bugtraq mailing list - 2012/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2012/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
²	³	⁴ 36	⁵ 13	⁶	⁷	⁸
⁹ 15	¹⁰ 3	¹¹ 6	¹² 11	¹³ 9	¹⁴	¹⁵
¹⁶ 16	¹⁷ 6	¹⁸ 15	¹⁹ 12	²⁰ 19	²¹	²²
²³ 23	²⁴ 6	²⁵ 11	²⁶ 8	²⁷ 9	²⁸	²⁹
³⁰ 15

Messages by day:

April 4 (36 messages)

Landshop v0.9.2 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
VMSA-2012-0006 VMware ESXi and ESX address several security issues (VMware Security Team <security@...are.com>)
[SECURITY] [DSA 2445-1] typo3-src security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 2442-2] openarena regression (Florian Weimer <fw@...eb.enyo.de>)
SQL injection in Wordpress plugin Buddypress (ivan_terkin@...oo.com)
[SECURITY] [DSA 2398-2] curl regression (Florian Weimer <fw@...eb.enyo.de>)
IPv6 stable privacy addresses (Fernando Gont <fgont@...networks.com>)
Hackito 2012 Crypto Challenge (Jonathan Brossard <endrazine@...il.com>)
[ MDVSA-2012:046 ] libpng (security@...driva.com)
[ MDVSA-2012:047 ] freeradius (security@...driva.com)
[ MDVSA-2012:048 ] mutt (security@...driva.com)
[ MDVSA-2012:049 ] nagios (security@...driva.com)
[security bulletin] HPSBMU02759 SSRT100817 rev.1 - HP Onboard Administrator (OA), Remote Unauthorized Access, Unauthorized Information Dis… (security-alert@...com)
[ MDVSA-2012:050 ] phpmyadmin (security@...driva.com)
[security bulletin] HPSBMU02753 SSRT100782 rev.1 - HP Business Availability Center (BAC) Running Apache, Remote Execution of Arbitrary Com… (security-alert@...com)
[ MDVSA-2012:051 ] libvorbis (security@...driva.com)
[ MDVSA-2012:052 ] libvorbis (security@...driva.com)
[Suspected Spam] Astaro Command Center v2.x - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
Arbor Networks Peakflow SP web interface XSS (b.saleh@....com)
APPLE-SA-2012-04-03-1 Java for OS X 2012-001 and Java for Mac OS X 10.6 Update 7 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Multiple vulnerabilities in osCmax (advisory@...ridge.com)
'e-ticketing' SQL Injection (CVE-2012-1673) (Mark Stanislav <mark.stanislav@...il.com>)
'phpPaleo' Local File Inclusion (CVE-2012-1671) (Mark Stanislav <mark.stanislav@...il.com>)
[DCA-2011-0016] - Tufin SecureTrack Cross Site Script (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)
'Hotel Booking Portal' SQL Injection (CVE-2012-1672) (Mark Stanislav <mark.stanislav@...il.com>)
[security bulletin] HPSBMU02749 SSRT100793 rev.1 - HP Business Availability Center (BAC) Running on Windows, Remote Cross Site Scripting (… (security-alert@...com)
Cisco Security Advisory: Buffer Overflow Vulnerabilities in the Cisco WebEx Player (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[ MDVSA-2012:053 ] ocsinventory (security@...driva.com)
[SE-2012-01] Security vulnerabilities in Java SE (Security Explorations <contact@...urity-explorations.com>)
Sourcefire Defense Center - multiple vulnerabilities. (Filip Palian <s3810@...stk.edu.pl>)
[SECURITY] [DSA 2446-1] libpng security update (Moritz Muehlenhoff <jmm@...ian.org>)
Flatnux CMS 2011 08.09.2 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
ME Firewall Analyzer v7.2 - Cross Site Vulnerabilities (Research <research@...nerability-lab.com>)
DirectAdmin v1.403 - Cross Site Scripting Vulnerability (Research <research@...nerability-lab.com>)
[SECURITY] [DSA 2447-1] tiff security update (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Arbor Networks Peakflow SP web interface XSS (Jose Nazario <jose@...or.net>)

