full-disclosure mailing list - 2012/08

Messages by day:

August 1 (36 messages)

• Re: AxMan ActiveX fuzzing <== Memory Corruption PoC (Carlo Di Dato <shinnai@...istici.org>)
• Re: AxMan ActiveX fuzzing <== Memory Corruption PoC (Giles Coochey <giles@...chey.net>)
• [SECURITY] [DSA 2518-1] krb5 security update (Yves-Alexis Perez <corsac@...ian.org>)
• sandboxed browsing (Kyle Creyts <kyle.creyts@...il.com>)
• nvidia linux binary driver priv escalation exploit (Dave Airlie <airlied@...il.com>)
• GunBound - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Barracuda Appliances - Validation Filter Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Barracuda SSL VPN 680 - Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• ME Application Manager 10 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Distimo Monitor 6.0 - Multiple Cross Site Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• ME Mobile Application Manager v10 - SQL Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Integer Overflow (Secunia Research <remove-vuln@...unia.com>)
• Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
• Re: sandboxed browsing (Christian Sciberras <uuf6429@...il.com>)
• Re: sandboxed browsing (Pablo Ximenes <pablo@...en.es>)
• Re: sandboxed browsing (Adam Caudill <adam@...mcaudill.com>)
• Re: sandboxed browsing (Andreas <mailinglisten@...workx.org>)
• Re: Security Problem with Google’s 2-Step Authentication (Pablo Ximenes <pablo@...en.es>)
• Re: sandboxed browsing (yersinia <yersinia.spiros@...il.com>)
• Re: AxMan ActiveX fuzzing <== Memory Corruption PoC (Georgi Guninski <guninski@...inski.com>)
• Re: sandboxed browsing (Christian Sciberras <uuf6429@...il.com>)
• [Security-news] SA-CONTRIB-2012-119 - Excluded Users - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-120 - Monthly Archive by Node Type - Access Bypass (unsupported) (security-news@...pal.org)
• [ MDVSA-2012:111 ] krb5 (security@...driva.com)
• Re: AxMan ActiveX fuzzing <== Memory Corruption PoC (Thor <thor@...merofgod.com>)
• Re: sandboxed browsing (Feighen Oosterbroek <feighen@...il.com>)
• Re: sandboxed browsing (François <aifsair@...il.com>)
• Re: sandboxed browsing (bk <chort0@...il.com>)
• OT: OSX-PHP Dev Enviornment (Thor <thor@...merofgod.com>)
• Re: OT: OSX-PHP Dev Enviornment (Thor <thor@...merofgod.com>)
• Re: OT: OSX-PHP Dev Enviornment (Ferenc Kovacs <tyra3l@...il.com>)
• Re: OT: OSX-PHP Dev Enviornment (Thor <thor@...merofgod.com>)
• Re: OT: OSX-PHP Dev Enviornment (Thor <thor@...merofgod.com>)
• [ MDVSA-2012:121 ] libjpeg-turbo (security@...driva.com)
• Re: sandboxed browsing ("Gillis Jones (Gillis57)" <me@...l.is>)
• Re: sandboxed browsing ("Menerick, John" <jmenerick@...suite.com>)

• hacking FB Ads ("Ivan .Heca" <ivanhec@...il.com>)
• [SECURITY] [DSA 2519-1] isc-dhcp security update (Nico Golde <nion@...ian.org>)
• Re: OT: OSX-PHP Dev Enviornment (Kelvin White <kelvin.white77@...il.com>)
• Kaspersky Password Manager 5.0.0.164 - Software Filter Vulnerability (Vulnerability Lab <admin@...nerability-lab.com>)
• Re: OT: OSX-PHP Dev Enviornment ("Michael D. Wood" <mike@...ecuritypros.org>)
• Re: sandboxed browsing ("Giovanni [dacav] Simoni" <simgidacav@...il.com>)
• Re: OT: OSX-PHP Dev Enviornment (Feighen Oosterbroek <feighen@...il.com>)
• e-commerce websites and password management... (n0sec <n0sec@...ru>)
• Re: hacking FB Ads (You Got Pwned <yougotpwned6@...glemail.com>)
• sandboxed browsing (Kyle Creyts <kyle.creyts@...il.com>)
• Re: OT: OSX-PHP Dev Enviornment (Ulisses Montenegro <ulisses.montenegro@...il.com>)
• Re: OT: OSX-PHP Dev Enviornment ("Kurt Ellzey" <kurt@...-sys.com>)
• Re: nvidia linux binary driver priv escalation exploit (Dave Airlie <airlied@...il.com>)
• [ MDVSA-2012:122 ] icedtea-web (security@...driva.com)
• Re: [ MDVSA-2012:122 ] icedtea-web (Robert Kim App and Facebook Marketing <evdo.hsdpa@...il.com>)
• sandboxed browsing (Robert Kim App and Facebook Marketing <evdo.hsdpa@...il.com>)
• [SECURITY] [DSA 2520-1] openoffice.org security update (Yves-Alexis Perez <corsac@...ian.org>)

