full-disclosure mailing list - 2013/12

Messages by day:

December 1 (3 messages)

• TouchID and !simple passcodes (Brandon Perry <bperry.volatile@...il.com>)
• Re: Day of bugs in WordPress 3 (Zenny <garbytrash@...il.com>)
• Re: Seems like Coinbase Security Team doesn't know how their cookie works (Marc Nimmerrichter <marc.nimmerrichter@....at>)

• PHDays IV Call for Papers is Open (PHD <PHD@...ecurity.com>)
• Photo Transfer Wifi 1.4.4 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• (no subject) (Ciaran McNally <ciaran.mcnally3@...l.dcu.ie>)
• D-Link DIR-XXX remote root access exploit. ("ScripT setInterval(function(){for( ){alert('fixme')} } 10) /scRIpt" <tytusromekiatomek@...ox.com>)
• FBTest remote command execution. ("ScripT setInterval(function(){for( ){alert('fixme')} } 10) /scRIpt" <tytusromekiatomek@...ox.com>)
• Multiple issues in OpenSSL - BN (multiprecision integer arithmetics). ("ScripT setInterval(function(){for( ){alert('fixme')} } 10) /scRIpt" <tytusromekiatomek…)
• Command injection vulnerability in Ruby Gem sprout 0.7.246 ("Larry W. Cashdollar" <larry0@...com>)

• Re: Multiple issues in OpenSSL - BN (multiprecision integer arithmetics). (coderman <coderman@...il.com>)
• CarolinaCon-10 / 2014 - Call for Presenters/Speakers (Vic Vandal <vvandal@...l.com>)
• Re: CVE-2013-6271 Remove Android Device Lock - App published (Curesec Research Team <crt@...esec.com>)
• [SECURITY] [DSA 2808-1] openjpeg security update (Raphael Geissert <geissert@...ian.org>)
• [CVE-2013-6237] ISL Light - Desktop 3.5.4, Clipboard security issue (Fran <jfrancisco.bolivar@...il.com>)
• Tftpd32 Client Side Format String Vulnerability ("Rustein, Fara Denise (LATCO - Buenos Aires)" <frustein@...OITTE.com>)
• DAVOSET v.1.1.4 ("MustLive" <mustlive@...security.com.ua>)

• NEW VMSA-2013-0014 VMware Workstation, Fusion, ESXi and ESX patches address a guest privilege escalation ("\"VMware Security Response Center\"" <security@...ar…)
• McAfee Email Gateway multiple vulns (Brandon Perry <bperry.volatile@...il.com>)
• Any not annoying help welcome (ICSS Security <ctrlaltdelete@...look.pt>)
• Re: Any not annoying help welcome (ICSS Security <ctrlaltdelete@...look.pt>)
• Re: Any not annoying help welcome (adam <iarethebest@...il.com>)
• Re: Any not annoying help welcome (Michael von Dach <michael.vondach@...ikedown.ch>)
• Imagam iFiles v1.16.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Re: Any not annoying help welcome (Christopher Dreher <Christopher.Dreher@...osec.de>)
• [SECURITY] [DSA 2809-1] ruby1.8 security update (Salvatore Bonaccorso <carnil@...ian.org>)
• [SECURITY] [DSA 2810-1] ruby1.9.1 security update (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: DAVOSET v.1.1.4 ("MustLive" <mustlive@...security.com.ua>)

• [Security-news] SA-CONTRIB-2013-097 - OG Features - Access bypass (security-news@...pal.org)
• CFP RootedCON 2014 (Omar Benbouazza <bvomar@...il.com>)
• Reflected XSS Attacks XSS vulnerabilities in NagiosQL 3.2.0 Servicepack 2 (CVE: CVE-2013-6039) (William Costa <william.costa@...il.com>)
• Re: Any not annoying help welcome (Mr OverBlue <theoverblue@...il.com>)
• Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Wireless Transfer App 3.7 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

