bugtraq mailing list - 2011/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2011/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 15	²	³
⁴ 23	⁵ 7	⁶ 14	⁷ 9	⁸ 13	⁹	¹⁰
¹¹ 17	¹² 15	¹³ 24	¹⁴ 19	¹⁵ 7	¹⁶	¹⁷
¹⁸ 8	¹⁹ 21	²⁰ 20	²¹ 16	²²	²³	²⁴
²⁵ 12	²⁶ 10	²⁷ 11	²⁸ 21	²⁹ 14	³⁰

Messages by day:

April 1 (15 messages)

[ MDVSA-2011:057 ] apache (security@...driva.com)
iDefense Security Advisory 03.31.10: RealNetworks Helix DNA Server RTSP Stack Buffer Overflow (labs-no-reply <labs-no-reply@...p.vrsn.com>)
BSD derived RFC3173 IPComp encapsulation will expand arbitrarily nested payload (Tavis Ormandy <taviso@...xchg8b.com>)
[security bulletin] HPSBMA02650 SSRT100429 rev.1 - HP Operations for UNIX, Remote Cross Site Scripting (XSS), Unauthorized Access (security-alert@...com)
[ MDVSA-2011:058 ] quagga (security@...driva.com)
Microsoft VISTA TCP/IP heap buffer underflow ("J. Oquendo" <sil@...iltrated.net>)
Movie Player v4.82 0Day Buffer overflow/DOS Exploit ("^Xecuti0N3r" <xecuti0n3r@...oo.com>)
RE: [Full-disclosure] Microsoft VISTA TCP/IP heap buffer underflow ("Thor (Hammer of God)" <thor@...merofgod.com>)
6-year FreeBSD-SA-05:02.sendfile exploit (Solar Designer <solar@...nwall.com>)
[ MDVSA-2011:059 ] ffmpeg (security@...driva.com)
[security bulletin] HPSBUX02645 SSRT100387 rev.1 - HP-UX Apache Web Server, Remote Information Disclosure, Cross-Site Scripting (XSS), Den… (security-alert@...com)
[security bulletin] HPSBUX02646 SSRT100396 rev.1 - HP-UX, Local Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBUX02639 SSRT100293 rev.1 - HP-UX Running XNTP, Remote Denial of Service (DoS) (security-alert@...com)
AR Web Content Manager (AWCM) Cross-Site scripting Vulnerability (SecPod Research <research@...pod.com>)
Flag this message Windows Media player 11.0.5721.5145 Buffer overflow/DOS Exploit ("^Xecuti0N3r" <xecuti0n3r@...oo.com>)

April 4 (23 messages)

[ MDVSA-2011:060 ] ffmpeg (security@...driva.com)
[ MDVSA-2011:063 ] xmlsec1 (security@...driva.com)
XCon 2011 XFocus Information Security Conference Call for Paper (xcon@...yongxingan.com)
Re: RFI in JAF CMS (security curmudgeon <jericho@...rition.org>)
[SECURITY] [DSA 2210-1] tiff security update (Thijs Kinkhorst <thijs@...ian.org>)
Stored and Reflective XSS in Yaws-Wiki 1.88-1 (Erlang) (mike@...ewat.ch)
[ MDVSA-2011:061 ] ffmpeg (security@...driva.com)
[ MDVSA-2011:062 ] ffmpeg (security@...driva.com)
[SECURITY] [DSA 2209-1] tgt security update (Moritz Muehlenhoff <jmm@...ian.org>)
ZDI-11-041: (0day) Multiple Browser Node Processing Stack Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-115: IBM solidDB solid.exe Authentication Bypass Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
THOMSON Router XSS (edgard.chammas@...amand.edu.lb)
RealNetworks RealGames StubbyUtil.ShellCtl.1 ActiveX Control (InstallerDlg.dll v2.6.0.445) Multiple Remote Commands Execution and Code Execu… (nospam@...il.it)
Xymon monitor cross-site scripting vulnerabilities (Henrik Størner <henrik@...n.dk>)
RealNetworks RealGames StubbyUtil.ProcessMgr.1 ActiveX Control (InstallerDlg.dll v2.6.0.445) Multiple Remote Commands Execution Vulnerabilit… (nospam@...il.it)
DC4420 - London DEFCON - April meet - Wednesday 22nd April 2011 (Major Malfunction <majormal@...ate-radio.org>)
Re: DC4420 - London DEFCON - April meet - Wednesday 20th April 2011 (Adam Laurie <adam@...roup.co.uk>)
[ MDVSA-2011:064 ] libtiff (security@...driva.com)
ZDI-11-116: Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-1102-1] tiff vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-1103-1] tex-common vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Xymon monitor cross-site scripting vulnerabilities (Henri Salo <henri@...v.fi>)
[USN-1104-1] FFmpeg vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)

