ MDVSA-2011:011 ] opensc (security@...driva.com)
[ GLSA 201101-06 ] IO::Socket::SSL: Certificate validation error (Stefan Behte <craig@...too.org>)
[SECURITY] [DSA 2146-1] Security update for mydms (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 201101-02 ] Tor: Remote heap-based buffer overflow (Tim Sammut <underling@...too.org>)
[SECURITY] [DSA 2147-1] Security update for pimd (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 2145-1] Security update for libsmi (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 201101-07 ] Prewikka: password disclosure (Stefan Behte <craig@...too.org>)
[ GLSA 201101-05 ] OpenAFS: Arbitrary code execution (Stefan Behte <craig@...too.org>)
[ GLSA 201101-03 ] libvpx: User-assisted execution of arbitrary code (Tim Sammut <underling@...too.org>)
[ MDVSA-2011:010 ] xfig (security@...driva.com)
Kingsoft AntiVirus 2011 SP5.2 KisKrnl.sys <= 2011.1.13.89 Local Kernel Mode D.O.S Exploit(3 lines of code) (th_decoder@....com)
'Seo Panel' Cookie-Rendered Persistent XSS Vulnerability (CVE-2010-4331) (Mark Stanislav <mark.stanislav@...il.com>)
[SECURITY] [DSA 2148-1] Security update for tor (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2011:012 ] mysql (security@...driva.com)

January 18 (2 messages)

AST-2011-001: Stack buffer overflow in SIP channel driver ("Asterisk Security Team" <security@...erisk.org>)
[USN-1044-1] D-Bus vulnerability (Jamie Strandboge <jamie@...onical.com>)

January 19 (4 messages)

Simploo CMS Community Edition - Remote PHP Code Execution Issue (david.kurz@...orsecurity.net)
[ MDVSA-2011:013 ] hplip (security@...driva.com)
[USN-1045-1] FUSE vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1045-2] util-linux update (Marc Deslauriers <marc.deslauriers@...onical.com>)

January 20 (6 messages)

[security bulletin] HPSBMA02625 SSRT100138 rev.1 - HP OpenView Storage Data Protector, Remote Execution of Arbitrary Code (security-alert@...com)
[USN-1046-1] Sudo vulnerability (Jamie Strandboge <jamie@...onical.com>)
DotNetNuke Remote Code Execution vulnerability (Daniel Niggebrugge <Niggebrugge@...-it.com>)
SQL Injection in Pixie (advisory@...ridge.ch)
SQL Injection in Pixie (advisory@...ridge.ch)
[SECURITY] [DSA 2149-1] Security update for dbus (Nico Golde <nion@...ian.org>)

January 21 (14 messages)

[ MDVSA-2011:014 ] ccid (security@...driva.com)
[security bulletin] HPSBUX02623 SSRT100355 rev.1 - HP-UX Running Kerberos, Remote Unauthorized Modification (security-alert@...com)
[security bulletin] HPSBMA02622 SSRT100342 rev.1 - HP Business Availability Center (BAC) and Business Service Management (BSM), Remote Cro… (security-alert@...com)
[TEHTRI-Security] CVE-2010-2599: Update your BlackBerry (Laurent OUDOT at TEHTRI-Security <laurent.oudot@...tri-security.com>)
London DEFCON - DC4420 - Tuesday 25th January 2011 - SOCIAL (Major Malfunction <majormal@...ate-radio.org>)
Code execution in Microsoft Fax Cover Page Editor (Luigi Auriemma <aluigi@...istici.org>)
[ MDVSA-2011:015 ] pcsc-lite (security@...driva.com)
IETF RFC on Port Randomization (Fernando Gont <fernando.gont@...il.com>)
NSOADV-2010-010: DATEV Multiple Applications DLL Hijacking Vulnerability (NSO Research <nso-research@...iriu.de>)
[ MDVSA-2011:016 ] t1lib (security@...driva.com)
[ MDVSA-2011:017 ] tetex (security@...driva.com)
[ GLSA 201101-09 ] Adobe Flash Player: Multiple vulnerabilities (Tim Sammut <underling@...too.org>)
[ GLSA 201101-08 ] Adobe Reader: Multiple vulnerabilities (Tim Sammut <underling@...too.org>)
[ MDVSA-2011:018 ] sudo (security@...driva.com)

January 24 (6 messages)

[SECURITY] [DSA 2150-1] request-tracker3.6 security update (Thijs Kinkhorst <thijs@...ian.org>)
[USN-1047-1] AWStats vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1048-1] Tomcat vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
ESA-2011-001: RSA, The Security Division of EMC, addresses RKM 1.5 C Client SQL Injection Vulnerability (<Security_Alert@....com>)
phpcms V9 BLind SQL Injection Vulnerability (eidelweiss@...dowslive.com)
[CFP] LACSEC 2011: 6th Network Security Event for Latin America and the Caribbean (Fernando Gont <fernando.gont@...il.com>)

January 25 (18 messages)