• NEW VMSA-2013-0015 VMware ESX updates to third party libraries (Edward Hawkins <security@...are.com>)
• [CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS (xin.wang <xin.wang@...ppsecurity.com.cn>)
• China's tool of the year (silence_is_best@...hmail.com)
• [CVE-2013-5676] Plain Text Password In SonarQube Jenkins Plugin (Christian Catalano <ch.catalano@...il.com>)
• Re: Vulnerabilities hiddenly fixed in WordPress 3.6 and 3.6.1 ("MustLive" <mustlive@...security.com.ua>)

• [CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application (Daniel Wood <daniel.wood@...sp.org>)

• [SECURITY] [DSA 2811-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
• Vulnerabilities hiddenly fixed in WordPress 3.5 and 3.5.1 ("MustLive" <mustlive@...security.com.ua>)

• Feetan Inc WireShare v1.9.1 iOS - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Print n Share v5.5 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• [SECURITY] [DSA 2812-1] samba security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Vulnerabilities in Apache Solr < 4.6.0 (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
• Re: Vulnerabilities hiddenly fixed in WordPress 3.5 and 3.5.1 (Julius Kivimäki <julius.kivimaki@...il.com>)
• Re: Open phones for privacy/anonymity applications, Guardian (Anonymous <nobody@...ailer.paranoici.org>)
• [SECURITY] [DSA 2813-1] gimp security update (Moritz Muehlenhoff <jmm@...ian.org>)
• [SECURITY] [DSA 2814-1] varnish security update (Salvatore Bonaccorso <carnil@...ian.org>)
• [SECURITY] [DSA 2815-1] munin security update (Salvatore Bonaccorso <carnil@...ian.org>)

• Air Gallery 1.0 Air Photo Browser - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Re: Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability #full (Vulnerability Lab <research@...nerability-lab.com>)
• Owning Render Farms via NVIDIA mental ray (ReVuln <info@...uln.com>)
• CORE-2013-1107 - IcoFX Buffer Overflow Vulnerability (CORE Advisories Team <advisories@...esecurity.com>)
• Android Fragment Injection vulnerability (Roee Hay <roeeh@...ibm.com>)

• Re: Open phones for privacy/anonymity applications, Guardian (Sean Lynch <seanl@...erati.org>)
• Adobe Flash Player and Shockwave Player security updates (Osama Alrashid <osama.alrashid@...il.com>)
• Photo Video Album Transfer 1.0 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• [Onapsis Research Labs] New SAP Security In-Depth issue: "Transport Management System: Highway to Production" (Onapsis Research Labs <research@...psis.com>)
• Clickjacking (?) on Facebook.com (Question) (Stefan Schurtz <sschurtz@...nline.de>)
• CORE-2013-0807 - Divide Error in Windows Kernel (CORE Advisories Team <advisories@...esecurity.com>)
• SOJOBO-ADV-13-05: Vtiger 5.4.0 Reflected Cross Site Scripting (<advisories@...omio.com>)
• List Charter (John Cartwright <johnc@...k.org.uk>)
• Re: CORE-2013-0807 - Divide Error in Windows Kernel (CORE Advisories Team <advisories@...esecurity.com>)

• Microsoft PhotoStory - CS Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• Microsoft Yammer - Persistent Profile Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Re: Clickjacking (?) on Facebook.com (Question) (Jann Horn <jann@...jh.net>)
• Re: Clickjacking (?) on Facebook.com (Question) (Stefan Schurtz <sschurtz@...nline.de>)
• Re: Clickjacking (?) on Facebook.com (Question) (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: Clickjacking (?) on Facebook.com (Question) (Jann Horn <jann@...jh.net>)
• Re: Clickjacking (?) on Facebook.com (Question) (Michal Zalewski <lcamtuf@...edump.cx>)
• Command injection in Ruby Gem Webbynode 1.0.5.3 ("Larry W. Cashdollar" <larry0@...com>)