April 5 (7 messages)

HTB22914: Local File Inclusion in UseBB (advisory@...ridge.ch)
HTB22913: Multiple CSRF (Cross-Site Request Forgery) in UseBB (advisory@...ridge.ch)
HTB22912: Multiple SQL Injections in Eleanor CMS (advisory@...ridge.ch)
HTB22911: XSS in Eleanor CMS (advisory@...ridge.ch)
[security bulletin] HPSBMA02652 SSRT100432 rev.2 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Informa… (security-alert@...com)
StartSite.ir Cross-site Scripting Vulnerability (md.r00t.defacer@...il.com)
[ MDVSA-2011:065 ] logrotate (security@...driva.com)

April 6 (14 messages)

ICMPv6 Router Announcement flooding denial of service affecting multiple systems (Marc Heuse <mh@...sec.de>)
[USN-1105-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
Re: XSS in CompactCMS (security curmudgeon <jericho@...rition.org>)
XSS Vulnerability in Redmine 1.0.1 to 1.1.1 (Netsparker Advisories <advisories@...itunasecurity.com>)
Re: [eVuln.com] Cookie Auth Bypass in Hot Links SQL (security curmudgeon <jericho@...rition.org>)
[ MDVSA-2011:066 ] rsync (security@...driva.com)
Re: Multiple vulnerabilities in chCounter <= 3.1.3 (security curmudgeon <jericho@...rition.org>)
Re: AWCM v2.2 Auth Bypass Vulnerabilities (security curmudgeon <jericho@...rition.org>)
Sonexis ConferenceManager Multiple Cross-site Scripting (XSS) Vulnerabilities (robkraus@...utionary.com)
Sonexis ConferenceManager SQL Injection (robkraus@...utionary.com)
[SECURITY] CVE-2011-1183 Apache Tomcat security constraint bypass (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2011-1475 Apache Tomcat information disclosure (Mark Thomas <markt@...che.org>)
[USN-1106-1] NSS vulnerabilities (Micah Gersten <micah@...onical.com>)
[USN-1107-1] x11-xserver-utils vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)

April 7 (9 messages)

[SECURITY] [DSA 2211-1] vlc security update (Moritz Muehlenhoff <jmm@...ian.org>)
SEC Consult SA-20110407-0 :: Libmodplug ReadS3M Stack Overflow (SEC Consult Vulnerability Lab <research@...-consult.com>)
HTB22921: SQL Injection in Viscacha (advisory@...ridge.ch)
HTB22919: Multiple XSS in Viscacha (advisory@...ridge.ch)
HTB22915: Path disclosure in Joomla (advisory@...ridge.ch)
HTB22920: Path disclosure in Viscacha (advisory@...ridge.ch)
HTB22918: Path disclosure in phpCollab (advisory@...ridge.ch)
HTB22917: XSS vulnerabilities in phpCollab (advisory@...ridge.ch)
HTB22916: XSRF (CSRF) in phpCollab (advisory@...ridge.ch)

April 8 (13 messages)

