full-disclosure mailing list - 2012/04

Messages by day:

April 1 (13 messages)

• Hackito 2012 Crypto Challenge (Jonathan Brossard <endrazine@...il.com>)
• iis bug (yuange <yuange1975@...mail.com>)
• FW: iis bug (yuange <yuange1975@...mail.com>)
• March 2012 mini Threat Intelligence report (Almaz <almaz@...yo.com>)
• Flatnux CMS 2011 08.09.2 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• ME Firewall Analyzer v7.2 - Cross Site Vulnerabilities (Research <research@...nerability-lab.com>)
• Swedish Army Web Database - SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
• HITB2011KUL - Skype Vulnerabilities 0Day Exploitation PART 1 (Research <research@...nerability-lab.com>)
• So, so you think you can tell April 1 joke from a 0day? (Georgi Guninski <guninski@...inski.com>)
• STEP Security ("J. Oquendo" <sil@...iltrated.net>)
• Re: STEP Security (Memory Vandal <memvandal@...il.com>)
• An April Fools' Day Android Payload (Dan Rosenberg <dan.j.rosenberg@...il.com>)
• Re: STEP Security (Nick FitzGerald <nick@...us-l.demon.co.uk>)

• Re: STEP Security (Jeff Kell <jeff-kell@....edu>)
• Amongst data breaches and misc 'leakage', not necessarily digital, DEFCON CTF continues at DEFCON XX (Vulcan DDtek <vulcan.ddtek@...il.com>)
• Re: iis bug (yuange <yuange1975@...mail.com>)
• [ MDVSA-2012:046 ] libpng (security@...driva.com)
• An April Fools' Day Android Payload ("ZeroDay.JP" <unixfreaxjp22@...il.com>)
• [ MDVSA-2012:047 ] freeradius (security@...driva.com)
• BulletProof FTP Client 2010 - Buffer Overflow Vulnerability (Research <research@...nerability-lab.com>)
• DirectAdmin v1.403 - Cross Site Scripting Vulnerability (Research <research@...nerability-lab.com>)
• www.LEORAT.com is scam (smith joseph <sj101490@...il.com>)
• Apache 2.2.xx 0day exploit (Adam Zabrocki <pi3@....com.pl>)
• Re: An April Fools' Day Android Payload (Dan Rosenberg <dan.j.rosenberg@...il.com>)
• Re: www.LEORAT.com is scam (Valdis.Kletnieks@...edu)
• Re: www.LEORAT.com is scam (Dave <mrx@...pergander.org.uk>)
• Re: www.LEORAT.com is scam (Dave <mrx@...pergander.org.uk>)
• [ MDVSA-2012:048 ] mutt (security@...driva.com)
• [ MDVSA-2012:049 ] nagios (security@...driva.com)
• Re: www.LEORAT.com is scam ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re(2): An April Fools' Day Android Payload (アドリアンヘンドリック <unixfreaxjp22@...il.com>)
• Re: www.LEORAT.com is scam (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• Re: Re(2): An April Fools' Day Android Payload (Andrew Farmer <andfarm@...il.com>)
• Re(3): An April Fools' Day Android Payload (アドリアンヘンドリック <unixfreaxjp22@...il.com>)
• [Tool] New release of peepdf (PDF analysis) (Jose Miguel Esparza <jesparza@...rnal-todo.com>)

• [ MDVSA-2012:050 ] phpmyadmin (security@...driva.com)
• Hacking AutoUpdate by Injecting Fake Updates ("Adam Behnke" <adam@...osecinstitute.com>)
• [ MDVSA-2012:051 ] libvorbis (security@...driva.com)
• [ MDVSA-2012:052 ] libvorbis (security@...driva.com)
• [ZEM560] Vulnerability on Fingerprint & Proximity Access Controller ("Zerial." <fernando@...ial.org>)