• Liferay JSON service API authentication vulnerability (Enrico Cinquini <enrico.cinquini@...il.com>)
• Re: OT: OSX-PHP Dev Enviornment (Kelvin White <kelvin.white77@...il.com>)
• [CVE-2012-3446] Apache Libcloud - possible SSL MITM due to invalid regular expression used to validate the target server host… (Tomaž Muraus <tomaz@...che.org>)
• 29C3: Call for Participation for 29th Chaos Communication Congress (fukami <lists@....io>)
• ZDI-12-128 : Mozilla Firefox nsHTMLSelectElement Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-129 : Microsoft Windows TrueType Font Parsing Remote Code Execution Vulnerability (Remote Kernel) (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-130 : Apple QuickTime Player MP4A Uninitialized Pointer Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-131 : Microsoft .NET Framework Undersized Glyph Buffer Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-132 : IBM Lotus iNotes dwa85W ActiveX Attachment_Times Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-133 : GE Proficy Historian ihDataArchiver.exe Multiple Opcode Parsing Remote Code Execution Vulnerabilities (ZDI Disclosures <zdi-disclosures@...pingpo…)
• ZDI-12-134 : IBM Lotus Quickr QP2 ActiveX _Times Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-135 : Apple QuickTime JPEG2k Sample Size Atom Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

• some distros for Raspberry Pi have sshd enabled and default logins. (larry Cashdollar <larry0@...com>)
• [ MDVSA-2012:123 ] libreoffice (security@...driva.com)
• [ MDVSA-2012:124 ] openoffice.org (security@...driva.com)
• Re: some distros for Raspberry Pi have sshd enabled and default logins. (rancor <therancor@...il.com>)
• Re: some distros for Raspberry Pi have sshd enabled and default logins. (larry Cashdollar <larry0@...com>)
• Re: some distros for Raspberry Pi have sshd enabled and default logins. (Gary Baribault <gary@...ibault.net>)
• Re: some distros for Raspberry Pi have sshd enabled and default logins. (rancor <therancor@...il.com>)
• [SECURITY] [DSA 2521-1] libxml2 security update (Moritz Muehlenhoff <jmm@...ian.org>)

• Re: [SECURITY] [DSA 2521-1] libxml2 security update (Robert Kim App and Facebook Marketing <evdo.hsdpa@...il.com>)
• Portspoof - service signature obfuscator (more pain for port scanners) (Piotr Duszynski <piotr@...zynski.eu>)
• [SECURITY] [DSA 2519-2] isc-dhcp regression (Nico Golde <nion@...ian.org>)
• nvidia linux binary driver priv escalation exploit (Daniel Dadap <ddadap@...dia.com>)
• GreHack 2012 - LAST Call For Papers (Grenoble, France) till 15th August 2012 (Fabien DUCHENE <f.duchene@...-online.fr>)
• CFP BugCON 2013 @ Ciudad de México ("Carlos A. Lozano" <vendetta@...con.org>)

• BeneficialBank Business v4.13.1 - Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Joomla com_package - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Joomla com_photo - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Inout Mobile Webmail APP - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• iAuto Mobile Application 2012 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• VMware Vendor Service - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• [SECURITY] [DSA 2522-1] fckeditor security update (Yves-Alexis Perez <corsac@...ian.org>)
• Android HTC Mail insecure password management (vtalk@...view.com)
• [ MDVSA-2012:125 ] wireshark (security@...driva.com)
• Subject: ZDI-12-134 : IBM Lotus Quickr QP2 ActiveX _Times Remote Code Execution Vulnerability, [from] Full-Disclosure Digest, Vol 90, Issue… (SMiller@...min.com)
• [SECURITY] [DSA 2523-1] globus-gridftp-server security update (Moritz Muehlenhoff <jmm@...ian.org>)
• [SECURITY] [DSA 2524-1] openttd security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Any contacts at Samsung Wintech? (Clare Elliott <hawthorne.uk@...il.com>)
• [SECURITY] [DSA 2525-1] expat security update (Moritz Muehlenhoff <jmm@...ian.org>)

• Re: Any contacts at Samsung Wintech? (Jeffrey Walton <noloader@...il.com>)

• Re: Android HTC Mail insecure password management (Jeffrey Walton <noloader@...il.com>)
• [ MDVSA-2012:126 ] libxml2 (security@...driva.com)
• [ MDVSA-2012:127 ] libtiff (security@...driva.com)
• htaccess files should not be used for security restrictions (Bogdan Calin <bogdan@...netix.com>)
• [HTTPCS] WooPress 'page' Cross Site Scripting Vulnerability (HTTPCS <contact@...pcs.com>)
• Easewe FTP(EaseWeFtp.ocx) Insecure Method Exploit (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• Re: Android HTC Mail insecure password management (coderman <coderman@...il.com>)
• [Security-news] SA-CONTRIB-2012-121 - Shorten URLs - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-122 - Better Revisions - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-123 - Shibboleth authentication - Access Bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-124 - Mime Mail - Access Bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-125 - Chaos tool suite (ctools) - Local File Inclusion and Cross Site Scripting (XSS) (security-news@...pal.org)