O2 classic router: persistent cross site scripting (XSS) and cross site request forgery (CSRF) (Hanno Böck <hanno@...eck.de>)
phplist: cross site request forgery (CSRF), CVE-2011-0748 (Hanno Böck <hanno@...eck.de>)
[SECURITY] [DSA 2212-1] tmux security update (Nico Golde <nion@...ian.org>)
XSS Vulnerabilities in 1024cms Admin Control Panel v1.1.0 Beta (by_argos@...mail.com)
LFI Vulnerability in 024cms Admin Control Panel v1.1.0 Beta (Complete-Modules Package) (by_argos@...mail.com)
Directory Traversal Vulnerability in 1024cms Admin Control Panel v1.1.0 Beta (Complete-Modules Package) (by_argos@...mail.com)
XSS Vulnerability in 1024cms Admin Control Panel v1.1.0 Beta (Master-cPanel Package) (by_argos@...mail.com)
LFI Vulnerability in 1024cms Admin Control Panel v1.1.0 Beta (Master-cPanel Package) (by_argos@...mail.com)
[ MDVSA-2011:069 ] php (security@...driva.com)
[ MDVSA-2011:070 ] gdm (security@...driva.com)
[ MDVSA-2011:071 ] kdelibs4 (security@...driva.com)
[ MDVSA-2011:072 ] gwenhywfar (security@...driva.com)
joomlacontenteditor (com_jce) BLIND sql injection vulnerability (eidelweiss@...dowslive.com)

April 11 (17 messages)

[SECURITY] [DSA 2213-1] x11-xserver-utils security update (Nico Golde <nion@...ian.org>)
[SECURITY] [DSA 2214-1] ikiwiki security update (Nico Golde <nion@...ian.org>)
Re: XSRF (CSRF) in Wolf CMS (security curmudgeon <jericho@...rition.org>)
[SECURITY] [DSA 2215-1] gitolite security update (Nico Golde <nion@...ian.org>)
Arbitary File Upload Vulnerability in Elxis CMS component eForum v1.1 (by_argos@...mail.com)
[Tool] sqlmap 0.9 released (Miroslav Stampar <miroslav.stampar@...il.com>)
Linksys WRT54G - read router password from file placed on FTP (rafdw@...zta.fm)
ZDI-11-117: McAfee Firewall Reporter GeneralUtilities.pm isValidClient Authentication Bypass Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
WOOT '11 Call for Papers (reminder) (Michal Zalewski <lcamtuf@...edump.cx>)
[SECURITY] [DSA 2216-1] isc-dhcp security update (Nico Golde <nion@...ian.org>)
[ MDVSA-2011:073 ] dhcp (security@...driva.com)
[SECURITY] [DSA 2217-1] dhcp3 security update (Nico Golde <nion@...ian.org>)
ZDI-11-118: Novell ZENworks Asset Management Path Traversal File Overwrite Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.c…)
Passwords^11 - Call for Papers ending April 17! (Per Thorsheim <per@...rsheim.net>)
Vulnerabilities in Microsoft Reader and HIS (Luigi Auriemma <aluigi@...istici.org>)
rPSA-2011-0013-1 openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2011-0014-1 httpd mod_ssl (rPath Update Announcements <announce-noreply@...th.com>)

April 12 (15 messages)

[USN-1108-1] DHCP vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: [Full-disclosure] Medium severity flaw in Konqueror (Tim Brown <timb@...-dimension.org.uk>)
Medium severity flaw in Konqueror (Tim Brown <timb@...-dimension.org.uk>)
HTB22927: CSRF (Cross-Site Request Forgery) in Webjaxe (advisory@...ridge.ch)
HTB22930: Multiple XSS in WebCalendar (advisory@...ridge.ch)
Re: [Full-disclosure] Medium severity flaw in Konqueror (Vincent Danen <vdanen@...hat.com>)
HTB22925: Path disclosure in Plogger (advisory@...ridge.ch)
CFP for BugCON 2011 @ Mexico City ("Carlos A. Lozano" <vendetta@...con.org>)
[SECURITY] [DSA 2218-1] vlc security update (Nico Golde <nion@...ian.org>)
[IMF 2011] Call for Participation (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
HTB22926: XSS vulnerability in Plogger (advisory@...ridge.ch)
Stack overflow in Microsoft HTML Help 6.1 (CHM files) (Luigi Auriemma <aluigi@...istici.org>)
HTB22929: Multiple Path disclosure in WebsiteBaker (advisory@...ridge.ch)
HTB22928: Multiple SQL Injections in WebsiteBaker (advisory@...ridge.ch)
[security bulletin] HPSBPI02656 SSRT090262 rev.1 - Certain HP Photosmart Printers, Remote Unauthorized Access, Cross Site Scripting (XSS) (security-alert@...com)

