jetlib.sec » Bugtraq

Feeds

118787 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Bugtraq

• February 22, 2012
• 8:25

  [ MDVSA-2012:023 ] libxml2

   » ‎ Bugtraq

  Posted by security on Feb 22

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:023
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : libxml2
  Date : February 22, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:...
  

  Tags:   

• 8:14

  Multiple XSS in Chyrp

   » ‎ Bugtraq

  Posted by advisory on Feb 22

  Advisory ID: HTB23073
  Product: Chyrp
  Vendor: Chyrp
  Vulnerable Version(s): 2.5b1 and probably prior
  Tested Version: 2.5b1
  Vendor Notification: 1 February 2012
  Vendor Patch: 2 February 2012
  Public Disclosure: 22 February 2012
  Vulnerability Type: Cross Site Scripting (XSS)
  CVE Reference(s): CVE-2012-1001
  Solution Status: Fixed by Vendor
  Risk Level: Medium
  Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ )...
  

  Tags:   

• 8:02

  [ MDVSA-2012:022 ] libpng

   » ‎ Bugtraq

  Posted by security on Feb 22

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:022
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : libpng
  Date : February 22, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A...
  

  Tags:   

• 7:52

  Multiple security vulnerabilities in Tremulous 1.1.0, GPP1, and unofficial MG and TJW engines

   » ‎ Bugtraq

  Posted by Simon McVittie on Feb 22

  Background
  ==========
  
  Tremulous is a team-based FPS game with RTS elements. Its engine and
  game logic are based on the GPL source release of the Quake III Arena
  engine and game logic by id Software.
  
  The de facto upstream developer of the Quake III engine is now another
  fork, ioquake3; in particular, ioquake3 fixes many security
  vulnerabilities present in the original Quake III Arena source release.
  Unlike (for instance) OpenArena or Urban...
  

  Tags:   

• 7:40

  [SECURITY] [DSA 2415-1] libmodplug security update

   » ‎ Bugtraq

  Posted by Nico Golde on Feb 22

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2415-1 security () debian org
  http://www.debian.org/security/ Nico Golde
  February 21, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : libmodplug
  Vulnerability : several
  Problem type : local...
  

  Tags:   

• 7:30

  [SECURITY] [DSA 2414-1] fex security update

   » ‎ Bugtraq

  Posted by Nico Golde on Feb 22

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2413-1 security () debian org
  http://www.debian.org/security/ Nico Golde
  February 21, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : fex
  Vulnerability : insufficient input sanitization...
  

  Tags:   

• February 21, 2012
• 11:53

  Mercurycom MR804 Router - Multiple HTTP Header Fields Denial Of Service Vulnerability

   » ‎ Bugtraq

  Posted by demonalex on Feb 21

  Title: Mercurycom MR804 Router - Multiple HTTP Header Fields Denial Of Service Vulnerability
  
  Product : Mercurycom MR804 Router
  
  Hardware Version : MR804 v8.0 081C3113
  
  Software Version : 3.8.1 Build 101220 Rel.53006nB
  
  Vendor: http://www.mercurycom.com.cn/
  
  Class: Boundary Condition Error
  
  CVE:
  
  Remote: Yes
  
  Local: No
  
  Published: 2012-02-21
  
  Updated:
  
  Impact : Medium (CVSS2 Base : 6.1, AV:A/AC:L/Au:N/C:N/I:N/A:C)
  
  Bug Description :...
  

  Tags:   

• 11:45

  IPv6 NIDS evasion and IPv6 fragmentation/reassembly improvements

   » ‎ Bugtraq

  Posted by Fernando Gont on Feb 21

  Folks,
  
  FYI, just posted:
  <http://blog.si6networks.com/2012/02/ipv6-nids-evasion-and-improvements-in.html>
  
  It contains some test results regarding the implementation of RFC 5722
  and draft-ietf-6man-ipv6-atomic-fragments.
  
  Thanks,
  

  Tags:   

• 11:33

  Re: [oss-security] Dolphin 7.0.7

   » ‎ Bugtraq

  Posted by Kurt Seifried on Feb 21

  Please use CVE-2012-0873 for these XSS issues.
  

  Tags:   

• 11:21

  Re: [oss-security] OxWall 1.1.1

   » ‎ Bugtraq

  Posted by Kurt Seifried on Feb 21

  Please use CVE-2012-0872 for these XSS issues.
  

  Tags:   

• 11:09

  Re: Vulnerabilitites in Debian F*EX

   » ‎ Bugtraq

  Posted by muuratsalo experimental hack lab on Feb 21

  CVE-2012-0869 assigned for this issue.
  