• [HITB-Announce] HITB Magazine Issue 009 - Call for Submissions (Hafez Kamal <aphesz@...kinthebox.org>)
• Re: htaccess files should not be used for security restrictions (Jason Hellenthal <jhellenthal@...aix.net>)
• Flogr v2.5.6 & v2.3 - Cross Site Script Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Arasism (IR) CMS - File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Gauss is out ! (Peter Dawson <slash.pd@...il.com>)
• [ MDVSA-2012:128 ] bash (security@...driva.com)
• Fwd: [TSCM-L] {6221} Domain Awareness System (j f <jf@...co.net>)
• How well does Microsoft support (and follow) their mantra "keep your PC updated"? ("Stefan Kanthak" <stefan.kanthak@...go.de>)
• Hacker Highschool v2 (Pete Herzog <pete@...com.org>)
• List Charter (John Cartwright <johnc@...k.org.uk>)
• Re: Hacker Highschool v2 (Benji <me@...ji.com>)
• Re: Hacker Highschool v2 (Peter Dawson <slash.pd@...il.com>)
• Re: Gauss is out ! ("J. Oquendo" <sil@...iltrated.net>)

• [PRE-SA-2012-05] Multiple heap-based buffer overflows in LibreOffice / OpenOffice (Timo Warns <warns@...-sense.de>)
• [ MDVSA-2012:129 ] busybox (security@...driva.com)
• [ MDVSA-2012:129-1 ] busybox (security@...driva.com)

• OS X Local Root: Silly SUID Helper in Tunnel Blick ("Jason A. Donenfeld" <Jason@...c4.com>)
• Re: OS X Local Root: Silly SUID Helper in Tunnel Blick ("Jason A. Donenfeld" <Jason@...c4.com>)
• Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• [HTTPCS] InterPhoto Image Gallery 'thisurl' Cross Site Scripting Vulnerability (HTTPCS <contact@...pcs.com>)
• [ MDVSA-2012:130 ] openldap (security@...driva.com)

• Tech journalists: Stop hyping unproven security tools ("Ivan .Heca" <ivanhec@...il.com>)
• OS X Local Root Exploit for Viscosity OpenVPN Client ("Jason A. Donenfeld" <Jason@...c4.com>)
• Re: Tech journalists: Stop hyping unproven security tools ("Thor (Hammer of God)" <thor@...merofgod.com>)
• iKAT 2012 Release - Interactive Kiosk Attack Tool (Paul Craig <paul@...cked.net>)
• [SECURITY] [DSA 2526-1] libotr security update (Nico Golde <nion@...ian.org>)
• 7sepehr CMS 2012 - Multiple SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• WTB: CIK and Fortezza card (Hambone Turkey <bowling4crypto@...il.com>)
• DLL Hijacking Against Installers In Browser Download Folders for Phish and Profit (Matt Howard <dreaminheks@...il.com>)
• NeoInvoice Blind SQL Injection (CVE-2012-3477) (Adam Caudill <adam@...mcaudill.com>)
• The Android Superuser App (Jann Horn <jannhorn@...glemail.com>)
• Re: WTB: CIK and Fortezza card (Benji <me@...ji.com>)
• nullcon Goa 2013 Call For Papers/Events (nullcon <nullcon@...lcon.net>)
• Re: The Android Superuser App (Jann Horn <jannhorn@...glemail.com>)
• Re: The Android Superuser App (Benji <me@...ji.com>)
• Re: OS X Local Root Exploit for Viscosity OpenVPN Client ("Jason A. Donenfeld" <Jason@...c4.com>)
• Re: Tech journalists: Stop hyping unproven security tools (Lincoln Anderson <ayblinkin@...il.com>)
• Re: OS X Local Root Exploit for Viscosity OpenVPN Client ("Jason A. Donenfeld" <Jason@...c4.com>)
• Re: Tech journalists: Stop hyping unproven security tools (Thor <thor@...merofgod.com>)
• Re: Tech journalists: Stop hyping unproven security tools (Thor <thor@...merofgod.com>)
• Re: Tech journalists: Stop hyping unproven security tools ("Kurt Ellzey" <kurt@...-sys.com>)
• [ MDVSA-2012:131 ] libotr (security@...driva.com)
• Re: DLL Hijacking Against Installers In Browser Download Folders for Phish and Profit (Gynvael Coldwind <gynvael@...dwind.pl>)
• Re: Tech journalists: Stop hyping unproven security tools ("Thor (Hammer of God)" <thor@...merofgod.com>)
• [SECURITY] [DSA 2527-1] php5 security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: WTB: CIK and Fortezza card (valdis.kletnieks@...edu)
• Re: DLL Hijacking Against Installers In Browser Download Folders for Phish and Profit (Christian Sciberras <uuf6429@...il.com>)