April 13 (24 messages)

[ MDVSA-2011:074 ] qt4 (security@...driva.com)
ZDI-11-119: (Pwn2Own) Microsoft Internet Explorer onPropertyChange Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Announcing TakeDownCon Dallas - May 14-19 - Dallas, TX (EC-Council USA <eccouncil.usa@...il.com>)
ZDI-11-120: Microsoft Office Excel RealTimeData Record Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-124: Microsoft PowerPoint TimeColorBehaviorContainer Floating Point Record Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...ping…)
[DCA-2011-0010] TOTVS Microsiga Protheus ERP - Memory Corruption (Flavio do Carmo Junior aka waKKu <carmo.flavio@...abs.com.br>)
ZDI-11-121: Microsoft Office XP Data Validation Record Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
nSense-2011-001: VeryPDF pdf2tif (Henri Lindberg <henri+lists@...nse.fi>)
VUPEN Security Research - Microsoft Office MSO Size Handling Integer Overflow Vulnerability ("VUPEN Security Research" <advisories@...en.com>)
ZDI-11-122: RealNetworks RealPlayer OpenURLInDefaultBrowser Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-123: Microsoft PowerPoint TimeCommandBehaviorContainer Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[security bulletin] HPSBUX02655 SSRT100353 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBUX02642 SSRT100415 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows running Java, R… (security-alert@...com)
VUPEN Security Research - Microsoft Windows GDI+ Size Handling Integer Overflow Vulnerability ("VUPEN Security Research" <advisories@...en.com>)
iDefense Security Advisory 04.12.11: Microsoft Excel Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
[security bulletin] HPSBMA02643 SSRT100416 rev.2 - HP Network Node Manager i (NNMi), Local Unauthorized Read Access to Files, Remote Cross… (security-alert@...com)
iDefense Security Advisory 04.12.11: Microsoft Internet Explorer Use-After-Free Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
Re: joomlacontenteditor (com_jce) BLIND sql injection vulnerability (Stephen Brandon <stephen@...ndonitconsulting.co.uk>)
[USN-1109-1] GIMP vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[PRE-SA-2011-03] Denial-of-service vulnerability in EFI partition handling code of the Linux kernel (Timo Warns <warns@...-sense.de>)
ZDI-11-125: Microsoft Office PowerPoint PersistDirectoryEntry Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[security bulletin] HPSBUX02653 SSRT100310 rev.1 - HP-UX Running NFS/ONCplus, Remote Denial of Service (DoS) (security-alert@...com)
Microsoft Patches Binary Planting Issues In Various Vendors' Products ("ACROS Security Lists" <lists@...os.si>)
MITKRB5-SA-2011-004 kadmind invalid pointer free() [CVE-2011-0285] (Tom Yu <tlyu@....edu>)

April 14 (19 messages)

