bugtraq mailing list - 2011/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2011/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 7	² 2	³ 1
⁴ 9	⁵ 16	⁶ 21	⁷ 10	⁸ 6	⁹ 4	¹⁰ 2
¹¹ 12	¹² 7	¹³ 4	¹⁴	¹⁵ 9	¹⁶ 1	¹⁷ 1
¹⁸ 10	¹⁹ 3	²⁰ 6	²¹ 16	²²	²³	²⁴
²⁵ 20	²⁶ 19	²⁷ 20	²⁸ 28	²⁹ 9	³⁰	³¹

Messages by day:

July 1 (7 messages)

Ashampoo 3D CAD Professional 3 ActiveX control Insecure Method (advisory@...ridge.ch)
Re: OpenSSH 3.5p1 Remote Root Exploit for FreeBSD (Darren Tucker <dtucker@....com.au>)
SEC Consult SA-20110701-0 :: Multiple SQL injection vulnerabilities in WordPress (SEC Consult Vulnerability Lab <research@...-consult.com>)
Working Remote Root Exploit for OpenSSH 3.4p1 (FreeBSD) ("HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>)
Re: Working Remote Root Exploit for OpenSSH 3.4p1 (FreeBSD) ("HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>)
Re: Working Remote Root Exploit for OpenSSH 3.4p1 (FreeBSD) (Benji <me@...ji.com>)
ZDI-11-232: HP iNode Management Center iNodeMngChecker.exe Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

July 2 (2 messages)

Multiple vulnerabilities in Winamp 5.61 (Luigi Auriemma <aluigi@...istici.org>)
AST-2011-011: Possible enumeration of SIP users due to differing authentication responses ("Asterisk Security Team" <security@...erisk.org>)

July 3 (1 message)

Resolved - NNT Change Tracker - Hard-Coded Encryption Key - Originally posted as http://seclists.org/fulldisclosure/2011/May/4… ("NNT Support" <support@...ws.com>)

July 4 (9 messages)

Re: Resolved - NNT Change Tracker - Hard-Coded Encryption Key Originally posted as http://seclists.org/fulldisclosure/2011/May/460 (dennis.brunnen@...il.com)
bcksrvr format string in Sybase Adaptive Server 15.5 (Luigi Auriemma <aluigi@...istici.org>)
Upload directory traversal in Novell ZenWorks Handheld Management 7.0.2 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 2271-1] curl security update (Giuseppe Iuculano <iuculano@...ian.org>)
Multiple Cross-Site Scripting vulnerabilities in WebCalendar (sschurtz@...nline.de)
Arbitrary files deletion in HP OpenView Performance Agent (Luigi Auriemma <aluigi@...istici.org>)
[security bulletin] HPSBMU02686 SSRT100541 rev.3 - HP OpenView Storage Data Protector, Remote Execution of Arbitrary Code (security-alert@...com)
in_midi multiple vulnerabilities in Winamp 5.61 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 2266-1] php5 security update (Moritz Muehlenhoff <jmm@...ian.org>)

July 5 (16 messages)

[security bulletin] HPSB3C02687 SSRT100377 rev.1 - HP Intelligent Management Center User Access Manager (UAM) and Endpoint Admission Defen… (security-alert@...com)
Re: Perfect PDF products distributed with vulnerable MSVC++ libraries (Jeffrey Walton <noloader@...il.com>)
Spring Source OXM Remote OS Command Injection when XStream and IBM JRE are used (pierre.ernst@...ibm.com)
NetBSD 5.1 libc/net multiple functions stack buffer overflow (cxib@...urityreason.com)
[SECURITY] [DSA 2267-1] perl security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2268-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2262-2] php5 update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2269-1] iceape security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2270-1] qemu-kvm security update (Moritz Muehlenhoff <jmm@...ian.org>)
Vega beta release: a new open-source web-application security assessment platform (David Mirza <dma@...graph.com>)
NGS00062 Patch Notification: Apple Mac OS X ImageIO TIFF Heap Overflow ("Research@...Secure" <research@...secure.com>)
NGS00051 Technical Advisory: Cisco VPN Client Privilege Escalation ("Research@...Secure" <research@...secure.com>)
NGS00052 Technical Advisory: Apple Mac OS X Image RAW Multiple Buffer Overflows ("Research@...Secure" <research@...secure.com>)
Multiple vulnerabilities in Open-Realty (advisory@...ridge.ch)
XSS in FlatPress (advisory@...ridge.ch)
NGS00057 Technical Advisory: Apple Mac OS X ImageIO Integer Overflow ("Research@...Secure" <research@...secure.com>)