  2012/2/20 muuratsalo experimental hack lab <muuratsalo () gmail com>:
  

  Tags:   

• 11:03

  F*EX 20111129-2 Cross Site Scripting Vulnerability

   » ‎ Bugtraq

  Posted by muuratsalo experimental hack lab on Feb 21

  ------------------------------------------------------------------------
  F*EX 20111129-2 Cross Site Scripting Vulnerability
  ------------------------------------------------------------------------
  
  title.............: F*EX 20111129-2 Cross Site Scripting Vulnerabilities
  author............: muuratsalo
  contact...........: muuratsalo[at]gmail[dot]com
  download..........: http://fex.rus.uni-stuttgart.de/fex.html
  tested on.........: Debian wheezy -...
  

  Tags:   

• 10:53

  F*EX

   » ‎ Bugtraq

  Posted by muuratsalo experimental hack lab on Feb 21

  ------------------------------------------------------------------------
  F*EX <= 20100208 Cross Site Scripting Vulnerabilities
  ------------------------------------------------------------------------
  
  title.............: F*EX <= 20100208 Cross Site Scripting Vulnerabilities
  author............: muuratsalo
  contact...........: muuratsalo[at]gmail[dot]com
  download..........: http://fex.rus.uni-stuttgart.de/fex.html
  tested on.........: Debian...
  

  Tags:   

• 10:43

  Vulnerabilitites in Debian F*EX

   » ‎ Bugtraq

  Posted by muuratsalo experimental hack lab on Feb 21

  Dear all,
  I have discovered some vulnerabilitites in Debian F*EX <= 20100208 and
  F*EX 20111129-2.
  
  F*EX (Frams's Fast File EXchange) is a service (GPL software) that can be
  used to allow users anywhere on the Internet to exchange files of ANY size
  quickly and conveniently. The sender uploads the file to the F*EX-server
  and the recipient automatically gets a notification e-mail with a
  download-URL. The sender must be a registered user in...
  

  Tags:   

• 7:13

  [SECURITY] [DSA 2413-1] libarchive security update

   » ‎ Bugtraq

  Posted by Luk Claes on Feb 21

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2413-1 security () debian org
  http://www.debian.org/security/ Luk Claes
  February 20, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : libarchive
  Vulnerability : buffer overflows
  Problem type...
  

  Tags:   

• February 20, 2012
• 12:46

  Dolphin 7.0.7

   » ‎ Bugtraq

  Posted by YGN Ethical Hacker Group on Feb 20

  1. OVERVIEW
  
  Dolphin 7.0.7 and lower versions are vulnerable to Cross Site Scripting.
  
  2. BACKGROUND
  
  Dolphin is the only "all-in-one" free community software platform for
  creating your own social networking, community or online dating site
  without any limits and under your full control. Dolphin comes with
  hundreds of features, module plugins and tools. Everything is included
  and extension posibilities are literally endless. You can use...
  

  Tags:   

• 12:37

  OxWall 1.1.1

   » ‎ Bugtraq

  Posted by YGN Ethical Hacker Group on Feb 20

  1. OVERVIEW
  
  OxWall 1.1.1 and lower versions are vulnerable to Cross Site Scripting.
  
  2. BACKGROUND
  
  Oxwall is a free open source software package for building social
  networks, family sites and collaboration systems. It is a flexible
  community website engine developed with the aim to provide people with
  a well-coded, user-friendly software platform for social needs. It is
  easy to set up, configure and manage Oxwall while you focus on your
  site...
  

  Tags:   

• 9:41

  DC4420 - London DEFCON - February meet - Tuesday February 21st 2012

   » ‎ Bugtraq

  Posted by Major Malfunction on Feb 20

  This month we have our usual two talk format - one that you'll need to
  concentrate on (and which will give us time to break into the bar), and
  one through which you can sip the beer you bought to accompany the one
  you bought for me...
  
  Shaun Colley of IOActive will make our heads hurt with
  "printf tricks & setjmp/longjmp bugs"
  
  followed by
  
  "E-mail Headers I Have Known And Loved" from @gwire (of NTK fame)...
  

  Tags:   

• 9:31

  SQL Injection Vulnerabilities in TestLink

   » ‎ Bugtraq

  Posted by jnatal on Feb 20

  ------------------
  Information
  ------------------
  Name: SQL Injection Vulnerabilities in TestLink
  Software tested: TL v1.8.5b & checked in v1.9.3 (prior version may be
  affected)
  Vendor Homepage: http://www.teamst.org
  Vendor Notification: 27 January 2012
  Vendor Patch: 4 February 2012
  Public Disclosure: 20 February 2012
  CVE: CVE-2012-0938 & CVE-2012-0939
  Solution Status: Fixed by Vendor
  
  ------------------
  Description
  ------------------...
  