Re: ZDI-11-117: McAfee Firewall Reporter GeneralUtilities.pm isValidClient Authentication Bypass Vulnerability (nospam@...il.it)
ZDI-11-126: CA Total Defense Suite Heartbeat Web Service Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-131: CA Total Defense Suite NonAssignedUserList Stored Procedure SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-128: CA Total Defense Suite UnassignFunctionalUsers Stored Procedure SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-129: CA Total Defense Suite UnassignAdminRoles Stored Procedure SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-130: CA Total Defense Suite UNC Management Console DeleteFilter SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
The BodgeIt Store - another vulnerable web app (psiinon <psiinon@...il.com>)
CA20110413-01: Security Notice for CA Total Defense ("Kotas, Kevin J" <Kevin.Kotas@...com>)
ZDI-11-132: CA Total Defense Suite UNC Management Console DeleteReportLayout SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-133: CA Total Defense Suite UNC Management Console DeleteReports SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-134: CA Total Defense Suite UNC Management Console RegenerateReport SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
HTB22924: Arbitrary Command Execution in phpAlbum.net (advisory@...ridge.ch)
HTB22923: XSRF (CSRF) in phpAlbum.net (advisory@...ridge.ch)
HTB22922: XSS vulnerabilities in phpAlbum.net (advisory@...ridge.ch)
[security bulletin] HPSBMA02652 SSRT100432 rev.3 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Informa… (security-alert@...com)
ZDI-11-127: CA Total Defense Suite UNCWS Web Service getDBConfigSettings Credential Disclosure Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com…)
Recon 2011 - Accepted Talks , Training, Call For Papers Reminder - July 8 to 10, 2011 - Montreal, Quebec (hfortier@...on.cx)
[USN-1110-1] KDE-Libs vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
ZDI-11-135: (Pwn2Own) WebKit WBR Tag Removal Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

April 15 (7 messages)

ZDI-11-104: (Pwn2Own) Webkit CSS Text Element Count Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
VUPEN Security Research - Microsoft Internet Explorer Layouts Use-after-free Vulnerability (CVE-2011-0094) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Windows OpenType CFF Driver Stack Overflow Vulnerability (CVE-2011-0034) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Internet Explorer Property Change Memory Corruption (CVE-2011-1345) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Apple Safari Text Nodes Remote Use-after-free Vulnerability (CVE-2011-1344) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel Real Time Data Stack Overwrite Vulnerability (CVE-2011-0105) ("VUPEN Security Research" <advisories@...en.com>)
RE: THOMSON Router XSS (Auffret Patrice <Patrice.Auffret@...hnicolor.com>)

April 18 (8 messages)

Does anyone know how to contact OpenSSH non-public? (Jann Horn <jannhorn@...glemail.com>)
Announcement: ClubHACK Magazine Issue 15-April 2011 released (abhijeet@...ag.in)
Re: DC4420 - London DEFCON - April meet - Wednesday 20th April 2011 (Major Malfunction <majormal@...ate-radio.org>)
[USN-1113-1] Postfix vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
ESA-2011-013: EMC NetWorker arbitrary code execution with elevated privileges vulnerability (<Security_Alert@....com>)
ESA-2011-014: RSA, The Security Division of EMC, announces the release of Adaptive Authentication (On-Premise) Flash File Security Pat… (<Security_Alert@....com>)
cPassMan v1.82 Arbitrary File Download - SOS-11-004 ("Lists" <lists@...seofsecurity.com>)
Re: Does anyone know how to contact OpenSSH non-public? (Rico Secada <coolzone@...dk>)

April 19 (21 messages)

