Mail Index

• Thread Index

• CanSecWest 2012 Mar 7-9; 2nd call for papers, closes next week, Monday.Dec 5 2011
  • From: Dragos Ruiu
• Insecure RSA Encryption in jCryption, PEAR Crypt_RSA and Crypt_RSA2
  • From: Daniel Roethlisberger
• Multiple vulnerabilities in OrangeHRM
  • From: advisory
• Sql injection in SugarCRM
  • From: advisory
• New issue of PenTest Magazine is out - 21 pages of free content.
  • From: maciej . kozuszek
• WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities
  • From: n0b0d13s
• Wordpress 1-jquery-photo-gallery-slideshow-flash plugin Cross-Site Scripting Vulnerabilities
  • From: Amir
• Wordpress flash-album-gallery plugin Cross-Site Scripting Vulnerabilities
  • From: Amir
• PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability
  • From: security
• [SECURITY] [DSA 2354-1] cups security update
  • From: Yves-Alexis Perez
• Re: Wordpress enable-latex plugin Remote File Include Vulnerabilities
  • From: Henri Salo
• [SECURITY] [DSA 2355-1] clearsilver security update
  • From: Moritz Muehlenhoff
• Re: Wordpress flash-album-gallery plugin Cross-Site Scripting Vulnerabilities
  • From: Henri Salo
• [security bulletin] HPSBPI02728 SSRT100692 rev.1 - Certain HP Printers and HP Digital Senders, Remote Firmware Update Enabled by Default
  • From: security-alert
• Re: Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability - SOS-11-003
  • From: Henri Salo
• Re: [MajorSecurity SA-081]Contao CMS 2.9.2 - Persistent Cross Site Scripting Issue
  • From: Henri Salo
• Re: Contao 2.10.1 Cross-site scripting vulnerability
  • From: Henri Salo
• Ariadne 2.7.6 Multiple XSS vulnerabilities
  • From: sschurtz
• Re: Serendipity freetag plugin 'serendipity[tagview]' Cross-Site Scripting vulnerability
  • From: Henri Salo
• Re: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability
  • From: Henri Salo
• [SECURITY] [DSA 2356-1] openjdk-6 security update
  • From: Florian Weimer
• [security bulletin] HPSBHF02723 SSRT100536 rev.1 - HP Protect Tools Device Access Manager for Windows, Remote Execution of Arbitrary Code, Denial of Service
  • From: security-alert
• FreeBSD ftpd/ProFTPD on FreeBSD Remote Root Exploit
  • From: HI-TECH .
• SANS AppSec 2012 CFP reminder
  • From: SANS AppSec CFP
• [PT-2011-43] Database information disclosure in Kayako Fusion
  • From: noreply
• Heap Memory Corruption in HP Device Access Manager for Protect Tools Information Store
  • From: advisory
• InfoSec Southwest 2012 CFP
  • From: I\)ruid
• XSSer v1.6 -beta- aka "Grey Swarm!" released.