• SmartJobBoard v3.4 b5140 - Multiple Web Vulnerabilites (Research <research@...nerability-lab.com>)
• Astaro Command Center v2.x - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Re: www.LEORAT.com is scam (Sebastian Rakowski <seb3255@...il.com>)
• [SE-2012-01] Security vulnerabilities in Java SE (Security Explorations <contact@...urity-explorations.com>)
• Mind Control Security Awareness (Pete Herzog <lists@...com.org>)
• Last public release ("HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>)
• Re: www.LEORAT.com is scam (Dave <mrx@...pergander.org.uk>)
• Re: Hacking AutoUpdate by Injecting Fake Updates (Charles Morris <cmorris@...odu.edu>)
• Re: Brute Force vulnerability in WordPress ("MustLive" <mustlive@...security.com.ua>)
• Re: Brute Force vulnerability in WordPress (Sanguinarious Rose <SanguineRose@...ultusTerra.com>)
• SQL Injection through HTTP Headers ("Adam Behnke" <adam@...osecinstitute.com>)
• Cisco Security Advisory: Buffer Overflow Vulnerabilities in the Cisco WebEx Player (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• [ MDVSA-2012:053 ] ocsinventory (security@...driva.com)
• Re: Working to get more people to check if their infected with DNS Changer (Gage Bystrom <themadichib0d@...il.com>)
• Sourcefire Defense Center - multiple vulnerabilities. (Filip Palian <s3810@...stk.edu.pl>)
• [Security-news] SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data Protection Vulnerability (security-news@...pal.org)
• Re: Working to get more people to check if their infected with DNS Changer (Valdis.Kletnieks@...edu)
• Re: www.LEORAT.com is scam (Sebastian Rakowski <seb3255@...il.com>)
• 'phpPaleo' Local File Inclusion (CVE-2012-1671) (Mark Stanislav <mark.stanislav@...il.com>)
• 'e-ticketing' SQL Injection (CVE-2012-1673) (Mark Stanislav <mark.stanislav@...il.com>)
• 'Hotel Booking Portal' SQL Injection (CVE-2012-1672) (Mark Stanislav <mark.stanislav@...il.com>)
• [SECURITY] [DSA 2446-1] libpng security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Brute Force vulnerability in WordPress (InterN0T Advisories <advisories@...ern0t.net>)
• [SECURITY] [DSA 2447-1] tiff security update (Moritz Muehlenhoff <jmm@...ian.org>)
• [Security-news] SA-CONTRIB-2012-057 - Printer, email and PDF versions - Cross Site Scripting (XSS) (security-news@...pal.org)

• Teensy USB HID (and Kautilya) for Penetration Testers (Nikhil Mittal <nikhil_uitrgpv@...oo.co.in>)
• [ MDVSA-2012:054 ] libtiff (security@...driva.com)
• [MATTA-2012-001] CVE-2012-1301; 0day; Open Proxy vulnerability in Umbraco 4.7 (Florent Daigniere <florent.daigniere@...stmatta.com>)
• mac trojan (RandallM <randallm@...mail.com>)
• Sagan 0.2.1 [Security Event/Log Analyzer] Released. (Champ Clark III <cclark@...drantsec.com>)
• Re: mac trojan (Dennis <shr3kst3r@...il.com>)
• Re: mac trojan (Jeffrey Walton <noloader@...il.com>)

• [CVE-2012-1574] Apache Hadoop user impersonation vulnerability ("Aaron T. Myers" <atm@...udera.com>)
• Re: [funsec] mac trojan (Charlie Derr <cderr@...ons-rock.edu>)
• Shakacon CFP - Extended Deadline: April 13, 2012 ("Shakacon" <info@...kacon.org>)
• Re: mac trojan ("Carl \"Thomas\" Guething" <thogue@...d.com>)
• Drop box (Fatherlaptop <fatherlaptop@...il.com>)
• PenTest Market is for FREE Now (Krzysztof Marczyk <krzysztof.marczyk@...tware.com.pl>)
• Re: PenTest Market is for FREE Now (John Jacobs <flamdugen@...mail.com>)
• Re: PenTest Market is for FREE Now (Dave <mrx@...pergander.org.uk>)
• Dolibarr ERP & CRM OS Command Injection (Nahuel Grisolia <nahuel.grisolia@...il.com>)

• FSA2012-1 and FSA2012-2: Chocolate easter egss vulnerable to egg white injection and usable as trojan horses. (klondike <klondike@...cosoft.es>)
• Re: FSA2012-1 and FSA2012-2: Chocolate easter egss vulnerable to egg white injection and usable as trojan horses. (rancor <therancor@...il.com>)
• Re: FSA2012-1 and FSA2012-2: Chocolate easter egss vulnerable to egg white injection and usable as trojan horses. (fabrice <full-disclosure@...satak.org>)

• AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow Vulnerabilities (Research <research@...nerability-lab.com>)
• idev Game Site CMS v1.0 - Multiple Web Vulnerabilites (Research <research@...nerability-lab.com>)
• osCmax Shop CMS v2.5.1 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• CsForum v0.8 - Cross Site Scripting Vulnerability (Research <research@...nerability-lab.com>)
• Astaro Command Center v2.x - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Astaro Security Gateway v7.504 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• US UF Services EDU Health - File Include Vulnerability (Research <research@...nerability-lab.com>)
• Thor's Private Key ("Thor (Hammer of God)" <thor@...merofgod.com>)