[SECURITY] [DSA 2219-1] xmlsec1 security update (Thijs Kinkhorst <thijs@...ian.org>)
ZDI-11-136: IBM Tivoli Directory Server ibmslapd.exe SASL Bind Request Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[DCA-2011-0011] - Ocomon Multiple SQL Injection (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)
HTB22939: Multiple SQL Injection in Universal Post Manager wordpress plugin (advisory@...ridge.ch)
HTB22932: Multiple XSS in webSPELL (advisory@...ridge.ch)
HTB22934: SQL Injection in WP-StarsRateBox wordpress plugin (advisory@...ridge.ch)
HTB22935: Multiple XSS in WP-StarsRateBox wordpress plugin (advisory@...ridge.ch)
HTB22941: CSRF (Cross-Site Request Forgery) in Dalbum (advisory@...ridge.ch)
[Annoucement] CHMag Call for Articles (abhijeet@...bhack.com)
HTB22940: XSS in SocialGrid wordpress plugin (advisory@...ridge.ch)
HTB22933: Multiple Path disclosure in webSPELL (advisory@...ridge.ch)
HTB22931: XSS vulnerability in InTerra Blog Machine (advisory@...ridge.ch)
Windows Synchronization Object Vulnerabilites in Antivirus Suites (Lists <lists@...twareintegrity.com>)
[USN-1114-1] KDENetwork vulnerability (Jamie Strandboge <jamie@...onical.com>)
[security bulletin] HPSBMA02659 SSRT100440 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Unautho… (security-alert@...com)
HTB22942: Path disclousure in Dalbum (advisory@...ridge.ch)
HTB22943: XSS in Dalbum (advisory@...ridge.ch)
HTB22937: Path disclosure in Universal Post Manager wordpress plugin (advisory@...ridge.ch)
Re: SQL Injection in LightNEasy (security curmudgeon <jericho@...rition.org>)
HTB22938: Multiple XSS in Universal Post Manager wordpress plugin (advisory@...ridge.ch)
Re: SQL Injection in LightNEasy (security curmudgeon <jericho@...rition.org>)

April 20 (20 messages)

[SECURITY] [DSA 2220-1] Request Tracker security update (Florian Weimer <fw@...eb.enyo.de>)
[USN-1108-2] DHCP vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
ZDI-11-138: Webkit Undefined DOM Prototype Attach Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[security bulletin] HPSBMA02658 SSRT100413 rev.1 - Insight Control for Linux (IC-Linux), Remote Unauthorized Elevation of Privilege, Execu… (security-alert@...com)
[security bulletin] HPSBMA02661 SSRT100408 rev.1 - HP Proliant Support Pack (PSP) Running on Linux and Windows, Remote Cross Site Scriptin… (security-alert@...com)
[security bulletin] HPSBMA02662 SSRT100409 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Unauthorized Access, … (security-alert@...com)
[SECURITY] [DSA 2221-1] Mojolicious security update (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-1118-1] OpenSLP vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
ZDI-11-137: Oracle Application Server Authentication Bypass Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-139: Webkit Anonymous Frame Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[security bulletin] HPSBMA02663 SSRT100428 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Cross Site Scrip… (security-alert@...com)
ZDI-11-140: Webkit Detached Body Element Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-1115-1] language-selector vulnerability (Kees Cook <kees@...ntu.com>)
[security bulletin] HPSBMA02660 SSRT100433 rev.1 - HP Performance Insight Running on HP-UX, Linux, Solaris, and Windows, Remote Unauthoriz… (security-alert@...com)
[USN-1116-1] Kerberos vulnerability (Kees Cook <kees@...ntu.com>)
Directory Traversal Vulnerability in Viola DVR VIO-4/1000 (by_argos@...mail.com)
[USN-1117-1] PolicyKit vulnerability (Kees Cook <kees@...ntu.com>)
[ MDVSA-2011:075 ] kdelibs4 (security@...driva.com)
[SECURITY] [DSA 2222-1] tinyproxy security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2223-1] doctrine security update (Florian Weimer <fw@...eb.enyo.de>)

April 21 (16 messages)