July 6 (21 messages)

Ubuntu: reseed(8), random.org, and HTTP request (Jeffrey Walton <noloader@...il.com>)
Re: Ubuntu: reseed(8), random.org, and HTTP request (coderman <coderman@...il.com>)
Re: Ubuntu: reseed(8), random.org, and HTTP request (Jeffrey Walton <noloader@...il.com>)
Re: Ubuntu: reseed(8), random.org, and HTTP request (Jeffrey Walton <noloader@...il.com>)
Re: in_midi multiple vulnerabilities in Winamp 5.61 (Henri Salo <henri@...v.fi>)
Re: Ubuntu: reseed(8), random.org, and HTTP request (Jamie Strandboge <jamie@...onical.com>)
Re: SEC Consult SA-20110701-0 :: Multiple SQL injection vulnerabilities in WordPress (Henri Salo <henri@...v.fi>)
Integer overflow in foobar2000 1.1.7 (Luigi Auriemma <aluigi@...istici.org>)
Re: Ubuntu: reseed(8), random.org, and HTTP request (Jonathan Le Vigouroux <jonathan.levigouroux@...il.com>)
NGS00060 Technical Advisory: Blue Coat BCAAA Remote Code Execution Vulnerability ("Research@...Secure" <research@...secure.com>)
MITKRB5-SA-2011-005 FTP daemon fails to set effective group ID [CVE-2011-1526] (Tom Yu <tlyu@....EDU>)
[SECURITY] [DSA 2272-1] bind9 security update (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBUX02688 SSRT100513 rev.1 - HP-UX Dynamic Loader, Local Privilege Escalation, Denial of Service (DoS) (security-alert@...com)
Fwd: RFC 6274 on Security Assessment of the Internet Protocol Version 4 (Fernando Gont <fernando@...t.com.ar>)
IDrive Online Backup ActiveX control Insecure Method (advisory@...ridge.ch)
aTube Catcher ActiveX Control Insecure Method (advisory@...ridge.ch)
Re: Multiple Cross-Site Scripting vulnerabilities in WebCalendar (Henri Salo <henri@...v.fi>)
Cisco Security Advisory: Cisco Content Services Gateway Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Arbitrary files deletion in HP OpenView Communication Broker (Luigi Auriemma <aluigi@...istici.org>)
Re: Ubuntu: reseed(8), random.org, and HTTP request (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Ubuntu: reseed(8), random.org, and HTTP request (Michal Zalewski <lcamtuf@...edump.cx>)

July 7 (10 messages)

Security Advisory: CVE-2011-2516 ("Cantor, Scott E." <cantor.2@....edu>)
Security Advisory: CVE-2011-2464 - ISC BIND 9 Remote packet Denial of Service against Authoritative and Recursive Servers (Barry Greene <bgreene@....org>)
Security Advisory: CVE-2011-2516 ("Cantor, Scott E." <cantor.2@....edu>)
Re: Re: Multiple Cross-Site Scripting vulnerabilities in WebCalendar (sschurtz@...nline.de)
Aruba Advisory AID-070611 Cross Site Scripting vulnerability in ArubaOS and AirWave Administration Web Interfaces (RGill <rgill@...banetworks.com>)
Security Advisory: CVE-2011-2465 ISC BIND 9 Remote Crash with Certain RPZ Configurations (Barry Greene <bgreene@....org>)
[SECURITY] [DSA 2273-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBMA02674 SSRT100487 rev.2 - HP Service Manager and HP Service Center, Unauthorized Remote Access, Unsecured Local A… (security-alert@...com)
phpMyAdmin 3.x Multiple Remote Code Executions (Mango <h@...r.se>)
ZDI-11-233: Symantec Web Gateway forget.php SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

July 8 (6 messages)

Detailes of the latest phpMyAdmin flaws (Mango <h@...r.se>)
Binary Planting Goes "Any File Type" ("ACROS Security Lists" <lists@...os.si>)
Re: Binary Planting Goes "Any File Type" (kyle kemmerer <krkemmerer@...il.com>)
Re: Binary Planting Goes "Any File Type" (Dan Kaminsky <dan@...para.com>)
Re: Binary Planting Goes "Any File Type" (anonymous-tips@...hmail.me)
phpMyAdmin 3.x preg_replace RCE POC (Mango <h@...r.se>)