April 5 (13 messages)

Re: Arbor Networks Peakflow SP web interface XSS (Jose Nazario <jose@...or.net>)
[ MDVSA-2012:054 ] libtiff (security@...driva.com)
[MATTA-2012-001] CVE-2012-1301; 0day; Open Proxy vulnerability in Umbraco 4.7 (Florent Daigniere <florent.daigniere@...stmatta.com>)
Quest vWorkspace 7.5 Connection Broker Client ActiveX Control (pnllmcli.dll 7.5.304.547) SaveMiniLaunchFile() Method Remote File Creation / O… (nospam@...il.it)
Quest Toad for Oracle Explain Plan Display ActiveX Control (QExplain2.dll 6.6.1.1115) Remote File Creation / Overwrite (nospam@...il.it)
vBulletin 4.1.10 Sql Injection Vulnerabilitiy (Amir@...st.ir)
Sony Bravia Remote Denial of Service - CVE-2012-2210 (gab.mnunes@...il.com)
Wordpress taggator plugin Sql Injection Vulnerabilities (Amir@...st.ir)
[waraxe-2012-SA#082] - File Existence Disclosure in Uploadify 3.0.0 (come2waraxe@...oo.com)
[waraxe-2012-SA#083] - Multiple Vulnerabilities in Uploadify 2.1.4 (come2waraxe@...oo.com)
[security bulletin] HPSBUX02757 SSRT100779 rev.2 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vu… (security-alert@...com)
[security bulletin] HPSBUX02758 SSRT100774 rev.1 - HP-UX running DCE, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBUX02760 SSRT100805 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vu… (security-alert@...com)

April 9 (15 messages)

PHPNuke Module's Name Download SQL Injection Vulnerabilities (CrAzY_CrAcKeR@...1-ss-2-lb.cnet.com)
[CVE-2012-1574] Apache Hadoop user impersonation vulnerability ("Aaron T. Myers" <atm@...udera.com>)
[waraxe-2012-SA#084] - Multiple Vulnerabilities in OpenCart 1.5.2.1 (come2waraxe@...oo.com)
[waraxe-2012-SA#085] - Reflected XSS in Uploadify Integration Wordpress plugin (come2waraxe@...oo.com)
CitrusDB 2.4.1 - LFI/SQLi Vulnerability (blaszczakm@...il.com)
[Suspected Spam] AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow Vulnerabilities (Research <research@...nerability-lab.com>)
idev Game Site CMS v1.0 - Multiple Web Vulnerabilites (Research <research@...nerability-lab.com>)
osCmax Shop CMS v2.5.1 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
CsForum v0.8 - Cross Site Scripting Vulnerability (Research <research@...nerability-lab.com>)
[Suspected Spam] Astaro Command Center v2.x - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
[Suspected Spam] Astaro Security Gateway v7.504 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
OWASP ZAP 1.4.0 released (psiinon <psiinon@...il.com>)
Secunia Research: RealNetworks Helix Server Credentials Disclosure Security Issue (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Helix Server SNMP Master Agent Service Two Denial of Service Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
CVE-2012-0769, the case of the perfect info leak (Fermín J. Serna <fjserna@...il.com>)

April 10 (3 messages)

[SECURITY] [DSA 2448-1] inspircd security update (Jonathan Wiltshire <jmw@...ian.org>)
Matterdaddy Market v1.1 - SQL Injection Vulnerabilities (Research <research@...nerability-lab.com>)
GroupWare epesiBIM CRM 1.2.1 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)

April 11 (6 messages)