• Re: Thor's Private Key ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: Thor's Private Key (Jason Hellenthal <jhellenthal@...aix.net>)
• Microsoft MSDN - Persistent Web Service Vulnerability (Research <research@...nerability-lab.com>)
• Secunia Research: RealNetworks Helix Server Credentials Disclosure Security Issue (Secunia Research <remove-vuln@...unia.com>)
• Secunia Research: Helix Server SNMP Master Agent Service Two Denial of Service Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
• ZDI-12-055 : Webkit.org Webkit copyNonAttributeProperties Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-056 : Mozilla Firefox nsSVGValue Out-of-Bounds Access Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-057 : (Pwn2Own) Adobe Flash Player NetStream addBytes Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-058 : Apple Quicktime PNG Depth Decoding Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-059 : Mozilla Firefox Ogg Vorbis Decoding Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• Teensy USB HID (and Kautilya) for Penetration Testers - Part 2 - Basics of Arduino and Hello World (Nikhil Mittal <nikhil_uitrgpv@...oo.co.in>)
• ZDI-12-060 : Oracle Java Runtime readMabCurveData nTblSize Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• CVE-2012-0769, the case of the perfect info leak (Fermín J. Serna <fjserna@...il.com>)
• CIntruder v0.1 (psy <root@...depsylon.net>)
• Re: CIntruder v0.1 (Travis Biehn <tbiehn@...il.com>)
• new law proposal on EU against hacking tools and practices (psy <root@...depsylon.net>)
• Re: new law proposal on EU against hacking tools and practices (Valdis.Kletnieks@...edu)
• Re: new law proposal on EU against hacking tools and practices (Travis Biehn <tbiehn@...il.com>)
• Re: new law proposal on EU against hacking tools and practices (Valdis.Kletnieks@...edu)
• Re: new law proposal on EU against hacking tools and practices (Dave <mrx@...pergander.org.uk>)
• Re: new law proposal on EU against hacking tools and practices (Valdis.Kletnieks@...edu)

• Re: Compromised VPN provider out there? (nix@...roxylists.com)
• [SECURITY] [DSA 2448-1] inspircd security update (Jonathan Wiltshire <jmw@...ian.org>)
• List Charter (John Cartwright <johnc@...k.org.uk>)
• Re: Compromised VPN provider out there? (Benji <me@...ji.com>)
• 44Con London 2012 CFP - September 5th - 7th (Steve <steve@...on.com>)
• Re: keeping data safe offline (Gage Bystrom <themadichib0d@...il.com>)
• Matterdaddy Market v1.1 - SQL Injection Vulnerabilities (Research <research@...nerability-lab.com>)
• National Center EDU Research - SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
• GroupWare epesiBIM CRM 1.2.1 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)

• National Center EDU Research - SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
• ACROS Blog: Adobe Reader X (10.1.2) msiexec.exe Planting ("ACROS Security Lists" <lists@...os.si>)
• [ MDVSA-2012:055 ] samba (security@...driva.com)
• Backtrack 5 R2 priv escalation 0day found in CTF exercise ("Adam Behnke" <adam@...osecinstitute.com>)
• TeamSHATTER Security Advisory: Privilege escalation via internal sql injection in RESTORE DATABASE command (Shatter <shatter@...secinc.com>)
• [Security-news] SA-CONTRIB-2012-058 - Fivestar - Input Validation (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-059 - Autosave - Cross Site Scripting (security-news@...pal.org)

• TWSL2012-008: Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
• DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Netjuke 1.0 RC1 - SQL Injection Vulnerabilities (Research <research@...nerability-lab.com>)
• Oracle Service Applications - SQL Injection Vulnerabilities (Research <research@...nerability-lab.com>)
• CRUNCH TV SHOW - Live Stream & Security Videos (Research <research@...nerability-lab.com>)
• [SECURITY] [DSA 2449-1] sqlalchemy security update (Nico Golde <nion@...ian.org>)
• Crystal Office Suite v1.43 - Buffer Overflow Vulnerability (Research <research@...nerability-lab.com>)
• [ MDVSA-2012:056 ] rpm (security@...driva.com)
• [ MDVSA-2012:057 ] freetype2 (security@...driva.com)
• Re: Backtrack 5 R2 priv escalation 0day found in CTF exercise (InterN0T Advisories <advisories@...ern0t.net>)
• Patrick Belcher (Rand Flieger <rflieger87@...il.com>)
• Most Linux distributions don't use tmpfs nor encrypt swap by default (Mark Krenz <mark@...o.com>)
• Last Mile, April 20 || CfP: SECURWARE 2012 || August 19-24, 2012 - Rome, Italy (Cristina Pascual<cris.pascual.gonzalez@...il.com>)
• [SE-2012-01] Security weakness in Apple Quicktime Java extensions (Security Explorations <contact@...urity-explorations.com>)
• [SECURITY] [DSA 2450-1] samba security update (Thijs Kinkhorst <thijs@...ian.org>)
• Erronous post concerning Backtrack 5 R2 0day ("Adam Behnke" <adam@...osecinstitute.com>)
• Re: Erronous post concerning Backtrack 5 R2 0day (Benji <me@...ji.com>)
• Re: Backtrack 5 R2 priv escalation 0day found in CTF exercise (Urlan <urlancomp@...il.com>)
• Re: Most Linux distributions don't use tmpfs nor encrypt swap by default (Grandma Eubanks <tborland1@...il.com>)