[USN-1119-1] Linux kernel (OMAP4) vulnerabilities (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 2224-1] openjdk-6 security update (Florian Weimer <fw@...eb.enyo.de>)
FreeBSD Security Advisory FreeBSD-SA-11:01.mountd (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[security bulletin] HPSBMA02664 SSRT100417 rev.1 - HP Insight Control Performance Management for Windows, Remote Privilege Elevation, Cros… (security-alert@...com)
[security bulletin] HPSBMA02665 SSRT100185 rev.1 - HP Virtual Server Environment for Windows, Remote Privilege Elevation (security-alert@...com)
CA20110420-02: Security Notice for CA Output Management Web Viewer ("Williams, James K" <James.Williams@...com>)
CA20110420-01: Security Notice for CA SiteMinder ("Williams, James K" <James.Williams@...com>)
HTB22947: XSS in Ajax Category Dropdown wordpress plugin (advisory@...ridge.ch)
HTB22946: Multiple SQL Injection in Ajax Category Dropdown wordpress plugin (advisory@...ridge.ch)
HTB22945: Multiple XSS in ZENphoto (advisory@...ridge.ch)
HTB22950: SQL injection in 4images (advisory@...ridge.ch)
HTB22949: Multiple Path disclousure in 4images (advisory@...ridge.ch)
HTB22944: Path disclousure in ZENphoto (advisory@...ridge.ch)
hack.lu 2011 CFP ("hack.lu 2011 information team" <hl2011@...k.lu>)
[USN-1120-1] tiff vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2011:076 ] xrdb (security@...driva.com)

April 25 (12 messages)

AST-2011-005: File Descriptor Resource Exhaustion ("Asterisk Security Team" <security@...erisk.org>)
[ MDVSA-2011:077 ] krb5 (security@...driva.com)
[security bulletin] HPSBMA02667 SSRT100464 rev.1 - HP SiteScope, Cross Site Scripting (XSS) and HTML Injection (security-alert@...com)
[security bulletin] HPSBMA02666 SSRT100434 rev.1 - HP Network Automation Running on Linux, Solaris, and Windows, Remote Information Disclo… (security-alert@...com)
[ACM CCS'11] Reminder: Deadline Approaching (May 6, 2011) (ACM CCS 2011 <acmccs2011@...il.com>)
[DSECRG-11-018] Kaspersky administration Kit - Remote code execution via SMBRelay (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
AT-TFTP Server Remote Denial of Service Vulnerability (SecPod Research <research@...pod.com>)
[ MDVSA-2011:078 ] libtiff (security@...driva.com)
XSS in Webmin 1.540 + exploit for privilege escalation (Javier Bassi <javierbassi@...il.com>)
AST-2011-006: Asterisk Manager User Shell Access ("Asterisk Security Team" <security@...erisk.org>)
Re: HTB22945: Multiple XSS in ZENphoto (Christian Kujau <lists@...dbynature.de>)
[TOOL RELEASE] T50 - an Experimental Mixed Packet Injector ( v5.3) ("Nelson Brito" <nbrito@...ure.org>)

April 26 (10 messages)

Re: SQL Injection in phpMySport (security curmudgeon <jericho@...rition.org>)
Re: [DSECRG-11-018] Kaspersky administration Kit - Remote code execution via SMBRelay ("Vladimir '3APA3A' Dubrovin" <3APA3A@...urityvulns.ru>)
HTB22953: XSS in Max's PHP Photo Album (advisory@...ridge.ch)
HTB22957: XSRF (CSRF) in phpList (advisory@...ridge.ch)
HTB22956: XSS vulnerabilities in phpList (advisory@...ridge.ch)
HTB22954: Path disclousure in yappa-ng Photo Gallery (advisory@...ridge.ch)
HTB22951: XSS in WP-Ajax-Recent-Posts wordpress plugin (advisory@...ridge.ch)
HTB22948: Path disclosure in Cotonti (advisory@...ridge.ch)
HTB22952: XSS vulnerabilities in Noah's Classifieds (advisory@...ridge.ch)
HTB22955: Path disclosure in BuddyPress WordPress plugin (advisory@...ridge.ch)

April 27 (11 messages)