[security bulletin] HPSBPV02754 SSRT100803 rev.1 - HP ProCurve 5400 zl Switch, Compact flash card virus (security-alert@...com)
[ MDVSA-2012:055 ] samba (security@...driva.com)
Android information leak (sumanj@...il.com)
Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress (advisory@...ridge.com)
Re: Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities Are Fixed! (info@...aid.com)
Backtrack 5 R2 priv escalation 0day found in CTF exercise ("Adam Behnke" <adam@...osecinstitute.com>)

April 12 (11 messages)

TeamSHATTER Security Advisory: Privilege escalation via internal sql injection in RESTORE DATABASE command (Shatter <shatter@...secinc.com>)
[ MDVSA-2012:056 ] rpm (security@...driva.com)
Netjuke 1.0 RC1 - SQL Injection Vulnerabilities (Research <research@...nerability-lab.com>)
[Suspected Spam] DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
[waraxe-2012-SA#086] - Local File Inclusion in Invision Power Board 3.3.0 (come2waraxe@...oo.com)
TWSL2012-008: Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
[ MDVSA-2012:057 ] freetype2 (security@...driva.com)
online newspaper university"newsdesc.php" SQL Injection Vulnerabilities (CrAzY_CrAcKeR@...1-ss-2-lb.cnet.com)
[SECURITY] [DSA 2449-1] sqlalchemy security update (Nico Golde <nion@...ian.org>)
Crystal Office Suite v1.43 - Buffer Overflow Vulnerability (Research <research@...nerability-lab.com>)
[SE-2012-01] Security weakness in Apple Quicktime Java extensions (Security Explorations <contact@...urity-explorations.com>)

April 13 (9 messages)

[SECURITY] [DSA 2450-1] samba security update (Thijs Kinkhorst <thijs@...ian.org>)
APPLE-SA-2012-04-12-1 Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Re: Backtrack 5 R2 priv escalation 0day found in CTF exercise (InterN0T Advisories <advisories@...ern0t.net>)
Erronous post concerning Backtrack 5 R2 0day ("Adam Behnke" <adam@...osecinstitute.com>)
VMSA-2012-0007 VMware hosted products and ESXi/ESX patches address privilege escalation (VMware Security Team <security@...are.com>)
[SECURITY] [DSA 2451-1] puppet security update (Nico Golde <nion@...ian.org>)
[ MDVSA-2012:058 ] curl (security@...driva.com)
Re: Erronous post concerning Backtrack 5 R2 0day (Jamie Riden <jamie.riden@...il.com>)
ACC PHP eMail v1.1 - Multiple Web Vulnerabilites (Research <research@...nerability-lab.com>)

April 16 (16 messages)

APPLE-SA-2012-04-13-1 Flashback malware removal tool (Apple Product Security <product-security-noreply@...ts.apple.com>)
[Suspected Spam] K-Meleon Browser v1.5.4 - Denial of Service Vulnerability (Research <research@...nerability-lab.com>)
Slides for "Recent Advances in IPv6 Security" at Hackito Ergo Sum 2012 (Fernando Gont <fgont@...networks.com>)
Total Quality Machines (productdetail.php) SQL Injection Vulnerabilities (CrAzY_CrAcKeR@...1-ss-2-lb.cnet.com)
Mathematica8.0.4 on Linux /tmp/MathLink vulnerability (paul.szabo@...ney.edu.au)
Siche Search v.0.5 Zerboard - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
[Suspected Spam] Cyberoam UTM v10.01.2 build 059 - File Include Vulnerabilities (Research <research@...nerability-lab.com>)
Passwords^12 : Call for Presentations (Per Thorsheim <per@...rsheim.net>)
[CVE-2012-1621] Apache OFBiz information disclosure vulnerability (Jacopo Cappellato <jacopoc@...che.org>)
[CVE-2012-1622] Apache OFBiz information disclosure vulnerability (Jacopo Cappellato <jacopoc@...che.org>)
FastPath Webchat | Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
Joomla! Plugin - Beatz 1.x <= Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
[SECURITY] [DSA 2452-1] apache2 security update (Stefan Fritsch <sf@...ian.org>)
[SECURITY] [DSA 2453-1] gajim security update (Nico Golde <nion@...ian.org>)
[ MDVSA-2012:059 ] python-sqlalchemy (security@...driva.com)
ACROS Blog: Adobe Reader X (10.1.2) msiexec.exe Planting ("ACROS Security Lists" <lists@...os.si>)