• VMSA-2012-0007 VMware hosted products and ESXi/ESX patches address privilege escalation (VMware Security Team <security@...are.com>)
• hi (Patrick Klos <pklos@...oo.com>)
• Re: Amongst data breaches and misc 'leakage', not necessarily digital, DEFCON CTF continues at DEFCON XX (Roman Medina-Heigl Hernandez <roman@...labs.com>)
• Re: Most Linux distributions don't use tmpfs nor encrypt swap by default (Mark Krenz <mark@...o.com>)
• [SECURITY] [DSA 2451-1] puppet security update (Nico Golde <nion@...ian.org>)
• Re: Erronous post concerning Backtrack 5 R2 0day (Ryan Dewhurst <ryandewhurst@...il.com>)
• Re: Most Linux distributions don't use tmpfs nor encrypt swap by default (Feighen Oosterbroek <feighen@...il.com>)
• [ MDVSA-2012:058 ] curl (security@...driva.com)
• [Spanish] - Exploit Pack - Web Security Framework (runlvl <runlvl@...il.com>)

• Invitation to connect on LinkedIn (Mezgani Ali via LinkedIn <member@...kedin.com>)
• Slides for "Recent Advances in IPv6 Security" at Hackito Ergo Sum 2012 (Fernando Gont <fgont@...networks.com>)
• Mathematica8.0.4 on Linux /tmp/MathLink vulnerability (paul.szabo@...ney.edu.au)

• ACC PHP eMail v1.1 - Multiple Web Vulnerabilites (Research <research@...nerability-lab.com>)
• EmbryoCore CMS v1.03 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Microsoft Service - Persistent Web Vulnerabilities (Research <research@...nerability-lab.com>)
• K-Meleon Browser v1.5.4 - Denial of Service Vulnerability (Research <research@...nerability-lab.com>)
• EmbryoCore CMS v1.03 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Microsoft AFKAR Website Service - Cross Site Vulnerabilities (Research <research@...nerability-lab.com>)
• Siche Search v.0.5 Zerboard - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Cyberoam UTM v10.01.2 build 059 - File Include Vulnerabilities (Research <research@...nerability-lab.com>)
• Re: Most Linux distributions don't use tmpfs nor encrypt swap by default (_ <packetnull@...il.com>)
• nullsec-bypass-aslr.pdf - ASLR / ASLR bypass techniques (Levent Kayan <levonkayan@....net>)
• DoS vulnerability in WordPress ("MustLive" <mustlive@...security.com.ua>)
• Re: nullsec-bypass-aslr.pdf - ASLR / ASLR bypass techniques (Gage Bystrom <themadichib0d@...il.com>)

• DoS vulnerability in MustLive (InterN0T Advisories <advisories@...ern0t.net>)
• [CVE-2012-1622] Apache OFBiz information disclosure vulnerability (Jacopo Cappellato <jacopoc@...che.org>)
• [CVE-2012-1621] Apache OFBiz information disclosure vulnerability (Jacopo Cappellato <jacopoc@...che.org>)
• Re: Most Linux distributions don't use tmpfs nor encrypt swap by default (Pedro Martelletto <pedro@...ientworks.net>)
• FastPath Webchat | Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
• Joomla! Plugin - Beatz 1.x <= Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
• [SECURITY] [DSA 2452-1] apache2 security update (Stefan Fritsch <sf@...ian.org>)
• [SECURITY] [DSA 2453-1] gajim security update (Nico Golde <nion@...ian.org>)
• [ MDVSA-2012:059 ] python-sqlalchemy (security@...driva.com)
• Re: Joomla! Plugin - Beatz 1.x <= Multiple Cross Site Scripting Vulnerabilities (David3 Gonnella <netevil@...kers.it>)
• Re: PHP Gift Registry 1.5.5 SQL Injection (Thomas Richards <g13net@...il.com>)
• Re: Mathematica8.0.4 on Linux /tmp/MathLink vulnerability (paul.szabo@...ney.edu.au)