July 9 (4 messages)

Re: Binary Planting Goes "Any File Type" (Dan Kaminsky <dan@...para.com>)
Re: Binary Planting Goes "Any File Type" (Mitja Kolsek <mitja.kolsek@...ossecurity.com>)
Re: Binary Planting Goes "Any File Type" (Mario Vilas <mvilas@...il.com>)
Re: Binary Planting Goes "Any File Type" (Mitja Kolsek <mitja.kolsek@...ossecurity.com>)

July 10 (2 messages)

Re: Binary Planting Goes "Any File Type" (Thierry Zoller <Thierry@...ler.lu>)
Re: Binary Planting Goes "Any File Type" (Mitja Kolsek <mitja.kolsek@...ossecurity.com>)

July 11 (12 messages)

ZDI-11-234: Trend Micro Control Manager CasLogDirectInsertHandler.cs Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
bcksrvr format string in Sybase Adaptive Server 15.5 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 2274-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2275-1] openoffice.org security update (Nico Golde <nico@...lde.de>)
[HITB-Announce] REMINDER: HITB2011 - Malaysia Call for Papers Closes on the 15th (Hafez Kamal <aphesz@...kinthebox.org>)
Alice (Telefonica Germany) Modem 1111 DoS + XSS (Moritz Naumann <security@...itz-naumann.com>)
Wireshark 1.4.0 Malformed IKE Packet Denial of Service (vuln@...c.org.cn)
[SECURITY] [DSA 2276-1] asterisk security update (Luciano Bello <luciano@...ian.org>)
POC2011 Call for Paper (pocadm@...il.com)
Ferdows CMS Pro <=1.1.0 and Ferdows CMS <=9.0.5 Multiple Vulnerabilities (admin@...report.ir)
phpMyAdmin 3.x Multiple Remote Code Executions (Mango <h@...r.se>)
[security bulletin] HPSBMU02690 SSRT100569 rev.1 - HP Business Availability Center (BAC) Running on Solaris and Windows, Remote Denial of … (security-alert@...com)

July 12 (7 messages)

[SECURITY] [DSA 2277-1] xml-security-c security update (Nico Golde <nion@...ian.org>)
[security bulletin] HPSBUX02689 SSRT100494 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) (security-alert@...com)
Re: Binary Planting Goes "Any File Type" (Aleksandr Yampolskiy <ayampolskiy@...t.com>)
ZDI-11-235: TrendMicro Control Manager CASProcessor.exe BLOB Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[SECURITY] [DSA 2276-2] asterisk regression update (Luciano Bello <luciano@...ian.org>)
Tugux CMS 1.2 Multiple vulnerability (BLIND sql & xss) (randy@...elweiss.info)
[Announcement] ClubHack Magazine Issue 18-July2011 Released (abhijeet@...bhack.com)

July 13 (4 messages)

[SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities (Mark Thomas <markt@...che.org>)
DC4420 - London DEFCON - July meet - Tuesday 19th July 2011 (Major Malfunction <majormal@...ate-radio.org>)
Re: DC4420 - London DEFCON - July meet - Tuesday 19th July 2011 (Major Malfunction <majormal@...ate-radio.org>)
[oCERT-2011-001] Chyrp input sanitization errors (Andrea Barisani <lcars-2R2EBYZCiwbYtjvyW6yDsg@...lic.gmane.org>)

July 15 (9 messages)

Static Analysis Tool Exposition (SATE) - Call for Participation ("Delaitre, Aurelien" <aurelien.delaitre@...t.gov>)
CVE-2010-2404 | Persistent Cross Site Scripting Vulnerability in Oracle I-Recruitment - E-Business Suite (Aditya K Sood <0kn0ck@...niche.org>)
[Annoucement] ClubHack Magazine - Call for Articles (abhijeet@...bhack.com)
Paltalk Messenger ActiveX Control Multiple Insecure Methods (advisory@...ridge.ch)
Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal() Remote Registry Dump Vulnerability (nospam@...il.it)
Torque Server Buffer Overflow Vulnerability (pi3@...ec.pl)
Re: Wireshark 1.4.0 Malformed IKE Packet Denial of Service (gerald@...eshark.org)
[SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities (Mark Thomas <markt@...che.org>)
iDefense Security Advisory 07.14.11: Citrix Access Gateway ActiveX Stack Buffer Overflow Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)