April 17 (6 messages)

Fwd: PHP Gift Registry 1.5.5 SQL Injection (Thomas Richards <g13net@...il.com>)
Re: Mathematica8.0.4 on Linux /tmp/MathLink vulnerability (Vikram Dhillon <dhillonv10@...il.com>)
Re: Mathematica8.0.4 on Linux /tmp/MathLink vulnerability (paul.szabo@...ney.edu.au)
[security bulletin] HPSBMU02764 SSRT100827 rev.1 - HP System Management Homepage (SMH) Running on Linux and Windows, Remote Cross Site Req… (security-alert@...com)
[security bulletin] HPSBOV02763 SSRT100826 rev.1 - HP Secure Web Server (SWS) for OpenVMS running PHP, Remote Denial of Service (DoS), Una… (security-alert@...com)
[security bulletin] HPSBOV02762 SSRT100825 rev.1 - HP Secure Web Server (SWS) for OpenVMS running CSWS_JAVA, Remote Denial of Service (DoS… (security-alert@...com)

April 18 (15 messages)

[security bulletin] HPSBOV02765 SSRT100828 rev.1 - HP OpenVMS, local Denial of Service (DoS) (security-alert@...com)
Squid URL Filtering Bypass (Gabriel Menezes Nunes <gab.mnunes@...il.com>)
McAfee Web Gateway URL Filtering Bypass (Gabriel Menezes Nunes <gab.mnunes@...il.com>)
Re: Wordpress advanced-text-widget Plugin Vulnerabilities (Henri Salo <henri@...v.fi>)
Re: Wordpress featurific-for-wordpress plugin Cross-Site Scripting Vulnerabilities (Henri Salo <henri@...v.fi>)
Re: Wordpress 1-jquery-photo-gallery-slideshow-flash plugin Cross-Site Scripting Vulnerabilities (Henri Salo <henri@...v.fi>)
DokuWiki Ver.2012/01/25 CSRF Add User Exploit (irancrash@...il.com)
ClubHack Magazine's April 2012 Issue is released. (v.hirve@...il.com)
VUPEN Security Research - Microsoft Internet Explorer VML Remote Code Execution (MS12-023 / CVE-2012-0172) (VUPEN Security Research <advisories@...en.com>)
Acuity CMS 2.6.x <= Cross Site Scripting (YGN Ethical Hacker Group <lists@...g.net>)
[ MDVSA-2012:032-1 ] mozilla (security@...driva.com)
TC-SA-2012-01: Multiple web-vulnerabilities in ownCloud 3.0.0 ("Tobias Glemser" <tglemser@...e-consulting.com>)
Multiple XSS vulnerabilities in XOOPS (advisory@...ridge.com)
Multiple vulnerabilities in Newscoop (advisory@...ridge.com)
[security bulletin] HPSBMU02766 SSRT100624 rev.1 - HP Onboard Administrator (OA), Remote Denial of Service (DoS) (security-alert@...com)

April 19 (12 messages)