[security bulletin] HPSBMA02654 SSRT100441 rev.1 - HP OpenView Storage Data Protector, Remote Execution of Arbitrary Code (security-alert@...com)
[SECURITY] [DSA 2225-1] asterisk security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2226-1] libmodplug security update (Moritz Muehlenhoff <jmm@...ian.org>)
CA20110426-01: Security Notice for CA Arcot WebFort Versatile Authentication Server ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[security bulletin] HPSBMA02667 SSRT100464 rev.2 - HP SiteScope, Cross Site Scripting (XSS) and HTML Injection (security-alert@...com)
Re: Stored XSS vulnerability in diafan.CMS (security curmudgeon <jericho@...rition.org>)
B-Sides Vienna | NinjaCon 11 Call For Participation (astera <a.schneeweisz@...il.com>)
NGS00068 Patch Notification: LibAVCodec AMV Out of Array Write ("Research@...Secure" <research@...secure.com>)
[USN-1124-1] rsync vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Cisco Security Advisory: Cisco Wireless LAN Controllers Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Manager (Cisco Systems Product Security Incident Response Team <psirt@...co.co…)

April 28 (21 messages)

[USN-1125-1] PCSC-Lite vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
HTB22965: Multiple XSS vulnerabilities in BackupPC (advisory@...ridge.ch)
CFP: Hacktivity 2011, September 17-18, Budapest, Hungary (jozsef.tiborcz@...ktivity.com)
HTB22958: XSS in phpGraphy (advisory@...ridge.ch)
hashdays 2011 - Call for Papers (#days CFP) (Hashdays CFP <cfp@...con-switzerland.org>)
HTB22959: CSRF (Cross-Site Request Forgery) in phpGraphy (advisory@...ridge.ch)
HTB22961: XSS in WP Photo Album wordpress plugin (advisory@...ridge.ch)
HTB22960: XSS in Daily Maui Photo Widget wordpress plugin (advisory@...ridge.ch)
ZDI-11-143: Cisco Unified CallManager xmldirectorylist.jsp SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[Onapsis Security Advisory 2011-010] Oracle JD Edwards JDENET Remote Logging Deactivation (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-005] SAP Enterprise Portal Path Disclosure (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-008] Oracle JD Edwards JDENET CallObjectKernel Remote Command Execution (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-011] Oracle JD Edwards JDENET Buffer Overflow (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-012] Oracle JD Edwards JDENET Firewall Bypass (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-013] Oracle JD Edwards JDENET USRBROADCAST Denial of Service (Onapsis Research Labs <research@...psis.com>)
VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Co… (VMware Security Team <security@...are.c…)
[Onapsis Security Advisory 2011-006] Oracle JD Edwards JDENET Kernel Denial of Service (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-009] Oracle JD Edwards JDENET SawKernel Remote Password Disclosure (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-007] Oracle JD Edwards JDENET Kernel Shutdown (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-004] SAP WebAS ITS Mobile Test Service Multiple Vulnerabilities (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2011-003] SAP WebAS ITS Mobile Start Service Multiple Vulnerabilities (Onapsis Research Labs <research@...psis.com>)

April 29 (14 messages)

[security bulletin] HPSBMA02668 SSRT100474 rev.1 - HP OpenView Storage Data Protector, Remote Execution of Arbitrary Code (security-alert@...com)
Re: HTB22827: File Content Disclosure in Wikipad (security curmudgeon <jericho@...rition.org>)
ESA-2011-015: RSA, The Security Division of EMC, announces a fix for a security vulnerability in RSA Data Loss Prevention (<Security_Alert@....com>)
ZDI-11-144: HP Data Protector Backup Client Service EXEC_BAR Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-145: HP Data Protector Backup Client Service GET_FILE Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-146: HP Data Protector Backup Client Service EXEC_SCRIPT Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-147: HP Data Protector Backup Client Service EXEC_INTEGUTIL Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-148: HP Data Protector Backup Client Service stutil Message Processing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoin…)
ZDI-11-149: HP Data Protector Backup Client Service HPFGConfig Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-150: HP Data Protector Backup Client Service omniiaputil Message Processing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pin…)
ZDI-11-151: HP Data Protector Backup Client Service bm Message Processing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.co…)
ZDI-11-152: HP Data Protector Backup Client Service GET_FILE Directory Traversal Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-153: Embarcadero Interbase connect Request Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-1126-1] PHP vulnerabilities (Steve Beattie <sbeattie@...ntu.com>)

296 messages

Powered by blists - more mailing lists