July 16 (1 message)

Interactive World SQL Injection Vulnerability [ Multiple Vulnerabilities ] (cyber netron <cybernetron@...il.com>)

July 17 (1 message)

Digging Inside VxWorks (OS + Firmware) - The Holistic Security (SecNiche Security Labs <0kn0ck@...niche.org>)

July 18 (10 messages)

ESA-2011-022: EMC Documentum eRoom Indexing Server HummingBird Client Connector Buffer Overflow Vulnerability (<Security_Alert@....com>)
APPLE-SA-2011-07-15-2 iOS 4.2.9 Software Update for iPhone (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2011-07-15-1 iOS 4.3.4 Software Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 2254-2] oprofile security update (luciano@...ian.org (Luciano Bello))
[SECURITY] [DSA 2278-1] horde3 security update (white@...ian.org (Steffen Joeris))
Reminder - DeepSec 2011 Call For Papers (DeepSec Conference <deepsec@...psec.net>)
Call for Papers: ICITST-2011 (Call for papers <call.for.papers.is@...il.com>)
ZDI-11-236: EMC Documentum eRoom Indexing Server OpenText HummingBird Connector Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpo…)
[ MDVSA-2011:112 ] blender (security@...driva.com)
[ MDVSA-2011:114 ] blender (security@...driva.com)

July 19 (3 messages)

"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>, (cyber netron <cybernetron@...il.com>)
[SECURITY] [DSA 2279-1] libapache2-mod-authnz-external security update (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 2280-1] libvirt security update (white@...ian.org (Steffen Joeris))

July 20 (6 messages)

H2HC Brazil (Hackers 2 Hackers Conference) 8th Edition - Call for Papers ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
Oracle Sun GlassFish Enterprise Server Stored XSS Vulnerability - Security Advisory - SOS-11-009 ("Lists" <lists@...seofsecurity.com>)
HTC / Android OBEX FTP Service Directory Traversal Vulnerability (alberto.morenot@...il.com)
OSI Security: Elitecore Cyberoam UTM - Authenticated Cross-Site Scripting Vulnerability (Patrick Webster <patrick@...security.com.au>)
XSS in Tiki Wiki CMS Groupware (advisory@...ridge.ch)
[ MDVSA-2011:115 ] bind (security@...driva.com)

July 21 (16 messages)

APPLE-SA-2011-07-20-1 Safari 5.1 and Safari 5.0.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Cisco Security Advisory: Cisco ASR 9000 Series Routers Line Card IP Version 4 Denial of Service Vulnerability (Cisco Systems Product Security Incident Response …)
ZDI-11-237: CA Total Defense Suite Gateway Security Malformed HTTP Packet Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.co…)
Cisco Security Advisory: Cisco SA 500 Series Security Appliances Web Management Interface Vulnerabilities (Cisco Systems Product Security Incident Response Team…)
CA20110720-01: Security Notice for CA Gateway Security and Total Defense ("Kotas, Kevin J" <Kevin.Kotas@...com>)
Securstar - DriveCrypt - Local Kernel Denial of Service/Memory Disclosure/Privilege Escalation (Digit Security Research <research@...it-security.com>)
[SECURITY] [DSA 2281-1] opie security update (white@...ian.org (Steffen Joeris))
iDefense Security Advisory 07.20.11: Multiple Vendor WebKit MathML Use-After-Free Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
iDefense Security Advisory 07.20.11: Safari WebKit TIFF Use-After-Free Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
iDefense Security Advisory 07.20.11: Multiple Vendor WebKit frameset style Heap Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
iDefense Security Advisory 07.20.11: Apple Safari innerText Use-After-Free Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
iDefense Security Advisory 07.20.11: Multiple Vendor WebKit SVG animVal Memory Corruption Vulnerability (labs-no-reply <labs-no-reply@...p.vrsn.com>)
Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability (fb1h2s Hack 2 Secure <fb1h2s@...il.com>)
Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure (adic@...ibm.com)
ZDI-11-238: Oracle Secure Backup validate_login Command Injection Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Foxit Reader Insecure Library Loading (robkraus@...tionary.com)

July 25 (20 messages)