• Re: DLL Hijacking Against Installers In Browser Download Folders for Phish and Profit (Matt Howard <dreaminheks@...il.com>)
• TCExam Edit SQL Injection ("research" <research@...ctionis.co.uk>)
• Group-Office Cleartext Credentials Stored in Cookies ("research" <research@...ctionis.co.uk>)
• TCExam Edit Cross-Site Scripting ("research" <research@...ctionis.co.uk>)
• Total Shop UK eCommerce Generic Cross-Site Scripting ("research" <research@...ctionis.co.uk>)
• Re: Tech journalists: Stop hyping unproven security tools (Stefan Edwards <saedwards.ecc@...il.com>)
• Re: Tech journalists: Stop hyping unproven security tools (Stefan Edwards <saedwards.ecc@...il.com>)
• [Announcement] ClubHack Magazine's Aug 2012 Issue Released (Abhijeet Patil <getabhijeetpatil@...il.com>)
• [SECURITY] [DSA 2528-1] icedove security update (Florian Weimer <fw@...eb.enyo.de>)

• Nishang: PowerShell for Penetration Testing (Nikhil Mittal <nikhil_uitrgpv@...oo.co.in>)
• Re: The Android Superuser App (Alexander Pruss <arpruss@...il.com>)
• debugfs exploit for a number of Android devices (Alexander Pruss <arpruss@...il.com>)
• [SECURITY] [DSA 2529-1] python-django security update (Thijs Kinkhorst <thijs@...ian.org>)
• DivX Plus Player plugin 2.2.0.52 Buffer Overflow PoC (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• Powershell for Penetration Testing - Nishang tool (John Cage <infosecnerdguy@...oo.com>)
• Associate professor from Pakistan National University - spammer (Tonu Samuel <tonu@....ee>)
• New Adobe Reader fixes some, but not all known bugs (Mateusz Jurczyk <j00ru.vx@...il.com>)
• [2.0 Update] Cisco Security Advisory: Cisco IOS XR Software Route Processor Denial of Service Vulnerability (Cisco Systems Product Security Incident Response T…)
• Re: debugfs exploit for a number of Android devices (Dan Rosenberg <dan.j.rosenberg@...il.com>)
• Re: debugfs exploit for a number of Android devices (Alexander Pruss <arpruss@...il.com>)
• [ MDVSA-2012:132 ] glpi (security@...driva.com)
• [Security-news] SA-CONTRIB-2012-126 - Hotblocks - Cross Site Scripting (XSS) and Denial of Service (DoS) (security-news@...pal.org)
• Drupal Custom Publishing Options Module XSS ("Justin C. Klein Keane" <justin@...irish.net>)
• Re: [Security-news] SA-CONTRIB-2012-126 - Hotblocks - Cross Site Scripting (XSS) and Denial of Service (DoS) ("Justin C. Klein Keane" <justin@...irish.net>)
• Re: Nishang: PowerShell for Penetration Testing (Harry Hoffman <hhoffman@...solutions.net>)
• [Security-news] SA-CONTRIB-2012-128 - Elegant Theme - Cross Site Scripting (XSS) (security-news@...pal.org)
• [SECURITY] [DSA 2530-1] rssh security update (Florian Weimer <fw@...eb.enyo.de>)
• [Security-news] SA-CONTRIB-2012-127 - Custom Publishing Options - Cross Site Scripting (XSS) Vulnerability (security-news@...pal.org)
• Re: Nishang: PowerShell for Penetration Testing (Peter Dawson <slash.pd@...il.com>)

• Re: Associate professor from Pakistan National University - spammer (valdis.kletnieks@...edu)
• Re: Full-Disclosure Digest, Vol 90, Issue 21 (Nikhil Mittal <nikhil_uitrgpv@...oo.co.in>)
• Re: Nishang: PowerShell for Penetration Testing (Nikhil Mittal <nikhil_uitrgpv@...oo.co.in>)
• Re: Associate professor from Pakistan National University - spammer (Tonu Samuel <tonu@...m.ee>)
• vulnerabilities in Samsung Epic 4G Touch with 2.3.6, and probably other Samsungs (Alexander Pruss <arpruss@...il.com>)
• Intercepting TOR (full-disclosure@...d32.com)
• middle-clicking on links (Jann Horn <jannhorn@...glemail.com>)
• Re: Intercepting TOR (valdis.kletnieks@...edu)
• [ MDVSA-2012:133 ] usbmuxd (security@...driva.com)
• Re: Associate professor from Pakistan National University - spammer (Jacqui Caren <jacqui.caren@...world.com>)
• Re: Nishang: PowerShell for Penetration Testing (Harry Hoffman <hhoffman@...solutions.net>)
• New version of dnsspider (noptrix <levonkayan@....net>)
• [ MDVSA-2012:134 ] wireshark (security@...driva.com)
• [ MDVSA-2012:135 ] wireshark (security@...driva.com)