• Re: Clickjacking (?) on Facebook.com (Question) (Jann Horn <jann@...jh.net>)
• Re: Clickjacking (?) on Facebook.com (Question) (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: Clickjacking (?) on Facebook.com (Question) (Jann Horn <jann@...jh.net>)
• Re: Clickjacking (?) on Facebook.com (Question) (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: Clickjacking (?) on Facebook.com (Question) (Jann Horn <jann@...jh.net>)
• Re: Clickjacking (?) on Facebook.com (Question) (Nahuel Grisolía <nahuel.grisolia@...il.com>)
• Ditto Forensic FieldStation, multiple vulnerabilities (Martin Wundram <wundram@...itrace.de>)
• [SECURITY] [DSA 2816-1] php5 security update (Thijs Kinkhorst <thijs@...ian.org>)
• <b>Where are you guys standing re: the (full) disclosure question?</b> (Pedro Luis Karrasquillo <peter_toyota@...mail.com>)
• Multiple vulnerabilities in SMF forum software (Jakob Lell <jakob@...oblell.com>)
• Re: Where are you guys standing re: the (full) disclosure ("Mikhail A. Utin" <mutin@...monwealthcare.org>)
• Re: <b>Where are you guys standing re: the (full) disclosure question?</b> (Georgi Guninski <guninski@...inski.com>)
• Re: Where are you guys standing re: the (full) disclosure (Georgi Guninski <guninski@...inski.com>)
• Re: Where are you guys standing re: the (full) disclosure (imipak <imipak@...il.com>)
• Microsoft Online, Office & Cloud - Persistent Encoding Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Re: Where are you guys standing re: the (full) disclosure (Gary Baribault <gary@...ibault.net>)
• Re: Where are you guys standing re: the (full) disclosure (Georgi Guninski <guninski@...inski.com>)
• DC4420 - DefCon London: Christmas Social (= no talks), Tuesday 17th December 2013 (Tony Naggs <tonynaggs@...il.com>)
• Re: Where are you guys standing re: the (full) disclosure (Gary Baribault <gary@...ibault.net>)
• Re: Where are you guys standing re: the (full) disclosure (Jeffrey Walton <noloader@...il.com>)
• Re: Where are you guys standing re: the (full) disclosure (Gary Baribault <gary@...ibault.net>)
• Re: Where are you guys standing re: the (full) disclosure (Gary Baribault <gary@...ibault.net>)
• Advisory 01/2013: PHP openssl_x509_parse() Memory Corruption Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
• Re: Where are you guys standing re: the (full) disclosure (Gary Baribault <gary@...ibault.net>)
• Re: Where are you guys standing re: the (full) disclosure (Gary Baribault <gary@...ibault.net>)

• RDRAND used directly when default engines loaded in openssl-1.0.1-beta1 through openssl-1.0.1e (coderman <coderman@...il.com>)
• Re: Where are you guys standing re: the (full) disclosure (amani <amani@...tmail.us>)
• cryptographic flaws in IBM SPSS data file encryption (Ben Pfaff <blp@...stanford.edu>)
• [SECURITY] [DSA 2817-1] libtar security update (Luciano Bello <luciano@...ian.org>)
• Securely Download Google Chrome Offline Installer (Dieyu <dieyu@...yu.org>)
• Re: <b>Where are you guys standing re: the (full) disclosure question?</b> (silence_is_best@...hmail.com)
• Re: <b>Where are you guys standing re: the (full) disclosure question?</b> (Jasper Kips <jasper@...netkips.nl>)
• E-mail Hacking - Hacker Highschool (Pete Herzog <lists@...com.org>)
• Re: Where are you guys standing re: the (full) disclosure (Paul Ammann <pta1@...tmail.us>)
• Re: Where are you guys standing re: the (full) disclosure (Jordon Bedwell <envygeeks@...il.com>)
• Re: Where are you guys standing re: the (full) disclosure (Jordon Bedwell <envygeeks@...il.com>)
• Re: Where are you guys standing re: the (full) disclosure (Jordon Bedwell <envygeeks@...il.com>)
• Call for Papers -YSTS 8 - Information Security Conference, Brazil (Luiz Eduardo <le@...s.org>)
• Re: <b>Where are you guys standing re: the (full) disclosure question?</b> (Dieyu <dieyu@...yu.org>)
• Re: <b>Where are you guys standing re: the (full) disclosure question?</b> (Pedro Luis Karrasquillo <peter_toyota@...mail.com>)
• Re: RDRAND used directly when default engines loaded in openssl-1.0.1-beta1 through openssl-1.0.1e (coderman <coderman@...il.com>)
• Re: RDRAND used directly when default engines loaded in openssl-1.0.1-beta1 through openssl-1.0.1e (coderman <coderman@...il.com>)
• Re: <b>Where are you guys standing re: the (full) disclosure question?</b> (Microsoft Security Response Center <secure@...rosoft.com>)

• Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line ("Larry W. Cashdollar" <larry0@...com>)
• Re: Where are you guys standing re: the (full) disclosure (Jordon Bedwell <envygeeks@...il.com>)
• Re: <b>Where are you guys standing re: the (full) disclosure question?</b> (Jasper Kips <jasper@...netkips.nl>)
• Re: Where are you guys standing re: the (full) disclosure (Pedro Luis Karrasquillo <peter_toyota@...mail.com>)
• iscripts autohoster , multiple vulns / php code injection exploit (0u7 5m4r7 <n0p1337@...il.com>)
• Iscripts multicart , multiple vulns (0u7 5m4r7 <n0p1337@...il.com>)
• Iscripts supportdesk 4.x , Multiple vulns / Sql injection exploit (0u7 5m4r7 <n0p1337@...il.com>)
• Buxalert PTC , multiple vulns / SQL injection Exploit (0u7 5m4r7 <n0p1337@...il.com>)
• Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• Solaris Recommended Patch Cluster 6/19 local root on x86 ("Larry W. Cashdollar" <larry0@...com>)

• Re: WordPress OptimizePress Theme - File Upload Vulnerability (Kurt Seifried <kseifried@...hat.com>)
• Traidnt up 3 , Admin info reset exploit (0u7 5m4r7 <n0p1337@...il.com>)
• Arabportal 2.x , Sql injection / Password reset exploit (0u7 5m4r7 <n0p1337@...il.com>)
• Kaspersky Internet Security - fake av. (vx Indy <indy.vx@...dex.by>)
• [SECURITY] [DSA 2818-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
• [SECURITY] [DSA 2819-1] End-of-life announcement for iceape (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Kaspersky Internet Security - fake av. (iPwn <pwnedomina@...il.com>)
• OpenText Exceed On Demand 8 multiple vulnerabilities (Krzysztof Kotowicz <kkotowicz+fd@...il.com>)
• Information Leakage and Backdoor vulnerabilities in WordPress ("MustLive" <mustlive@...security.com.ua>)
• Release: Faraday Penetration Test IDE (Francisco Amato <famato@...obytesec.com>)
• FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• BodyHacking Convention 2014 ("I)ruid" <druid@...ghq.org>)
• AST-2013-006: Buffer Overflow when receiving odd length 16 bit SMS message ("Asterisk Security Team" <security@...erisk.org>)
• AST-2013-007: Asterisk Manager User Dialplan Permission Escalation ("Asterisk Security Team" <security@...erisk.org>)
• QuickHeal AntiVirus 7.0.0.1 - Stack Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

• Re: RDRAND used directly when default engines loaded in openssl-1.0.1-beta1 through openssl-1.0.1e (coderman <coderman@...il.com>)
• [SECURITY] [DSA 2820-1] nspr security update (Raphael Geissert <geissert@...ian.org>)
• Re: [CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application (Fyodor <fyodor@...p.org>)
• CSRF, DoS and IL vulnerabilities in WordPress ("MustLive" <mustlive@...security.com.ua>)
• Re: [CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application (William Scott Lockwood III <scott@...pylog.c…)
• [ MDVSA-2013:288 ] subversion (security@...driva.com)
• [ MDVSA-2013:287-1 ] drupal (security@...driva.com)
• Re: [CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application (coderman <coderman@...il.com>)
• CORE-2013-0903 - RealPlayer Heap-based Buffer Overflow Vulnerability (CORE Advisories Team <advisories@...esecurity.com>)
• Fw: xss (VMw4r3 <vmw4r3@...oo.ie>)