Permutation Oriented Programming ("Nelson Brito" <nbrito@...ure.org>)
Joomla! 1.7.0-RC and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
[ MDVSA-2011:116 ] curl (security@...driva.com)
[ MDVSA-2011:117 ] krb5-appl (security@...driva.com)
Hiding Backdoors in plain sight, again (CoreTex Team <lists@...esecurity.com>)
Re: [Full-disclosure] [Bkis] sNews 1.7.1 XSS vulnerability (Henri Salo <henri@...v.fi>)
[ MDVSA-2011:118 ] wireshark (security@...driva.com)
CobraScripts (search_result.php?cid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
phpMyAdmin 3.x Conditional Session Manipulation (Mango <h@...r.se>)
NGS00042 Patch Notification: Solaris USB configuration descriptor kernel stack overflow ("Research@...Secure" <research@...secure.com>)
[SECURITY] [DSA 2282-1] qemu-kvm security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2283-1] krb5-appl security update (Moritz Muehlenhoff <jmm@...ian.org>)
phpBB AJAX Chat/Shoutbox MOD CSRF Vulnerability (spamgoeshere@...venroddis.com)
[SECURITY] [DSA 2284-1] opensaml2 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2011:119 ] libsndfile (security@...driva.com)
[DSB-2011-01] Security Advisory FreeRADIUS 2.1.11 (advisory@...-cert.de)
OWASP AppSec USA 2011 Pre-conference Challenge #3 - July (adam.baso@...sp.org)
APPLE-SA-2011-07-20-2 iWork 9.1 Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2011-07-25-1 iOS 4.3.5 Software Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2011-07-25-2 iOS 4.2.10 Software Update for iPhone (Apple Product Security <product-security-noreply@...ts.apple.com>)

July 26 (19 messages)

TWSL2011-007: iOS SSL Implementation Does Not Validate Certificate Chain (Trustwave Advisories <trustwaveadvisories@...stwave.com>)
[SECURITY] [DSA 2285-1] mapserver security update (Nico Golde <nico@...lde.de>)
PHP-Barcode 0.3pl1 Remote Code Execution (beford <xbefordx@...il.com>)
CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials Disclosure and Commands Execution (nospam@...il.it)
Zones Web Solution (index.php?manufacturers_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Funnel Web (items.php?&cat_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Funnel Web (directory.php?cid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Funnel Web (selected_product.php?t) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Funnel Web (pages.php?page) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Indonesia Web Design (link-directory.php?cid) (link-directory.php?pid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
DotComEgypt (products.php?cat_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Precision (products.php?cat_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Lava (news_item.php?id) (album.php?id) (basket.php?baction) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
[PT-2011-08] Multiple vulnerabilities in Dlink DPH 150SE/E/F1 (noreply@...ecurity.ru)
[PT-2011-25] SQL injection vulnerabilities in Support Incident Tracker (noreply@...ecurity.ru)
[PT-2011-05] Cross-Site Scripting in Koha Library Software (noreply@...ecurity.ru)
Hacking IPv6 Networks (slides) (Fernando Gont <fgont@...kingipv6networks.com>)
Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials ("Williams, James K" <James.Williams@...com>)
[Tool] DoS for OpenSLP (and others) (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)

July 27 (20 messages)

[SECURITY] [DSA 2286-1] phpmyadmin security update (Thijs Kinkhorst <thijs@...ian.org>)
ESA-2011-024: EMC Captiva eInput multiple vulnerabilities (<Security_Alert@....com>)
ESA-2011-021: EMC Data Protection Advisor sensitive information disclosure vulnerability (<Security_Alert@....com>)
Agent Image (news_details.php?news_ID) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
SA500 vulnerabilities - details (michal.sajdak@...uritum.pl)
[ MDVSA-2011:120 ] freetype2 (security@...driva.com)
G2webCMS (products.php?cat_id) (member-profile.php?profile) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
iCube Lab (product_details.php?cat_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Solutiontech (product.php?cat_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Chrome Web Solutions (details.php?cat_id) (listing_more.php?id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Multiple XSS in GBook PHP guestbook (advisory@...ridge.ch)
Redirection vulnerability in MBoard (advisory@...ridge.ch)
[ MDVSA-2011:121 ] samba (security@...driva.com)
ZDI-11-239: Apple Safari Webkit FrameOwner Element Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-240: Apple Safari Webkit SVG Marker Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-241: Webkit setAttributes attributeChanged Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-242: Apple Safari Rendering Object Body Detachment Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-11-243: WebKit ContentEditable Inline Style Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Dow Group (dynamic.php?id) (sub.php?solutioncat_id) (news_desc.php?id) (product.php?id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
FootBall Cms (view_table_lig.php?group) XSS Vulnerability (ehsan_hp200@...mail.com)