Re: Squid URL Filtering Bypass (Richard Barrett <r.barrett@...ninfo.co.uk>)
Re: Squid URL Filtering Bypass (Gabriel Menezes Nunes <gab.mnunes@...il.com>)
ESA-2012-018: EMC Data Protection Advisor Multiple Vulnerabilities (<Security_Alert@....com>)
The history of a -probably- 13 years old Oracle bug: TNS Poison (Joxean Koret <joxeankoret@...oo.es>)
Security advisory for Bugzilla 4.2.1, 4.0.6 and 3.6.9 (LpSolit@...il.com)
[SECURITY] [DSA 2453-2] gajim regression (Nico Golde <nion@...ian.org>)
Ruxcon 2012 Call For Papers (cfp@...con.org.au)
VUPEN Security Research - Adobe Flash Player NetStream Remote Code Execution Vulnerability (APSB12-07 / CVE-2012-0773) (VUPEN Security Research <advisories@vup…)
[CVE-2012-2273] Comodo Internet Security <5.10 BSOD (Win7 x64) (Ange Albertini <ange.albertini@...il.com>)
Re: Squid URL Filtering Bypass (Mario Vilas <mvilas@...il.com>)
[ MDVSA-2012:060 ] openssl (security@...driva.com)
Vulnerabilities in Samsung TV (remote controller protocol) (Luigi Auriemma <aluigi@...istici.org>)

April 20 (19 messages)

[SECURITY] [DSA 2454-1] openssl security update (Raphael Geissert <geissert@...ian.org>)
[security bulletin] HPSBUX02761 SSRT100823 rev.1 - HP-UX Running Apache, Remote Denial of Service (DoS), Local Increase of Privilege (security-alert@...com)
DC4420 - London DEFCON - April meet - Tuesday April 24th 2012 (Major Malfunction <majormal@...ate-radio.org>)
RE: Squid URL Filtering Bypass (Jim Harrison <Jim@...tools.org>)
Incomplete protection of Oracle Database locked accounts (CVE-2012-0510) (Shatter <shatter@...secinc.com>)
OCIPasswordChange API leaks information of password hash (CVE-2012-0511) (Esteban Martinez Fayo <efayo@...secinc.com>)
Some failed authentication attempts using OCIPasswordChange API are not recorded (CVE-2012-0511) (Shatter <shatter@...secinc.com>)
Specially crafted Json service request allows full control over a Liferay portal instance (Jelmer Kuperus <jelmer.advisories@...il.com>)
SQL Injection in Oracle Enterprise Manager (compareWizFirstConfig web page) (CVE-2012-0512) (Shatter <shatter@...secinc.com>)
Liferay 6.1 can be compromised in its default configuration (Jelmer Kuperus <jelmer.advisories@...il.com>)
SQL Injection in Oracle Enterprise Manager (searchPage web page) (CVE-2012-0525) (Shatter <shatter@...secinc.com>)
HTTP Response Splitting in Oracle Enterprise Manager (prevPage parameter) (CVE-2012-0526) (Shatter <shatter@...secinc.com>)
HTTP Response Splitting in Oracle Enterprise Manager (pageName parameter) (CVE-2012-0527) (Shatter <shatter@...secinc.com>)
Oracle Enterprise Manager vulnerable to Session fixation (CVE-2012-0528) (Shatter <shatter@...secinc.com>)
OCIPasswordChange API leaks information of password hash (CVE-2012-0511) (Shatter <shatter@...secinc.com>)
Specially crafted webdav request allows reading of local files on liferay 6.0.x (Jelmer Kuperus <jelmer.advisories@...il.com>)
IPv6 host scanning in IPv6 (Fernando Gont <fgont@...networks.com>)
[security bulletin] HPSBMU02764 SSRT100827 rev.2 - HP System Management Homepage (SMH) Running on Linux and Windows, Remote Cross Site Req… (security-alert@...com)
XSS in Kaseya version 6.2.0.0 web interface (bede@...fus.net)

April 23 (23 messages)