• Capstone 1.0 disassembly framework release! (Nguyen Anh Quynh <aquynh@...il.com>)
• [ MDVSA-2013:289 ] owncloud (security@...driva.com)
• [ MDVSA-2013:291 ] kernel (security@...driva.com)
• [ MDVSA-2013:291 ] kernel (security@...driva.com)
• [ MDVSA-2013:290 ] mediawiki (security@...driva.com)
• phrack.org being spammed (Yvan Janssens <ik@...nj.me>)
• InfoSec Southwest 2014 CFP now open! (ISSW CFP <cfp@...osecsouthwest.com>)
• [CVE-2013-5573] Jenkins v1.523 Default markup formatter permits offsite-bound forms (Christian Catalano <ch.catalano@...il.com>)
• Re: [CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application (Daniel Wood <daniel.wood@...sp.org>)
• [ MDVSA-2013:292 ] links (security@...driva.com)
• [ MDVSA-2013:293 ] gimp (security@...driva.com)
• [ MDVSA-2013:294 ] gimp (security@...driva.com)
• [SECURITY] [DSA 2822-1] xorg-server security update (Moritz Muehlenhoff <jmm@...ian.org>)
• [SECURITY] [DSA 2823-1] pixman security update (Moritz Muehlenhoff <jmm@...ian.org>)

• [Security-news] SA-CONTRIB-2013-098 - Ubercart - Session Fixation Vulnerability (security-news@...pal.org)
• [SECURITY] [DSA 2821-1] gnupg security update (Thijs Kinkhorst <thijs@...ian.org>)
• XSS in HP Operations Orchestration Central version 9.06 (Bart Leppens <bart.leppens@...il.com>)
• Apache Santuario security advisory CVE-2013-4517 released (Colm O hEigeartaigh <coheigea@...che.org>)
• Re: [CVE-2013-6986] Insecure Data Storage in Subway Ordering ("Mikhail A. Utin" <mutin@...monwealthcare.org>)
• [ MDVSA-2013:295 ] gnupg (security@...driva.com)
• [SECURITY] [DSA 2824-1] curl security update (Salvatore Bonaccorso <carnil@...ian.org>)
• Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• URL Redirector Abuse and XSS vulnerabilities in WordPress ("MustLive" <mustlive@...security.com.ua>)

• Re: MS13-102: NtConnectPort() LPC (yuange <yuange1975@...mail.com>)
• [REVIVE-SA-2013-001] Revive Adserver 3.0.2 fixes SQL injection vulnerability (Matteo Beccati <php@...cati.com>)
• Synology DSM multiple directory traversal (Andrea Fabrizi <andrea.fabrizi@...il.com>)
• Re: RDRAND used directly when default engines loaded in openssl-1.0.1-beta1 through openssl-1.0.1e (coderman <coderman@...il.com>)
• [ MDVSA-2013:296 ] wireshark (security@...driva.com)
• [ MDVSA-2013:297 ] munin (security@...driva.com)
• [SECURITY] [DSA 2825-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
• [ MDVSA-2013:298 ] php (security@...driva.com)
• WinAppDbg 1.5 is out! (Mario Vilas <mvilas@...il.com>)

• Fwd: NS1 ssh bad attempts (Gary Baribault <gary@...ibault.net>)

• [ MDVSA-2013:299 ] samba (security@...driva.com)
• Practical malleability attack against CBC-Encrypted LUKS partitions (Jakob Lell <jakob@...oblell.com>)
• Re: Vulnerabilities hiddenly fixed in WordPress 3.5 and 3.5.1 ("MustLive" <mustlive@...security.com.ua>)