• [ MDVSA-2012:136 ] phpmyadmin (security@...driva.com)
• [ MDVSA-2012:138 ] acpid (security@...driva.com)
• [ MDVSA-2012:137 ] acpid (security@...driva.com)
• Re: The Android Superuser App (David Black <disclosure@....org>)
• [FOREGROUND SECURITY 2012-001] Lsoft ListServ v16 (WA revision R4241) SHOWTPL parameter Cross-SIte Scripting - XSS (Jose Carlos de Arriba <jcarriba@...egrounds…)
• GIMP Scriptfu Python Remote Command Execution ("research" <research@...ctionis.co.uk>)
• Social Engine v4.2.5 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• ShopperPress v2.7 Wordpress - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Nike+ Panel & Mobile App - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Re: Associate professor from Pakistan National University - spammer (Tonu Samuel <tonu@....ee>)
• Re: GIMP Scriptfu Python Remote Command Execution (Julius Kivimäki <julius.kivimaki@...il.com>)
• Context IS Advisory - SAP Host Control Remote Code Execution (Context IS - Disclosure <disclosure@...textis.co.uk>)
• ZDI-12-136 : Apple QuickTime Invalid Public Movie Atom Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-137 : Apple Mac OS X libsecurity_cdsa_plugin Malloc Integer Truncation Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoi…)
• ZDI-12-138 : SAP Business Objects Financial Consolidation CtAppReg.dll username Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpo…)
• ZDI-12-139 : SAP Crystal Reports crystalras.exe OBUnmarshal Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-140 : McAfee SmartFilter Administration Server SFAdminSrv.exe JBoss RMI Remote Code Execution Vulnerabilty (ZDI Disclosures <zdi-disclosures@...pingpoin…)
• ZDI-12-141 : Microsoft .NET Framework Clipboard Unsafe Memory Access Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-142 : Oracle Java WebStart Browser Argument Injection Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-143 : Microsoft Visio DWGDP MTEXT Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-144 : EMC AutoStart ftAgent Opcode 0x4B Subcode 0x1D4C Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• Re: Associate professor from Pakistan National University - spammer (valdis.kletnieks@...edu)

• Re: how i stopped worrying and loved the backdoor (coderman <coderman@...il.com>)
• Re: debugfs exploit for a number of Android devices (coderman <coderman@...il.com>)

• Re: how i stopped worrying and loved the backdoor (Dan Kaminsky <dan@...para.com>)
• IOServer "Root Directory" Trailing Backslash Web Server Vuln (hinge <hinge@...fus.net>)
• [HTTPCS] w-agora 4.2.1 Multiple Vulnerabilities(SQLI, XSS) (HTTPCS <contact@...pcs.com>)
• Re: GIMP Scriptfu Python Remote Command Execution (Giles Coochey <giles@...chey.net>)
• ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities [UPDATED!] (Vulnerability Lab <research@...nerability-lab.com>)
• [SECURITY] [DSA 2531-1] xen security update (Luciano Bello <luciano@...ian.org>)
• Re: how i stopped worrying and loved the backdoor (Marcus Meissner <meissner@...e.de>)
• Re: how i stopped worrying and loved the backdoor (Robert Kim App and Facebook Marketing <evdo.hsdpa@...il.com>)
• [ MDVSA-2012:139 ] postgresql (security@...driva.com)
• Re: how i stopped worrying and loved the backdoor ("Thor (Hammer of God)" <thor@...merofgod.com>)
• Re: DakaRand (Dan Kaminsky <dan@...para.com>)
• Re: DakaRand (Ben Laurie <ben@...ks.org>)
• Re: DakaRand (Jeffrey Walton <noloader@...il.com>)
• Re: DakaRand (Dan Kaminsky <dan@...para.com>)
• Re: DakaRand (Ben Laurie <ben@...ks.org>)
• Re: DakaRand (Dan Kaminsky <dan@...para.com>)
• Re: DakaRand (Jeffrey Walton <noloader@...il.com>)

• Re: DakaRand (Ben Laurie <ben@...ks.org>)
• Re: DakaRand (Dan Kaminsky <dan@...para.com>)
• Re: DakaRand (Ben Laurie <ben@...ks.org>)
• [ MDVSA-2012:140 ] mono (security@...driva.com)
• Windows Internet Explorer(ieframe.dll) null pointer dereference (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• ocPoral CMS 8.x | Cross Site Request Forgery (CSRF) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
• ocPoral CMS 8.x | Session Hijacking Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
• Re: vulnerabilities in Samsung Epic 4G Touch with 2.3.6, and probably other Samsungs (Alexander Pruss <arpruss@...il.com>)
• Re: GIMP Scriptfu Python Remote Command Execution ("research" <research@...ctionis.co.uk>)
• The most realistic hacking contest (Dmitry Evteev <devteev@...ecurity.ru>)
• Re: DakaRand (Dan Kaminsky <dan@...para.com>)
• Re: DakaRand (Paul Schmehl <pschmehl_lists@...rr.com>)
• Re: DakaRand (Giles Coochey <giles@...chey.net>)
• Re: DakaRand (Paul Schmehl <pschmehl_lists@...rr.com>)
• Re: DakaRand (Dan Kaminsky <dan@...para.com>)
• Re: DakaRand (Paul Schmehl <pschmehl_lists@...rr.com>)