• Windows XP denial of service 0day found in CTF exercise ("Adam Behnke" <adam@...osecinstitute.com>)
• Re: Windows XP denial of service 0day found in CTF exercise (Memory Vandal <memvandal@...il.com>)
• Re: Windows XP denial of service 0day found in CTF exercise (Romain Bourdy <achileos@...il.com>)
• Re: Windows XP denial of service 0day found in CTF exercise (Memory Vandal <memvandal@...il.com>)
• Re: Mathematica8.0.4 on Linux /tmp/MathLink vulnerability (Vikram Dhillon <dhillonv10@...il.com>)
• Re: DoS vulnerability in WordPress (Kurt Seifried <kseifried@...hat.com>)
• Re: Most Linux distributions don't use tmpfs nor encrypt swap by default (Mark Krenz <mark@...gbug.org>)
• Re: Windows XP denial of service 0day found in CTF exercise ("Justin C. Klein Keane" <justin@...irish.net>)
• Re: Windows XP denial of service 0day found in CTF exercise (Mihamina Rakotomandimby <mihamina@...mb.org>)
• winAUTOPWN v3.0 Released ("QUAKER DOOMER" <quakerdoomer@...ox.lv>)
• SEC Consult whitepaper :: The Source Is A Lie (SEC Consult Vulnerability Lab <research@...-consult.com>)
• Re: Windows XP denial of service 0day found in CTF exercise (adam@...osecinstitute.com)
• Re: DoS vulnerability in WordPress (Javier Reoyo <javier.reoyo@...erdominios.com>)
• [ MDVSA-2012:032-1 ] mozilla (security@...driva.com)
• Re: Windows XP denial of service 0day found in CTF exercise ("Elazar Broad" <elazar@...hmail.com>)
• Re: Windows XP denial of service 0day found in CTF exercise (Valdis.Kletnieks@...edu)
• Acuity CMS 2.6.x <= Cross Site Scripting (YGN Ethical Hacker Group <lists@...g.net>)
• Re: Windows XP denial of service 0day found in CTF exercise (Terrence <secretpackets@...il.com>)

• 10 Ways to Enhance Your Career in Information Security (Krzysztof Marczyk <krzysztof.marczyk@...tware.com.pl>)
• LibreOffice 3.5.2.2 - memory corruption with a specific .rtf file (Carlo Di Dato <shinnai@...istici.org>)
• Hack Cup 2012 (Nicolas Waisman <nicolas@...unityinc.com>)
• [Announcement] CHMag's Issue 27, April 2012 Released (Abhijeet Patil <getabhijeetpatil@...il.com>)
• The history of a -probably- 13 years old Oracle bug: TNS Poison (Joxean Koret <joxeankoret@...oo.es>)
• [Security-news] SA-CONTRIB-2012-060 - Commerce Reorder - Cross Site Request Forgery (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-061 - Gigya - Social optimization - Cross Site Scripting (XSS) (security-news@...pal.org)

• [SECURITY] [DSA 2453-2] gajim regression (Nico Golde <nion@...ian.org>)
• Ruxcon 2012 Call For Papers (cfp@...con.org.au)
• Re: [Announcement] CHMag's Issue 27, April 2012 Released (Robert Kim App and Facebook Marketing <evdo.hsdpa@...il.com>)
• incorrect integer conversions in OpenSSL can result in memory corruption. (Tavis Ormandy <taviso@...xchg8b.com>)
• Re: Most Linux distributions don't use tmpfs nor encrypt swap by default (Jon Dowland <jon+full-disclosure@...opop.org>)
• Re: incorrect integer conversions in OpenSSL can result in memory corruption. (Benjamin Kreuter <ben.kreuter@...il.com>)
• [ MDVSA-2012:060 ] openssl (security@...driva.com)
• Incomplete protection of Oracle Database locked accounts (CVE-2012-0510) (Shatter <shatter@...secinc.com>)
• Some failed authentication attempts using OCIPasswordChange API are not recorded (CVE-2012-0511) (Shatter <shatter@...secinc.com>)
• SQL Injection in Oracle Enterprise Manager (compareWizFirstConfig web page) (CVE-2012-0512) (Shatter <shatter@...secinc.com>)
• SQL Injection in Oracle Enterprise Manager (searchPage web page) (CVE-2012-0525) (Shatter <shatter@...secinc.com>)
• HTTP Response Splitting in Oracle Enterprise Manager (prevPage parameter) (CVE-2012-0526) (Shatter <shatter@...secinc.com>)
• HTTP Response Splitting in Oracle Enterprise Manager (pageName parameter) (CVE-2012-0527) (Shatter <shatter@...secinc.com>)
• Oracle Enterprise Manager vulnerable to Session fixation (CVE-2012-0528) (Shatter <shatter@...secinc.com>)
• OCIPasswordChange API leaks information of password hash (CVE-2012-0511) (Shatter <shatter@...secinc.com>)

• IPv6 host scanning in IPv6 (Fernando Gont <fgont@...networks.com>)
• Weak password reset token & code exec in ownCloud 3.0.0 (luks <luks@...oit.de>)
• [SECURITY] [DSA 2454-1] openssl security update (Raphael Geissert <geissert@...ian.org>)
• Re: incorrect integer conversions in OpenSSL can result in memory corruption. (Douglas Huff <mith@...obdobbs.org>)
• DC4420 - London DEFCON - April meet - Tuesday April 24th 2012 (Major Malfunction <majormal@...ate-radio.org>)
• PenTest is one year old now (Krzysztof Marczyk <krzysztof.marczyk@...tware.com.pl>)
• Re: PenTest is one year old now (Henri Salo <henri@...v.fi>)
• [SECURITY] [DSA 2455-1] typo3-src security update (Nico Golde <nion@...ian.org>)
• Re: DoS vulnerability in WordPress ("MustLive" <mustlive@...security.com.ua>)
• Re: DoS vulnerability in WordPress (Christian Sciberras <uuf6429@...il.com>)