July 28 (28 messages)

TeamSHATTER Security Advisory: Oracle Enterprise Manager vulnerable to XSS (notifRuleInfo$mode page) (Shatter <shatter@...secinc.com>)
TeamSHATTER Security Advisory: Oracle Enterprise Manager vulnerable to XSS (sitemap page) (Shatter <shatter@...secinc.com>)
TeamSHATTER Security Advisory: Oracle Enterprise Manager vulnerable to XSS (metricDetail$type page) (Shatter <shatter@...secinc.com>)
Coherendz (products.php?cat_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
WOC Consulting (search_result.php?cid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Canoy Softwares (search_result.php?loc_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Zones Web Solution (StoneDetails.php?stone) XSS Vulnerability (ehsan_hp200@...mail.com)
Zones Web Solution (status.asp?print) (search_result.php?loc_id) Remote SQL injection Vulnerabilities (ehsan_hp200@...mail.com)
Web Fusion Nepal (tour.php?category) XSS Vulnerability (ehsan_hp200@...mail.com)
Avon Groups (search_result.php?cid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Web Fusion Nepal (find.php?id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Infocus Web Solutions (news_desc.php?id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
A1 Solutions (cat_sell.php?cid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
indiacon (selloffers.php?cid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
CobraScripts (selloffers.php?cid) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
Wireshark 1.6.1 Malformed IKE Packet Denial of Service (vuln@...c.org.cn)
Re: [Full-disclosure] [BMSA-2009-07] Backdoor in PyForum (Henri Salo <henri@...v.fi>)
Two security issues fixed in ioQuake3 engine (Thilo Schulz <thilo@...s.eu>)
[security bulletin] HPSBMU02692 SSRT100581 rev.2 - HP SiteScope, Remote Cross Site Scripting (XSS) and Session Fixation Attack (security-alert@...com)
[SECURITY] [DSA 2287-1] libpng security update (Luciano Bello <luciano@...ian.org>)
[security bulletin] HPSBMU02693 SSRT100583 rev.1 - HP Network Automation Running on Linux, Solaris, and Windows, Remote SQL Injection, Cro… (security-alert@...com)
[security bulletin] HPSBMU02669 SSRT100346 rev.3 - HP Data Protector Media Management Daemon (mmd), Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBUX02689 SSRT100494 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBMU02691 SSRT100483 rev.2 - HP Performance Agent and HP Operations Agent, Remote Arbitrary File Deletion (security-alert@...com)
Gopal Systems (products.php?cat_id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
n.runs-SA-2011.001 - Citrix XenApp / XenDesktop Stack-Based Buffer Overflow (<security@...ns.com>)
n.runs-SA-2011.002 - Citrix XenApp / XenDesktop XML Service Heap Corruption (<security@...ns.com>)
ZDI-11-244: (0day) FlexNet License Server Manager lmadmin Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

July 29 (9 messages)

Sitecore CMS 6.4 Open URL Redirect Vulnerability (Tom Neaves <tom@...neaves.com>)
[SECURITY] [DSA 2288-1] libsndfile security update (Moritz Muehlenhoff <jmm@...ian.org>)
PacSec CFP note, deadline Aug 3; conf Nov 9/10 Tokyo (Dragos Ruiu <dr@....net>)
Cisco Security Advisory: Cisco TelePresence Recording Server Default Credentials for Root Account Vulnerability (Cisco Systems Product Security Incident Respons…)
Vegetav (news_item.php?id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
cgcraft llc (info.php?id) (news_item.php?id) Remote SQL injection Vulnerability (ehsan_hp200@...mail.com)
AppSec USA 2011 Open Source Showcase Call for Demos (adam.baso@...sp.org)
ZDI-11-245: Sybase Adaptive Server Backup and Monitor Server Translation Array Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoi…)
ZDI-11-246: Sybase Adaptive Server Backup and Monitor Server NULL Write Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

243 messages

Powered by blists - more mailing lists