• How to use ARP Spoof to bypass firewall ACL? (Richard Miles <richard.k.miles@...glemail.com>)
• [ MDVSA-2012:141 ] openslp (security@...driva.com)
• [ MDVSA-2012:142 ] gimp (security@...driva.com)

• string length field overwrite in IE9? ("pm whatever" <pmwhatever@....net>)
• USB HID attacks on Mac OS X (Herald Gibson <heraldgibson@...ketmail.com>)
• XSS and Blind SQL Injection Vulnerabilities in Banana Dance CMS (Netsparker Advisories <advisories@...itunasecurity.com>)
• XSS and SQL Injection Vulnerabilities in OrderSys (Netsparker Advisories <advisories@...itunasecurity.com>)
• XSS Vulnerabilities in LabWiki (Netsparker Advisories <advisories@...itunasecurity.com>)
• XSS and SQL Injection Vulnerabilities in Jara (Netsparker Advisories <advisories@...itunasecurity.com>)
• [SECURITY] [DSA 2532-1] libapache2-mod-rpaf security update (Thijs Kinkhorst <thijs@...ian.org>)
• ZDI-12-145 : Symantec Endpoint Protection SemSvc.exe AgentServlet Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-146 : Novell eDirectory RelativeToFullDN Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-147 : WebKit ContentEditable swapInNode Use-After-Free Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-148 : GE Proficy Real-Time Information Portal Remote Interface Service Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoin…)
• ZDI-12-149 : Cisco AnyConnect VPN Client Verification Bypass Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-150 : Oracle Outside In XPM Processing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-151 : Oracle Outside In Excel File TxO Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• Re: ZDI-12-145 : Symantec Endpoint Protection SemSvc.exe AgentServlet Remote Code Execution Vulnerability (James Lay <jlay@...ve-tothe-box.net>)
• ZDI-12-152 : Oracle Outside In Excel MergeCells Record Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-153 : Apple QuickTime sean Atom Size Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-154 : IBM Lotus Notes URL Command Injection Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-155 : InduSoft Thin Client ISSymbol InternationalOrder Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• Re: ZDI-12-149 : Cisco AnyConnect VPN Client Verification Bypass Remote Code Execution Vulnerability (Benji <me@...ji.com>)
• ZDI-12-156 : Cisco AnyConnect VPN Client Arbitrary Program Instantiation Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com…)
• ZDI-12-157 : Microsoft Excel Series Record Parsing Type Mismatch Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-158 : Microsoft Internet Explorer MSADO CacheSize Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-159 : EMC AutoStart ftAgent Opcode 0x14 Subcode 0x7e7 Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-160 : EMC AutoStart ftAgent Opcode 0x14 Subcode 0x7F8 Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-161 : EMC AutoStart ftAgent Opcode 0x2d Subcode 0x1194 Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 180 day deadline. (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-163 : (0Day) HP iNode Management Center iNodeMngChecker.exe Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-164 : (0Day) HP Intelligent Management Center img.exe Integer Wrap Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.co…)
• ZDI-12-165 : (0Day) HP Operations Agent for NonStop Server HEALTH Packet Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingp…)
• ZDI-12-166 : (0Day) HP LeftHand Virtual SAN Appliance Unauthenticated Access Remote Command Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpo…)
• -==SEC-T 2012 Invitation==- (Mattias Bååth <mattias.baath@...dband.net>)
• Vulnerabilities in JW Player Pro ("MustLive" <mustlive@...security.com.ua>)

• Re: ZDI-12-149 : Cisco AnyConnect VPN Client Verification Bypass Remote Code Execution Vulnerability (kkhagel@...vipe.com)
• Adobe Pixel Bender Toolkit2 (tbbmalloc.dll) DLL Hijacking Exploit (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• foxit reader 5.3.1(dwmapi.dll) DLL Hijacking Exploit (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• Snagit 11.0.1 (dwmapi.dll) DLL Hijacking Exploit (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• Ad Manager Pro v. 4 Remote FLI (CorryL <corryl80@...il.com>)
• [ MDVSA-2012:143 ] python-django (security@...driva.com)
• [SECURITY] [DSA 2533-1] pcp security update (Florian Weimer <fw@...eb.enyo.de>)
• Re: XSS Vulnerabilities in LabWiki (Henri Salo <henri@...v.fi>)