• XSS parameter injection in the search field of http://chicasdetorbe.com (klondike <klondike@...cosoft.es>)
• [ MDVSA-2012:061 ] raptor (security@...driva.com)
• [ MDVSA-2012:062 ] openoffice.org (security@...driva.com)
• [ MDVSA-2012:063 ] libreoffice (security@...driva.com)
• Re: incorrect integer conversions in OpenSSL can result in memory corruption. (Jeffrey Walton <noloader@...il.com>)
• Re: incorrect integer conversions in OpenSSL can result in memory corruption. ("Zach C." <fxchip@...il.com>)

• Re: incorrect integer conversions in OpenSSL can result in memory corruption. (Jeffrey Walton <noloader@...il.com>)
• HTC IQRD Android Permission Leakage (CVE-2012-2217) (VSR Advisories <advisories@...curity.com>)
• Re: HTC IQRD Android Permission Leakage (CVE-2012-2217) (Jeffrey Walton <noloader@...il.com>)
• Attacking Critical Internet Infrastructure (fireball9@...hmail.com)
• Re: HTC IQRD Android Permission Leakage (CVE-2012-2217) (Jason Hellenthal <jhellenthal@...aix.net>)
• Re: Attacking Critical Internet Infrastructure ("Dobbins, Roland" <rdobbins@...or.net>)
• phpMyBible 0.5.1 Mutiple XSS (Thomas Richards <g13net@...il.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS ("Thor (Hammer of God)" <thor@...merofgod.com>)
• XSS and FPD vulnerabilities in Organizer for WordPress ("MustLive" <mustlive@...security.com.ua>)

• Re: phpMyBible 0.5.1 Mutiple XSS (Valdis.Kletnieks@...edu)
• Re: phpMyBible 0.5.1 Mutiple XSS ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS (Jeffrey Walton <noloader@...il.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS (BMF <badmotherfsckr@...il.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS (Laurelai <laurelai@...echan.org>)
• Re: phpMyBible 0.5.1 Mutiple XSS (BMF <badmotherfsckr@...il.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS (Laurelai <laurelai@...echan.org>)
• SumatraPDF v2.0.1 chm and mobi files memory corruption (Carlo Di Dato <shinnai@...istici.org>)
• Mobipocket Reader version 6.2 Build 608 Buffer Overflow (Carlo Di Dato <shinnai@...istici.org>)
• XSS and Blind SQL Injection Vulnerabilities in ExponentCMS (Netsparker Advisories <advisories@...itunasecurity.com>)
• IPhone TreasonSMS - HTML Inject & File Include Vulnerability (Research <research@...nerability-lab.com>)
• Havalite CMS v1.0.4 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• PSFTP v.1.8 Build 921 - Null Pointer (DoS) Vulnerability (Research <research@...nerability-lab.com>)
• Chengdu Bureau of Commerce - SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS (Terrence <secretpackets@...il.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS (Alex Buie <abuie@...services.com>)
• Re: phpMyBible 0.5.1 Mutiple XSS (Jason Hellenthal <jhellenthal@...aix.net>)
• [HITB-Announce] HITB Magazine Issue 008 (now with print edition!) (Hafez Kamal <aphesz@...kinthebox.org>)
• .NET Framework EncoderParameter integer overflow vulnerability (Akita Software Security <lists@...tasecurity.nl>)
• AST-2012-004: Asterisk Manager User Unauthorized Shell Access ("Asterisk Security Team" <security@...erisk.org>)
• AST-2012-005: Heap Buffer Overflow in Skinny Channel Driver ("Asterisk Security Team" <security@...erisk.org>)
• AST-2012-006: Remote Crash Vulnerability in SIP Channel Driver ("Asterisk Security Team" <security@...erisk.org>)
• FYI: We're now paying up to $20, 000 for web vulns in our services (Michal Zalewski <lcamtuf@...edump.cx>)
• [New Tool] - Exploit Pack - Web Security (runlvl <runlvl@...il.com>)
• [New tool] - Exploit Pack - Web Security (runlvl <runlvl@...il.com>)