  • From: psy
• [security bulletin] HPSBUX02729 SSRT100687 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS)
  • From: security-alert
• fast and somewhat reliable cache timing
  • From: Michal Zalewski
• Hackito Ergo Sum 2012 Call For Papers ! (12/13/14 April 2012)
  • From: Matthieu Suiche
• Vulnerabilities in Serv-U 11.1.0.3
  • From: Luigi Auriemma
• [DCA-2011-0014] - Elxis CMS Cross Site Script
  • From: Ewerson Guimarães (Crash) - Dclabs
• [SECURITY] [DSA 2358-1] openjdk-6 security update
  • From: Florian Weimer
• Re: Wordpress enable-latex plugin Remote File Include Vulnerabilities
  • From: Henri Salo
• Meditate Web Content Editor 'username_input' SQL-Injection vulnerability
  • From: sschurtz
• Wordpress pretty-link.1.5.2 plugin Cross-Site Scripting Vulnerabilities
  • From: irist . ir
• [security bulletin] HPSBMU02726 SSRT100685 rev.2 - HP Operations Agent and Performance Agent for AIX, HP-UX, Linux, and Solaris, Local Unauthorized Access
  • From: security-alert
• MITKRB5-SA-2011-007 KDC null pointer dereference in TGS handling [CVE-2011-1530]
  • From: Tom Yu
• [SECURITY] [DSA 2359-1] mojarra security update
  • From: Florian Weimer
• [SECURITY] [DSA 2360-1] Two month advance notification for upcoming end-of-life for Debian oldstable
  • From: Moritz Muehlenhoff
• [security bulletin] HPSBHF02723 SSRT100536 rev.2 - HP ProtectTools Device Access Manager for Windows, Remote Execution of Arbitrary Code, Denial of Service (DoS)
  • From: security-alert
• [ MDVSA-2011:181 ] proftpd
  • From: security
• DDIVRT-2011-38 KnowledgeTree login.php Blind SQL Injection
  • From: ddivulnalert
• [SECURITY] [DSA 2361-1] chasen security update
  • From: Florian Weimer
• ZDI-11-340 : Apple Quicktime Font Table Signed Length Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-341 : Cisco WebEx Player WRF Type 0 Parsing Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-342 : Novell ZENworks Asset Management Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-343 : RealNetworks RealPlayer mp4arender esds channel count Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-344 : RealNetworks RealPlayer RV20 Decoding Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-345 : TrendMicro Control Manager CmdProcessor.exe AddTask Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• seamless bait-and-switch
  • From: Michal Zalewski
• Re: Wordpress pretty-link.1.5.2 plugin Cross-Site Scripting Vulnerabilities
  • From: Henri Salo
• Re: Wordpress pretty-link.1.5.2 plugin Cross-Site Scripting Vulnerabilities
  • From: Henri Salo
• 0A29-11-2 : Privilege escalation vulnerability in HP Application Lifestyle Management (ALM) Platform v11
  • From: 0a29 40
• [DCA-2011-0015] QuesCom Qportal User - OctoWebSvr/COM - Source Code Disclosure
  • From: Ewerson Guimarães (Crash) - Dclabs
• [ MDVSA-2011:182 ] dhcp
  • From: security
• Re: seamless bait-and-switch
  • From: Michal Zalewski
• Call for Papers - 2012 Rocky Mountain Information Security Conference
  • From: president
• Re: seamless bait-and-switch
  • From: Michal Zalewski
• DC4420 - London DEFCON - 13 December 2011
  • From: Major Malfunction
• AST-2011-013: Possible remote enumeration of SIP endpoints with differing NAT settings
  • From: Asterisk Security Team
• AST-2011-014: Remote crash possibility with SIP and the “automon” feature enabled
  • From: Asterisk Security Team
• CA20111208-01: Security Notice for CA SiteMinder
  • From: Williams, James K
• [SignalSEC Labs]: HTC Touch2 T3333 Video Player Memory Corruption
  • From: signaladvisory
• *CLOSING IN 5 DAYS * Re: AppSec DC 2012 - Call for Trainers
  • From: AppSec DC
• the week of silly PoCs continues: data://www.mybank.com/
  • From: Michal Zalewski
• Re: seamless bait-and-switch
  • From: Jann Horn
• [SECURITY] [DSA 2362-1] acpid security update