• Re: XSS and SQL Injection Vulnerabilities in Jara (Henri Salo <henri@...v.fi>)
• Microsoft Indexing Service Server-side null pointer dereference (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• Microsoft Indexing Service Server-side (ixsso.dll) null pointer dereference (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• Re: How to use ARP Spoof to bypass firewall ACL? (taha <tahacalypse@...il.com>)
• Re: XSS Vulnerabilities in LabWiki (muuratsalo experimental hack lab <muuratsalo@...il.com>)
• [IA23] Aoop CMS v0.3.6 Multiple Vulnerabilities (Inshell Security <info@...hell.net>)

• Re: XSS and SQL Injection Vulnerabilities in OrderSys (muuratsalo experimental hack lab <muuratsalo@...il.com>)
• yahoo messenger 11.5.0 (d3d10.dll) DLL Hijacking Exploit (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• [SECURITY] [DSA 2534-1] postgresql-8.4 security update (Florian Weimer <fw@...eb.enyo.de>)

• Re: yahoo messenger 11.5.0 (d3d10.dll) DLL Hijacking Exploit (Julius Kivimäki <julius.kivimaki@...il.com>)
• Windows Kernel Intel x64 SYSRET Vulnerability + Code Signing Bypass Bonus (Shahriyar Jalayeri <shahriyar.j@...il.com>)

• Conceptronic Grab’n’Go Network Storage and Sitecom Home Storage Center - Authentication Bypass Vulnerability in - AA… (Mattijs van Ommeren <mattijs@...yon.nl>)
• Conceptronic Grab’n’Go Network Storage - Password disclosure Vulnerability - AA-002 (Mattijs van Ommeren <mattijs@...yon.nl>)
• OpenSecurityTraining Exploits 2 class (OST FD <opensectraining.fd@...il.com>)
• CA20111208-01: Security Notice for CA SiteMinder [updated] ("Williams, James K" <James.Williams@...com>)
• Re: Printer in the DMZ (Benji <me@...ji.com>)
• Re: Conceptronic Grab’n’Go Network Storage - Password disclosure Vulnerability - AA-002 (Mattijs van Ommeren <mattijs@...yon.nl>)
• Zend Framework - Local file disclosure via XXE injection ("MustLive" <mustlive@...security.com.ua>)
• XXE Injection in CakePHP and Squiz CMS ("MustLive" <mustlive@...security.com.ua>)
• The Dangerous of Fakeroot (Teguh <info@...ektronic.com>)
• Printer in the DMZ (Igor Igor <unclyigor@...il.com>)
• Re: Printer in the DMZ (Joshua Thomas <rappercrazzy@...il.com>)
• Re: The Dangerous of Fakeroot (Jeffrey Walton <noloader@...il.com>)
• Re: The Dangerous of Fakeroot (Wiliam Steck <codeinjection@...il.com>)
• Re: The Dangerous of Fakeroot ("Thor (Hammer of God)" <thor@...merofgod.com>)

• Re: The Dangerous of Fakeroot (Wiliam Steck <codeinjection@...il.com>)
• Re: The Dangerous of Fakeroot (Wiliam Steck <codeinjection@...il.com>)
• Re: Printer in the DMZ (valdis.kletnieks@...edu)
• cloudsafe365 for wordpress: file disclosure (Jan van Niekerk <jvnkrk@...il.com>)
• Re: cloudsafe365 for wordpress: file disclosure (Henri Salo <henri@...v.fi>)
• Re: cloudsafe365 for wordpress: file disclosure (Christian Sciberras <uuf6429@...il.com>)
• Re: cloudsafe365 for wordpress: file disclosure (Henri Salo <henri@...v.fi>)
• [ MDVSA-2012:144 ] tetex (security@...driva.com)
• [IMF 2013] Call for Papers (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
• Re: cloudsafe365 for wordpress: file disclosure (Ivan Carlos <icarlos@...rlos.net>)