• BeyondCHM 1.1 Buffer Overflow (Carlo Di Dato <shinnai@...istici.org>)
• OpenSSL Security Advisory (Mark J Cox <mark@...nssl.org>)
• Fwd: Vulnerability research and exploit writing (Ferenc Kovacs <tyra3l@...il.com>)
• Cross Site Scripting - Exploitation & Penetration Strings (Research <research@...nerability-lab.com>)
• Microsoft Incremental Linker Integer Overflow (Walied Assar <waliedassar@...il.com>)
• RuggedCom - Backdoor Accounts in my SCADA network? You don't say... (jc <jc@...rew.org>)
• [New tool] - Exploit Pack - Web Security ("noreply@...loitpack.com" <noreply@...loitpack.com>)
• New IETF I-D: Security Implications of IPv6 on IPv4 networks (Fernando Gont <fgont@...networks.com>)
• Re: [New tool] - Exploit Pack - Web Security (Jerome Athias <jerome@...peas.com>)
• Re: [New tool] - Exploit Pack - Web Security (Michele Orru <antisnatchor@...il.com>)
• Re: [New tool] - Exploit Pack - Web Security (Mario Vilas <mvilas@...il.com>)
• Vulnerability in Backtrack (Григорий Братислава <musntlive@...il.com>)
• [ MDVSA-2012:064 ] openssl0.9.8 (security@...driva.com)
• Re: Vulnerability in Backtrack (Gage Bystrom <themadichib0d@...il.com>)
• Re: Vulnerability in Backtrack (Urlan <urlancomp@...il.com>)
• Re: Vulnerability in Backtrack (Gage Bystrom <themadichib0d@...il.com>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Jim Harrison <Jim@...tools.org>)
• [Tool] Introducing plown: security scanner for Plone CMS (mgogoulos@...eb.me)
• Re: incorrect integer conversions in OpenSSL can result in memory corruption. (sd <sd@...ksheep.org>)
• Re: Vulnerability in Backtrack (Sergio Arcos <sergio.arcos@...il.com>)
• Re: Vulnerability in Backtrack (David3 Gonnella <netevil@...kers.it>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Michal Zalewski <lcamtuf@...edump.cx>)
• Vulnerability in Gentoo hardened (klondike <klondike@...cosoft.es>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Charles Morris <cmorris@...odu.edu>)
• Re: Vulnerability in Gentoo hardened (Milan Berger <m.berger@...ject-mindstorm.net>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: Vulnerability in Gentoo hardened (Valdis.Kletnieks@...edu)
• Re: Vulnerability in Gentoo hardened ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Ramon de C Valle <rcvalle@...hat.com>)
• Hacking WolframAlpha ("Adam Behnke" <adam@...osecinstitute.com>)
• [SECURITY] [DSA 2456-1] dropbear security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Fwd: Vulnerability research and exploit writing ("Elazar Broad" <elazar@...hmail.com>)
• [SECURITY] [DSA 2457-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Fwd: Vulnerability research and exploit writing (Michal Zalewski <lcamtuf@...edump.cx>)
• [SECURITY] [DSA 2548-1] iceape security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Opcodes Database Revival (Jerome Athias <jerome@...peas.com>)

• Re: We're now paying up to $20, 000 for web vulns in our services (Georgi Guninski <guninski@...inski.com>)
• [SECURITY] [DSA 2454-2] openssl incomplete fix (Raphael Geissert <geissert@...ian.org>)
• Re: Vulnerability in Backtrack (Disposable <disposable_94z9Q@...dohacerlo.com>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Jim Harrison <Jim@...tools.org>)
• Re: Fwd: Vulnerability research and exploit writing (Alex Buie <abuie@...services.com>)
• Re: Vulnerability in Gentoo hardened (Georgi Guninski <guninski@...inski.com>)
• Re: Vulnerability in Gentoo hardened (Laurelai <laurelai@...echan.org>)
• Re: Vulnerability in Gentoo hardened (Laurelai <laurelai@...echan.org>)
• Re: Fwd: Vulnerability research and exploit writing (James Condron <james@...o-internet.org.uk>)
• Re: Vulnerability in Gentoo hardened (Laurelai <laurelai@...echan.org>)
• Re: Vulnerability in Gentoo hardened (Benji <me@...ji.com>)
• Re: Vulnerability in Gentoo hardened (Laurelai <laurelai@...echan.org>)
• Re: Vulnerability in Backtrack (James Condron <james@...o-internet.org.uk>)
• Re: Vulnerability in Gentoo hardened (Benji <me@...ji.com>)
• Re: Vulnerability in Gentoo hardened (Laurelai <laurelai@...echan.org>)
• Re: Vulnerability in Gentoo hardened (Benji <me@...ji.com>)
• Re: Vulnerability in Gentoo hardened (Laurelai <laurelai@...echan.org>)
• Re: Vulnerability in Gentoo hardened (Benji <me@...ji.com>)
• MoroccoTel Box Default Open Telnet Password (Jerome Athias <jerome@...peas.com>)
• Re: Vulnerability in Gentoo hardened (Georgi Guninski <guninski@...inski.com>)
• [SECURITY] [DSA 2460-1] asterisk security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Hacking WolframAlpha (Lincoln Anderson <ayblinkin@...il.com>)
• XSS, CSRF and AFU vulnerabilities in Organizer for WordPress ("MustLive" <mustlive@...security.com.ua>)
• (no subject) (Ramon Driessen <ramon.driessen@...il.com>)
• Re: (no subject) (coderman <coderman@...il.com>)
• [Security-news] SA-CONTRIB-2012-062 - Creative Commons - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-063 - RealName - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-064 - Ubercart - Multiple vulnerabilities (security-news@...pal.org)
• Re: [Security-news] SA-CONTRIB-2012-063 - RealName - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-065 - Sitedoc - Information disclosure (security-news@...pal.org)
• FW: (no subject) (imipak <imipak@...il.com>)
• [Security-news] SA-CONTRIB-2012-066 - Spaces and Spaces OG - Access Bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-067 - Linkit - Access bypass (security-news@...pal.org)
• Re: FW: (no subject) (Michael Wood <itnetsec@...il.com>)