  • From: Moritz Muehlenhoff
• Call for Papers -YSTS 6 - Security Conference, Brazil
  • From: Luiz Eduardo
• Introduction to R-sequence public key cryptography attack
  • From: Michal Bucko
• OSI Security: Squiz Matrix - User Account Enumeration
  • From: Troy Rose
• [ MDVSA-2011:183 ] pidgin
  • From: security
• WordPress flash-album-gallery Plugin 'flagshow.php' Cross Site Scripting Vulnerability
  • From: Amir
• Secunia Research: Winamp AVI Parsing Two Integer Overflow Vulnerabilities
  • From: Secunia Research
• zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal
  • From: security
• [ MDVSA-2011:184 ] krb5
  • From: security
• Re: seamless bait-and-switch
  • From: Charles Morris
• Re: [Full-disclosure] silly PoCs continue: X-Frame-Options give you less than expected
  • From: Michal Zalewski
• Re: the week of silly PoCs continues: data://www.mybank.com/
  • From: nothanks
• [ MDVSA-2011:185 ] libcap
  • From: security
• Secunia Research: Sterling Trader Data Processing Buffer Overflow Vulnerability
  • From: Secunia Research
• Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities
  • From: Amir
• [ MDVSA-2011:186 ] nfs-utils
  • From: security
• ESA-2011-036: RSA, The Security Division of EMC, announces the release of a Security Fix for RSA(r) Adaptive Authentication (On-Premise)
  • From: Security_Alert
• ZDI-11-346 : Microsoft Office 2007 Office Art Shape Record Hierarchy Parsing Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-347 : Microsoft Office Word Hidden Border Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-348 : HP OpenView NNM nnmRptConfig.exe nameParams Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• Re: WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities
  • From: brian
• Citrix Receiver, XenDesktop "Pass-the-hash" Attack
  • From: vtek63
• Multiple vulnerabilities in Browser CRM
  • From: advisory
• Re: Wordpress skysa-official plugin Cross-Site Scripting Vulnerabilities
  • From: support
• Re:Re: Introduction to R-sequence public key cryptography attack
  • From: Michal Bucko
• [MATTA-2011-003] Restorepoint Remote root command execution vulnerability - CVE-2011-4201 CVE-2011-4202
  • From: Tavaris Desamito
• Re: Re: WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities
  • From: n0b0d13s
• 0A29-11-3 : Cross-Site Scripting vulnerabilities in Nagios XI < 2011R1.9
  • From: 0a29 40
• 0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9
  • From: 0a29 40
• PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability
  • From: sschurtz
• ESA-2011-039: RSA(r), The Security Division of EMC, announces security fixes and improvements for RSASecurID(r) Software Token 4.1 for Microsoft(r)Windows(r)
  • From: Security_Alert
• HTML 5 Security Report
  • From: Ivan Buetler
• NGS00138 Patch Notification: Websense Triton 7.6 - Authentication bypass in report management UI
  • From: Research@NGSSecure
• [ MDVSA-2011:187 ] php-pear
  • From: security
• NGS00137 Patch Notification: Websense Triton 7.6 - Reflected XSS in report management UI
  • From: Research@NGSSecure
• NGS00140 Patch Notification: Websense Triton 7.6 - Unauthenticated remote command execution as SYSTEM
  • From: Research@NGSSecure
• NGS00141 Patch Notification: Websense Triton 7.6 - Stored XSS in report management UI
  • From: Research@NGSSecure
• [RT-SA-2011-005] Owl Intranet Engine: Authentication Bypass
  • From: RedTeam Pentesting GmbH
• [RT-SA-2011-006] Owl Intranet Engine: Information Disclosure and Unsalted Password Hashes
  • From: RedTeam Pentesting GmbH
• New IETF I-D on "Stable Privacy Addresses"
  • From: Fernando Gont
• New IETF I-Ds on Fragmentation-related security issues
  • From: Fernando Gont
• Seotoaster SQL-Injection Admin Login Bypass
  • From: security
• [ MDVSA-2011:188 ] libxml2
  • From: security