• CVE-2012-2665 Manifest-processing errors in Apache OpenOffice 3.4.0 (Rob Weir <robweir@...che.org>)
• [HTTPCS] Plogger multiple vulnerabilities (HTTPCS <contact@...pcs.com>)
• [SE-2012-01] information regarding recently discovered Java 7 attack (Security Explorations <contact@...urity-explorations.com>)
• Re: The Dangerous of Fakeroot (Teguh <info@...ektronic.com>)
• Re: The Dangerous of Fakeroot (Teguh <info@...ektronic.com>)
• Teaching Hackers to Hack: "The Shellcode Lab" training at "Hack In The Box" (Ty Miller <tyronmiller@...il.com>)
• Re: cloudsafe365 for wordpress: file disclosure (craig deveson <craig.deveson@...il.com>)
• [ MDVSA-2012:145 ] firefox (security@...driva.com)
• t2′12: Challenge to be released 2012-09-01 10:00 EEST (Tomi Tuominen <tomi.tuominen@...fi>)
• [ MDVSA-2012:146 ] firefox (security@...driva.com)
• ZDI-12-168 : InduSoft Thin Client ISSymbol InternationalSeparator Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-167 : (0Day) Novell File Reporter NFRAgent.exe VOL Tag Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-169 : GE Proficy Historian KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-170 : (0Day) HP Application Lifecycle Management XGO.ocx ActiveX Control Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpo…)
• ZDI-12-171 : (0Day) Hewlett-Packard Intelligent Management Center UAM sprintf Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoin…)
• ZDI-12-172 : (0Day) HP Operations Orchestration RSScheduler Service JDBC Connector Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pin…)
• ZDI-12-173 : (0Day) HP SiteScope SOAP Call getSiteScopeConfiguration Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-174 : (0Day) HP SiteScope UploadFilesHandler Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-176 : (0Day) HP SiteScope SOAP Call getFileInternal Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-175 : (0Day) HP SiteScope SOAP Call create Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-177 : (0Day) HP SiteScope SOAP Call loadFileContent Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-178 : (0Day) HP SiteScope SOAP Call update Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-179 : EMC ApplicationXtender Desktop Viewer AEXView ActiveX AnnoSave Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.…)
• ZDI-12-181 : Novell iPrint nipplib.dll client-file-name Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-180 : Novell ZENWorks AdminStudio ISGrid.dll ActiveX Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• ZDI-12-182 : EMC AppXtender WxSuperCtrl650.ocx ActiveX Control Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
• [ MDVSA-2012:147 ] mozilla-thunderbird (security@...driva.com)
• Re: [SE-2012-01] information regarding recently discovered Java 7 attack (Jeffrey Walton <noloader@...il.com>)
• Re: [SE-2012-01] information regarding recently discovered Java 7 attack (Jeffrey Walton <noloader@...il.com>)
• [Security-news] SA-CONTRIB-2012-132 - Announcements - Access Bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-131 - Email Field - Access Bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-133 - Taxonomy Image - Cross Site Scripting (XSS) & Arbitrary PHP code execution (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-130 - Jstool - Multiple Vulnerabilities (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-129 - Activism - Access Bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-134 - Views - Privilege Escalation (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2012-135 - CAPTCHA - Insufficient anti-automation prevention (security-news@...pal.org)
• [SECURITY] [DSA 2535-1] rtfm security update (Florian Weimer <fw@...eb.enyo.de>)
• Re: [SE-2012-01] information regarding recently discovered Java 7 attack (Tim <tim-security@...tinelchicken.org>)
• [Security-news] SA-CONTRIB-2012-136 - Apache Solr Search Autocomplete - Cross Site Scripting (XSS) (security-news@...pal.org)
• Netsparker Community Edition is Back (Netsparker Advisories <advisories@...itunasecurity.com>)

• Re: [SE-2012-01] information regarding recently discovered Java 7 attack (Jacqui Caren <jacqui.caren@...world.com>)
• vBulletin and MyBB Vulnerability (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)
• SEC Consult 20120829-0 :: Symantec Messaging Gateway - Support Backdoor (SEC Consult Vulnerability Lab <research@...-consult.com>)
• [ MDVSA-2012:074-1 ] ffmpeg (security@...driva.com)
• [ MDVSA-2012:148 ] ffmpeg (security@...driva.com)
• [SECURITY] [DSA 2536-1] otrs2 security update (Florian Weimer <fw@...eb.enyo.de>)
• [SECURITY] [DSA 2537-1] typo3-src security update (Florian Weimer <fw@...eb.enyo.de>)
• AST-2012-012: Asterisk Manager User Unauthorized Shell Access ("Asterisk Security Team" <security@...erisk.org>)
• AST-2012-013: ACL rules ignored when placing outbound calls by certain IAX2 users ("Asterisk Security Team" <security@...erisk.org>)
• War FTP Daemon Remote Format String Vulnerability (kaveh ghaemmaghami <kavehghaemmaghami@...glemail.com>)

• VMSA-2012-0013 VMware vSphere and vCOps updates to third party libraries (VMware Security Team <security@...are.com>)
• .Net Cross Site Scripting - Request Validation Bypassing ("Seeker Research Center" <qsrc@...tium.com>)
• Re: [SE-2012-01] information regarding recently discovered Java 7 attack (Security Explorations <contact@...urity-explorations.com>)
• Re: [SE-2012-01] information regarding recently discovered Java 7 attack (Security Explorations <contact@...urity-explorations.com>)
• [SE-2012-01] New security issue affecting Java SE 7 Update 7 (Security Explorations <contact@...urity-explorations.com>)
• SNMP Reflected Denial Of Service - PoC (Full Disclosure <full.disclosure@...dex.ru>)
• Re: SNMP Reflected Denial Of Service - PoC (Anestis Bechtsoudis <bechtsoudis.a@...il.com>)
• Re: [SE-2012-01] information regarding recently discovered Java 7 attack (Jeffrey Walton <noloader@...il.com>)
• IBM Lotus Domino Cross-Site Scripting and HTTP Response Splitting vulnerabilities ("MustLive" <mustlive@...security.com.ua>)

393 messages

Powered by blists - more mailing lists