[SECURITY] [DSA 2455-1] typo3-src security update (Nico Golde <nion@...ian.org>)
Re: Squid URL Filtering Bypass (Amos Jeffries <amos@...enet.co.nz>)
Re: McAfee Web Gateway URL Filtering Bypass (Vikram Dhillon <dhillonv10@...il.com>)
Re: Squid URL Filtering Bypass (Gabriel Menezes Nunes <gab.mnunes@...il.com>)
[ MDVSA-2012:061 ] raptor (security@...driva.com)
[ MDVSA-2012:062 ] openoffice.org (security@...driva.com)
[ MDVSA-2012:063 ] libreoffice (security@...driva.com)
phpMyBible 0.5.1 Mutiple XSS (Thomas Richards <g13net@...il.com>)
[Suspected Spam] IPhone TreasonSMS - HTML Inject & File Include Vulnerability (Research <research@...nerability-lab.com>)
[Suspected Spam] Havalite CMS v1.0.4 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
PSFTP v.1.8 Build 921 - Null Pointer (DoS) Vulnerability (Research <research@...nerability-lab.com>)
[Spam] Chengdu Bureau of Commerce - SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
XSS and Blind SQL Injection Vulnerabilities in ExponentCMS (Netsparker Advisories <advisories@...itunasecurity.com>)
[HITB-Announce] HITB Magazine Issue 008 (now with print edition!) (Hafez Kamal <aphesz@...kinthebox.org>)
HTC IQRD Android Permission Leakage (CVE-2012-2217) (VSR Advisories <advisories@...curity.com>)
.NET Framework EncoderParameter integer overflow vulnerability (Akita Software Security <lists@...tasecurity.nl>)
ChurchCMS 0.0.1 'admin.php' Multiple SQLi (Thomas Richards <g13net@...il.com>)
AST-2012-004: Asterisk Manager User Unauthorized Shell Access ("Asterisk Security Team" <security@...erisk.org>)
AST-2012-005: Heap Buffer Overflow in Skinny Channel Driver ("Asterisk Security Team" <security@...erisk.org>)
AST-2012-006: Remote Crash Vulnerability in SIP Channel Driver ("Asterisk Security Team" <security@...erisk.org>)
WebCalendar <= 1.2.4 Two Security Vulnerabilities (n0b0d13s@...il.com)
FYI: We're now paying up to $20,000 for web vulns in our services (Michal Zalewski <lcamtuf@...edump.cx>)
Re: phpMyBible 0.5.1 Mutiple XSS (Lostmon@...il.com)

April 24 (6 messages)

[ MDVSA-2012:064 ] openssl0.9.8 (security@...driva.com)
RuggedCom - Backdoor Accounts in my SCADA network? You don't say... (jc <jc@...rew.org>)
[security bulletin] HPSBUX02768 SSRT100664 rev.1 - CIFS Server (Samba), Remote Cross Site Request Forgery (CSRF), Denial of Service (DoS) (security-alert@...com)
New IETF I-D: Security Implications of IPv6 on IPv4 networks (Fernando Gont <fgont@...networks.com>)
RE: McAfee Web Gateway URL Filtering Bypass (Jim Harrison <Jim@...tools.org>)
PHP Ticket System Beta 1 'p' SQL Injection (Thomas Richards <g13net@...il.com>)

April 25 (11 messages)

[SECURITY] [DSA 2456-1] dropbear security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2457-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2548-1] iceape security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2454-2] openssl incomplete fix (Raphael Geissert <geissert@...ian.org>)
linux privileged and arbitrary chdir() (fixed at 5.4 cifs release) (Jesús Olmos <jesus.olmos@...eliv.com>)
Multiple vulnerabilities in Piwigo (advisory@...ridge.com)
[SECURITY] [DSA 2460-1] asterisk security update (Moritz Muehlenhoff <jmm@...ian.org>)
RE: We're now paying up to $20,000 for web vulns in our services (Jim Harrison <Jim@...tools.org>)
Re: We're now paying up to $20,000 for web vulns in our services (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [Full-disclosure] We're now paying up to $20, 000 for web vulns in our services (Charles Morris <cmorris@...odu.edu>)
Re: [Full-disclosure] We're now paying up to $20, 000 for web vulns in our services (Michal Zalewski <lcamtuf@...edump.cx>)