• <BASE> tag used for hijacking external resources (XSS)
  • From: Bouke van Laethem
• [security bulletin] HPSBUX02719 SSRT100658 rev.3 - HP-UX Running BIND, Remote Denial of Service (DoS)
  • From: security-alert
• [security bulletin] HPSBUX02729 SSRT100687 rev.2 - HP-UX Running BIND, Remote Denial of Service (DoS)
  • From: security-alert
• [ MDVSA-2011:189 ] jasper
  • From: security
• Re: <BASE> tag used for hijacking external resources (XSS)
  • From: Jann Horn
• silly PoCs continue: X-Frame-Options give you less than expected
  • From: Michal Zalewski
• VUPEN Security Research - Microsoft Windows Time Behaviour Remote Use-after-free Vulnerability (MS11-090)
  • From: VUPEN Security Research
• VUPEN Security Research - Microsoft Windows Media Player DVR-MS Buffer Overflow Vulnerability (MS11-092)
  • From: VUPEN Security Research
• VUPEN Security Research - Adobe Flash Player "SAlign" Memory Corruption Vulnerability (CVE-2011-2459)
  • From: VUPEN Security Research
• VUPEN Security Research - Microsoft Windows "datime.dll" Remote Code Execution Vulnerability (MS11-090)
  • From: VUPEN Security Research
• [SECURITY] [DSA 2363-1] tor security update
  • From: Moritz Muehlenhoff
• Re: <BASE> tag used for hijacking external resources (XSS)
  • From: Mario Vilas
• Re: <BASE> tag used for hijacking external resources (XSS)
  • From: Bouke van Laethem
• Re: <BASE> tag used for hijacking external resources (XSS)
  • From: Mario Vilas
• Re: <BASE> tag used for hijacking external resources (XSS)
  • From: Bouke van Laethem
• Re: <BASE> tag used for hijacking external resources (XSS)
  • From: Mario Vilas
• Re: RFI in JAF CMS
  • From: Henri Salo
• Re: WordPress flash-album-gallery Plugin 'flagshow.php' Cross Site Scripting Vulnerability
  • From: Henri Salo
• [SECURITY] [DSA 2364-1] xorg security update
  • From: Moritz Muehlenhoff
• [Suspected Spam] Content Papst CMS v2011.2 - Multiple Web Vulnerabilities
  • From: research@xxxxxxxxxxxxxxxxxxxxx
• appRain CMF v0.1.5 - Multiple Web Vulnerabilities
  • From: research@xxxxxxxxxxxxxxxxxxxxx
• [SECURITY] [DSA 2365-1] dtc security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2011:190 ] libarchive
  • From: security
• PHP Booking Calendar 10e XSS
  • From: tom
• IFIP NTMS'2012 - Deadline Extended to 12 January 2012
  • From: publicity
• [ MDVSA-2011:191 ] libarchive
  • From: security
• SEC Consult SA-20111219-0 :: Client-side remote arbitrary file upload in SecCommerce SecSigner Java Applet
  • From: SEC Consult Vulnerability Lab
• SEC Consult SA-20111219-1 :: Multiple vulnerabilities in WhatsApp
  • From: SEC Consult Vulnerability Lab
• SASHA v0.2.0 Mutiple XSS
  • From: tom
• Novell Sentinel Log Manager <=1.2.0.1 Path Traversal
  • From: Andrea Fabrizi
• Syhunt: Time-Based Blind NoSQL Injection
  • From: Felipe M. Aragon
• [SECURITY] [DSA 2366-1] mediawiki security update
  • From: Jonathan Wiltshire
• Slides of our "Hacking IPv6 Networks" training at DEEPSEC 2011
  • From: Fernando Gont
• [SECURITY] [DSA 2367-1] asterisk security update
  • From: Moritz Muehlenhoff
• [security bulletin] HPSBUX02697 SSRT100591 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
  • From: security-alert
• Re: SASHA v0.2.0 Mutiple XSS
  • From: Henri Salo
• Multiple vulnerabilities in PHPShop CMS Free
  • From: advisory
• ZDI-11-350 : Enterasys NetSight nssyslogd PRI Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• Tiki Wiki CMS Groupware Stored Cross-Site-Scripting
  • From: security
• Re: ESA-2011-039: RSA(r), The Security Division of EMC, announces security fixes and improvements for RSASecurID(r) Software Token 4.1 for Microsoft(r)Windows(r)
  • From: security_alert
• TWSL2011-018: Authentication Bypass Vulnerability in IBM TS3100/TS3200 Web User Interface
  • From: Trustwave Advisories
• post-XSS landscape