• NEW VMSA-2013-0016 VMware ESXi and ESX unauthorized file access through vCenter Server and ESX ("\"VMware Security Response Center\"" <security@...are.com>)
• [ MDVSA-2013:300 ] asterisk (security@...driva.com)
• [ MDVSA-2013:301 ] nss (security@...driva.com)
• Security by destruction (Jerome Athias <athiasjerome@...il.com>)
• Vulnerabilities in Dewplayer ("MustLive" <mustlive@...security.com.ua>)
• Merry Christmas and all the best in the new year (Georgi Guninski <guninski@...inski.com>)
• Re: Fwd: NS1 ssh bad attempts (silence_is_best@...hmail.com)
• CVSphoto.com Stores Passwords Unhashed (Alex Buie <alex.buie@...zenfeline.net>)
• [SECURITY] [DSA 2826-1] denyhosts security update (Yves-Alexis Perez <corsac@...ian.org>)

• [SECURITY] [DSA 2827-1] libcommons-fileupload-java security update (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: Vulnerabilities hiddenly fixed in WordPress 3.5 and 3.5.1 (Valdis.Kletnieks@...edu)
• Happy Holidays / Xmas Advisory (joernchen <joernchen@...noelit.de>)
• Re: Happy Holidays / Xmas Advisory (Henri Salo <henri@...v.fi>)

• Re: Happy Holidays / Xmas Advisory (PsychoBilly <zpamh0l3@...il.com>)
• [ MDVSA-2013:302 ] pixman (security@...driva.com)
• RBS Change v3.6.8 XSS Vulnerability ("metropolis haxor" <metrOpolis@...uxmail.org>)
• [Wooyun]Amazon elasticbeanstalk code execution ("Wooyun.org" <help.en@...yun.org>)
• [Wooyun] Safari for windows PhishingAlert bypass vuln ("Wooyun.org" <help.en@...yun.org>)
• [CVE-2013-7209]JForum CSRF(Cross-site request forgery) Vulnerability (arno <arno.chen@...ppsecurity.com.cn>)
• Re: Happy Holidays / Xmas Advisory (Brandon Perry <bperry.volatile@...il.com>)
• Re: Happy Holidays / Xmas Advisory (Gage Bystrom <themadichib0d@...il.com>)
• Vulnerabilities in plugins for WordPress, Joomla and Plone with Dewplayer ("MustLive" <mustlive@...security.com.ua>)

• SEC Consult SA-20131227-0 :: IBM Web Content Manager (WCM) XPath Injection (SEC Consult Vulnerability Lab <research@...-consult.com>)
• Re: Happy Holidays / Xmas Advisory (Henri Salo <henri@...v.fi>)

• [SECURITY] [DSA 2828-1] drupal6 security update (Salvatore Bonaccorso <carnil@...ian.org>)
• [SECURITY] [DSA 2829-1] hplip security update (Moritz Muehlenhoff <jmm@...ian.org>)
• CALL FOR PAPERS - Hackers 2 Hackers Conference 11th edition ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
• vm86 syscall kernel-panic and some more goodies waiting to be analyzed (halfdog <me@...fdog.net>)

• 30c3: The Year in Crypto default engines loaded in openssl-1.x through openssl-1.0.1e] (coderman <coderman@...il.com>)
• Re: Happy Holidays / Xmas Advisory (Matthew Gow <mattgow@...il.com>)
• Re: vm86 syscall kernel-panic and some more goodies waiting to be analyzed (halfdog <me@...fdog.net>)

• [SECURITY] [DSA 2830-1] ruby-i18n security update (Florian Weimer <fw@...eb.enyo.de>)

• Phact (iPwn <i@...ct.in>)
• Re: Open phones for privacy/anonymity applications, Guardian (l@...wijk.nl)
• DoS vulnerability in Adobe Flash Player (BSOD) ("MustLive" <mustliveua@...il.com>)
• CSRF, XSS and Redirector vulnerabilities in IBM Lotus Notes Traveler ("MustLive" <mustlive@...security.com.ua>)

224 messages

Powered by blists - more mailing lists