April 26 (8 messages)

ToorCamp 2012: The American Hacker Camp (h1kari@...rcon.org)
[SECURITY] [DSA 2459-1] quagga security update (Florian Weimer <fw@...eb.enyo.de>)
Oracle TNS Poison vulnerability is actually a 0day with no patch available (Joxean Koret <joxeankoret@...oo.es>)
Re: The history of a -probably- 13 years old Oracle bug: TNS Poison (laurenz.albe@...n.gv.at)
PHP Volunteer Management 'id' 1.0.2 Multiple Vulnerabilities (Thomas Richards <g13net@...il.com>)
[security bulletin] HPSBPI02728 SSRT100692 rev.6 - Certain HP Printers and HP Digital Senders, Remote Firmware Update Enabled by Default (security-alert@...com)
DDIVRT-2012-40 PacketVideo TwonkyServer and TwonkyMedia Directory Traversal (ddivulnalert@...frontline.com)
DDIVRT-2012-41 ACTi Web Configurator cgi-bin Directory Traversal (ddivulnalert@...frontline.com)

April 27 (9 messages)

[ MDVSA-2012:066 ] mozilla (security@...driva.com)
[security bulletin] HPSBPV02754 SSRT100803 rev.2 - HP ProCurve 5400 zl Switch, Compact flash card contains trojan malware (security-alert@...com)
[SECURITY] [DSA 2461-1] spip security update (Moritz Muehlenhoff <jmm@...ian.org>)
DIY CMS v1.0 Poll - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
DirectAdmin v1.403 - Multiple Cross Site Vulnerabilities (Research <research@...nerability-lab.com>)
Car Portal CMS v3.0 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability (Research <research@...nerability-lab.com>)
VMSA-2012-0008 VMware ESX updates to ESX Service Console (VMware Security Team <security@...are.com>)
[ MDVSA-2012:065 ] php (security@...driva.com)

April 30 (15 messages)

[SECURITY] [DSA 2462-1] imagemagick security update (Moritz Muehlenhoff <jmm@...ian.org>)
PHP Volunteer Management (get_messages.php) SQL Injection Vulnerabilities (ariosrandy@...il.com)
Opial CMS v2.0 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability (Research <research@...nerability-lab.com>)
OWASP 2012 Online Competition with Hacking-Lab ("Ivan Buetler" <ivan.buetler@...c.ch>)
Wordpress WPsc-MijnPress plugin Cross-Site Scripting Vulnerabilities (Amir@...st.ir)
Pritlog v0.821 CMS - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
NGS00107 Patch Notification: Oracle Grid Engine sgepasswd Buffer Overflow ("Research@...Secure" <research@...secure.com>)
NGS00137 Technical Advisory: Websense Triton 7.6 - reflected XSS in report management UI ("Research@...Secure" <research@...secure.com>)
NGS00138 Technical Advisory: Websense Triton 7.6 - authentication bypass in report management UI ("Research@...Secure" <research@...secure.com>)
NGS00140 Technical Advisory: Websense Triton 7.6 - unauthenticated remote command execution as SYSTEM ("Research@...Secure" <research@...secure.com>)
NGS00141 Technical Advisory: Websense Triton 7.6 stored XSS in report management UI ("Research@...Secure" <research@...secure.com>)
NGS00117 Technical Advisory: Symantec pcAnywhere insecure file permissions local privilege escalation ("Research@...Secure" <research@...secure.com>)
NGS00118 Technical Advisory: Symantec pcAnywhere Remote Code Execution as SYSTEM ("Research@...Secure" <research@...secure.com>)
McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control GetObject() Security Bypass Remote Code Execution Vulnerability (nospam@...il.it)

233 messages

Powered by blists - more mailing lists