  • From: Michal Zalewski
• [SECURITY] [DSA 2368-1] lighttpd security update
  • From: Nico Golde
• RE: RFI in JAF CMS
  • From: Frédéric BOURLA
• [SECURITY] [DSA 2381-] lighttpd security update
  • From: Nico Golde
• Multiple vulnerabilities in epesi BIM
  • From: advisory
• Multiple vulnerabilities in OBM
  • From: advisory
• [SECURITY] [DSA 2369-1] libsoup2.4 security update
  • From: Nico Golde
• [SECURITY] [DSA 2370-1] unbound security update
  • From: Florian Weimer
• Exploit for Asterisk Security Advisory AST-2011-013
  • From: Ben Williams
• [MATTA-2011-001] pfSense x509 Insecure Certificate Creation
  • From: Florent Daigniere
• ZDI-11-351 : WellinTech KingView HistoryServer.exe Opcode 3 Parsing Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-352 : HP Managed Printing Administration jobAcct Multiple Vulnerabilities
  • From: ZDI Disclosures
• ZDI-11-353 : HP Managed Printing Administration MPAUploader.dll Remote Code Execution Vulnerability
  • From: ZDI Disclosures
• ZDI-11-354 : HP Managed Printing Administration jobDelivery Multiple Vulnerabilities
  • From: ZDI Disclosures
• TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin
  • From: Trustwave Advisories
• Tiki Wiki CMS Groupware <= 8.2 (snarf_ajax.php) Remote PHP Code Injection
  • From: n0b0d13s
• Xmas 2011 Security Puzzle
  • From: Ivan Buetler
• FreeBSD Security Advisory FreeBSD-SA-11:06.bind
  • From: FreeBSD Security Advisories
• FreeBSD Security Advisory FreeBSD-SA-11:07.chroot
  • From: FreeBSD Security Advisories
• FreeBSD Security Advisory FreeBSD-SA-11:08.telnetd
  • From: FreeBSD Security Advisories
• FreeBSD Security Advisory FreeBSD-SA-11:09.pam_ssh
  • From: FreeBSD Security Advisories
• Merry Christmas from the FreeBSD Security Team
  • From: FreeBSD Security Officer
• FreeBSD Security Advisory FreeBSD-SA-11:10.pam
  • From: FreeBSD Security Advisories
• [ MDVSA-2011:192 ] mozilla
  • From: security
• [SECURITY] [DSA 2372-1] heimdal security update
  • From: Florian Weimer
• Lighttpd Proof of Concept code for CVE-2011-4362
  • From: pi3
• [SECURITY] [DSA 2373-1] inetutils security update
  • From: Florian Weimer
• [SECURITY] [DSA 2375-1] krb5. krb5-appl security update
  • From: Florian Weimer
• [ MDVSA-2011:194 ] icu
  • From: security
• [SECURITY] [DSA 2374-1] openswan security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2011:193 ] squid
  • From: security
• MITKRB5-SA-2011-008 buffer overflow in telnetd [CVE-2011-4862]
  • From: Tom Yu
• [security bulletin] HPSBPI02732 SSRT100435 rev.1 - HP Managed Printing Administration, Remote Execution of Arbitrary Code and Other Vulnerabilities
  • From: security-alert
• [security bulletin] HPSBPI02728 SSRT100692 rev.2 - Certain HP Printers and HP Digital Senders, Remote Firmware Update Enabled by Default
  • From: security-alert
• [security bulletin] HPSBMU02731 SSRT100518 rev.1 - HP Database Archiving Software, Remote Execution of Arbitrary Code
  • From: security-alert
• [ MDVSA-2011:195 ] krb5-appl
  • From: security
• [ MDVSA-2011:196 ] ipmitool
  • From: security
• n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
  • From: security
• [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision
  • From: Andrea Barisani
• Winn Guestbook v2.4.8c Stored XSS
  • From: tom
• Security advisory for Bugzilla 4.2rc1, 4.0.3, 3.6.7 and 3.4.13
  • From: LpSolit
• Re: Wordpress flash-album-gallery plugin Cross-Site Scripting Vulnerabilities
  • From: Henri Salo
• [SECURITY] [DSA 2376-1] ipmitool security update
  • From: Thijs Kinkhorst
• [SECURITY] [DSA 2263-2] movabletype-opensource security update
  • From: Thijs Kinkhorst
• [ MDVSA-2011:197 ] php
  • From: security
• SEC Consult SA-20111230-0 :: Critical authentication bypass in Microsoft ASP.NET Forms - CVE-2011-3416
  • From: SEC Consult Vulnerability Lab