HTB22794: Path disclousure in Pixelpost (advisory@...ridge.ch)
[DSECRG-00143] SAP Crystal Reports 2008 - ActiveX insecure methods (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DSECRG-00153] Oracle Document Capture Actbar2.ocx - insecure method (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
HTB22791: File Content Disclosure in Pixelpost (advisory@...ridge.ch)
[DSECRG-11-007] Oracle Document Capture ImportBodyText - read files (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DSECRG-11-005] Oracle Document Capture empop3.dll - insecure method (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
HTB22788: XSS in Pivotx (advisory@...ridge.ch)
[DSECRG-11-006] Oracle Document Capture ActiveX - Insecure method, buffer overflow (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
HTB22792: XSS in Pixelpost (advisory@...ridge.ch)
HTB22790: XSS in Pivotx (advisory@...ridge.ch)
[DSECRG-11-008] Open Edge RDBMS - Multiple architecture vulnerabilities (UNPATCHED) (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
HTB22789: Path disclousure in Pivotx (advisory@...ridge.ch)
HTB22787: Path disclousure in Pligg CMS (advisory@...ridge.ch)
[security bulletin] HPSBMA02624 SSRT100195 rev.2 - HP LoadRunner and HP Performace Center, Remote Execution of Arbitrary Code (security-alert@...com)
syslog-ng wrong file permission vulnerability (SZALAY Attila <sasa@...abit.hu>)
[OVSA20110118] OpenVAS Manager Vulnerable To Command Injection (Tim Brown <timb@...nvas.org>)
[DSECRG-00142] SAP Crystal Reports 2008 - actionNavjsp_xss (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DSECRG-00145] SAP Crystal Reports 2008 - Directory Traversal (Alexandr Polyakov <alexandr.polyakov@...c.ru>)

January 27 (20 messages)

[USN-1051-1] HPLIP vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[security bulletin] HPSBMA02626 SSRT100301 rev.1 - HP OpenView Storage Data Protector, Remote Denial of Service (DoS) (security-alert@...com)
Microsoft IIS 6 parsing directory �x.asp� Vulnerability (info@...uritylab.ir)
Huawei HG default WEP/WPA generator (Pedro Joaquín <pjoaquin@...il.com>)
ESA-2011-003: EMC NetWorker librpc.dll spoofing vulnerability. (<Security_Alert@....com>)
VUPEN Security Research - Novell GroupWise "TZID" Variable Remote Buffer Overflow Vulnerability (VUPEN-SR-2011-004) ("VUPEN Security Research" <advisories@...en…)
HTB22795: Path disclosure in Hycus CMS (advisory@...ridge.ch)
PRTG V8.1.2.1809 XSS Bugs in login.htm and error.htm (Joshua Gimer <jgimer@...il.com>)
Re: Remote Code Execution in ICQ 7 (Daniel Seither <post@...oc.de>)
[ MDVSA-2011:019 ] libuser (security@...driva.com)
IETF RFC on "the implementation of the TCP urgent mechanism" (Fernando Gont <fernando.gont@...il.com>)
Vanilla Forums 2.0.16 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Cisco Security Advisory: Cisco Content Services Gateway Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SECURITY] [DSA 2151-1] New OpenOffice.org packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Lomtec ActiveWeb Professional 3.0 CMS Allows Arbitrary File Upload and Execution as SYSTEM in ColdFusion (2010-WEB-002)… ("StenoPlasma @ www.ExploitDevelopment.c…)
OpenOffice.org Multiple Memory Corruption Vulnerabilities (VSR Advisories <advisories@...curity.com>)
HTB22796: Path disclousure in DBHcms (advisory@...ridge.ch)
[USN-1052-1] OpenJDK vulnerability (Steve Beattie <sbeattie@...ntu.com>)
HTB22797: Path disclousure in BLOG:CMS (advisory@...ridge.ch)
HTB22793: XSRF (CSRF) in KaiBB (advisory@...ridge.ch)

January 28 (6 messages)

CA20101231-01: Security Notice for CA ARCserve D2D (updated) ("Williams, James K" <James.Williams@...com>)
[SECURITY] [DSA 2152-1] hplip security update (Moritz Muehlenhoff <jmm@...ian.org>)
FreeBSD local denial of service - forced reboot ("HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>)
TELUS Security Labs VR - Symantec Alert Management System HNDLRSVC Arbitrary Command Execution (noreply@...us.com)
TELUS Security Labs VR - Symantec Antivirus Intel Alert Handler Service Denial of Service (noreply@...us.com)
TELUS Security Labs VR - Novell ZENworks Handheld Management ZfHIPCND.exe Buffer Overflow (noreply@...us.com)

January 31 (8 messages)

CVE-2010-3854: Apache CouchDB Cross Site Scripting Issue (Jan Lehnardt <jan@...che.org>)
[SECURITY] [DSA-2154-1] exim4 security update (Stefan Fritsch <sf@...ian.org>)
[SECURITY] [DSA-2154-2] exim4 regression fix (Stefan Fritsch <sf@...ian.org>)
[SECURITY] [DSA-2156-1] pcscd security update (Steve Kemp <skx@...ian.org>)
VirtueMart eCommerce for Joomla <= 1.1.6 Blind SQL Injection (Andrea Fabrizi <andrea.fabrizi@...il.com>)
[HITB-Announce] Reminder: HITB2011AMS - Call for Papers closes on the 18th of Feb (Hafez Kamal <aphesz@...kinthebox.org>)
[SECURITY] [DSA 2155-1] freetype security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2153-1] linux-2.6 security update (dann frazier <dannf@...ian.org>)

193 messages

Powered by blists - more mailing lists