• [SECURITY] [DSA 2459-1] quagga security update (Florian Weimer <fw@...eb.enyo.de>)
• Oracle TNS Poison vulnerability is actually a 0day with no patch available (Joxean Koret <joxeankoret@...oo.es>)
• Re: phpMyBible 0.5.1 Mutiple XSS ("Martin Allert" <allert@...go.de>)
• Re: [New tool] - Exploit Pack - Web Security (Mario Vilas <mvilas@...il.com>)
• Microsoft MSN Hotmail - Password Reset & Setup Vulnerability (Research <research@...nerability-lab.com>)
• [SECURITY] [DSA 2461-1] spip security update (Moritz Muehlenhoff <jmm@...ian.org>)
• IA, CSRF and FPD vulnerabilities in Organizer for WordPress ("MustLive" <mustlive@...security.com.ua>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Jim Harrison <Jim@...tools.org>)
• Re: Full-Disclosure Digest, Vol 86, Issue 34 ("Gabriel S. Craciun" <gcraciun@...nsfond.ro>)
• Re: [New tool] - Exploit Pack - Web Security (Michele Orru <antisnatchor@...il.com>)
• CIntruder v0.2 released (psy <root@...depsylon.net>)

• [Exploit Pack] - Web Security -Webinar Live demo! (runlvl <runlvl@...il.com>)
• VMSA-2012-0008 VMware ESX updates to ESX Service Console (VMware Security Team <security@...are.com>)
• [ MDVSA-2012:065 ] php (security@...driva.com)
• [ MDVSA-2012:066 ] mozilla (security@...driva.com)
• DDIVRT-2012-40 PacketVideo TwonkyServer and TwonkyMedia Directory Traversal (ddivulnalert <ddivulnalert@...frontline.com>)
• DDIVRT-2012-41 ACTi Web Configurator cgi-bin Directory Traversal (ddivulnalert <ddivulnalert@...frontline.com>)
• DirectAdmin v1.403 - Multiple Cross Site Vulnerabilities (Research <research@...nerability-lab.com>)
• DIY CMS v1.0 Poll - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• Car Portal CMS v3.0 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability (Research <research@...nerability-lab.com>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Bob McConnell <rvm@...RD.com>)
• Re: We're now paying up to $20, 000 for web vulns in our services (Charlie Derr <cderr@...ons-rock.edu>)
• Re: We're now paying up to $20, 000 for web vulns in our services ("Marcio B. Jr." <marcio.barbado@...il.com>)

• nullcon Delhi 2012 Call for Paper/Call for Event (murtuja bharmal <murtuja_bharmal@...oo.com>)

• Opial CMS v2.0 - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability (Research <research@...nerability-lab.com>)
• China Pujia Government - Blind SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
• China Pujiang Government - Blind SQL Injection Vulnerability (Research <research@...nerability-lab.com>)
• Croogo v1.3.4 CMS - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• [SECURITY] [DSA 2462-1] imagemagick security update (Moritz Muehlenhoff <jmm@...ian.org>)
• WordPress BruteForce Script (CorryL <corryl80@...il.com>)
• Re: WordPress BruteForce Script (R00T_ATI <r00t_ati@...eam.net>)
• PHP Denial of Service - Memory leak in getimagesize(). (Manu <sourvivor@...il.com>)

• Pritlog v0.821 CMS - Multiple Web Vulnerabilities (Research <research@...nerability-lab.com>)
• DoS vulnerabilities in Firefox, Internet Explorer and Opera ("MustLive" <mustlive@...security.com.ua>)
• Re: DoS vulnerabilities in Firefox, Internet Explorer and Opera (Valdis.Kletnieks@...edu)
• CWEs translation (Jerome Athias <jerome@...peas.com>)
• XSS in UMP-Sarkozy mailer system (Jerome Athias <jerome@...peas.com>)
• Re: DoS vulnerabilities in Firefox, Internet Explorer and Opera (InterN0T Advisories <advisories@...ern0t.net>)

384 messages

Powered by blists - more mailing lists