  Tags:   

• 9:21

  SEC Consult SA-20120220-0 :: Multiple critical vulnerabilities in VOXTRONIC voxlog professional

   » ‎ Bugtraq

  Posted by SEC Consult Vulnerability Lab on Feb 20

  SEC Consult Vulnerability Lab Security Advisory < 20120220-0 >
  =======================================================================
  title: Multiple critical vulnerabilities
  product: VOXTRONIC voxlog professional - voice recording
  solution
  vulnerable version: VOXTRONIC voxlog professional <= 3.7.2.729
  (webclient version)
  fixed version: unknown...
  

  Tags:   

• 9:09

  SEC Consult SA-20120220-1 :: Multiple Vulnerabilities in ELBA5

   » ‎ Bugtraq

  Posted by SEC Consult Vulnerability Lab on Feb 20

  SEC Consult Vulnerability Lab Security Advisory < 20120220-1 >
  =======================================================================
  title: Multiple Vulnerabilities in ELBA5
  product: ELBA 5
  vulnerable version: ELBA 5.4.1
  5.5.0 R00004 build 0778
  fixed version: partially in 5.5.0 R00004 build 0778
  all issues in 5.5.0 R5
  impact: Medium...
  

  Tags:   

• 8:58

  [SECURITY] [DSA 2412-1] libvorbis security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Feb 20

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2412-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 19, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : libvorbis
  Vulnerability : buffer overflow
  Problem type :...
  

  Tags:   

• 8:49

  [SECURITY] [DSA 2411-1] mumble security update

   » ‎ Bugtraq

  Posted by Florian Weimer on Feb 20

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2411-1 security () debian org
  http://www.debian.org/security/ Florian Weimer
  February 19, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : mumble
  Vulnerability : information disclosure
  Problem type...
  

  Tags:   

• 8:37

  CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability [Updated]

   » ‎ Bugtraq

  Posted by YGN Ethical Hacker Group on Feb 20

  1. OVERVIEW
  
  The CubeCart 3.0.20 and lower versions are vulnerable to Open URL Redirection.
  
  2. BACKGROUND
  
  CubeCart is an "out of the box" ecommerce shopping cart software
  solution which has been written to run on servers that have PHP &
  MySQL support. With CubeCart you can quickly setup a powerful online
  store which can be used to sell digital or tangible products to new
  and existing customers all over the world.
  
  3. VULNERABILITY...
  

  Tags:   

• 8:30

  WebsiteBaker 2.8.2 SP2 HTTP-Referer XSS vulnerability

   » ‎ Bugtraq

  Posted by sschurtz on Feb 20

  Advisory: WebsiteBaker 2.8.2 SP2 HTTP-Referer XSS vulnerability
  Advisory ID: SSCHADV2012-003
  Author: Stefan Schurtz
  Affected Software: Successfully tested on WebsiteBaker 2.8.2 SP2
  Vendor URL: www.websitebaker2.org
  Vendor Status: fixed
  
  ==========================
  Vulnerability Description
  ==========================
  
  HTTP-Referer in WebsiteBaker 2.8.2 SP2 is prone to a XSS...
  

  Tags:   

• 8:18

  Downloads Folder: A Binary Planting Minefield

   » ‎ Bugtraq

  Posted by ACROS Security Lists on Feb 20

  This blog post reveals a bit of our research and provides an advance notification of
  a largely unknown remote exploit technique on Windows. More importantly, it provides
  instructions for protecting your computers from this technique while waiting for the
  affected software to correct its behavior.
  
  http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html
  
  or
  
  http://bit.ly/wmq00a
  
  Enjoy the reading!
  
  Mitja Kolsek, CEO / @mkolsek...
  

  Tags:   

• February 17, 2012
• 10:58

  [ MDVSA-2012:021 ] java-1.6.0-openjdk

   » ‎ Bugtraq

  Posted by security on Feb 17

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:021
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : java-1.6.0-openjdk
  Date : January 17, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem...
  

  Tags:   

• 9:24

  Puppet Dashboard insecure by default

   » ‎ Bugtraq

  Posted by Schweiss, Chip on Feb 17

  Apparently, leaving all security up to the end user is okay with Puppet Labs.
  
  I stumbled across some rather alarming search results when looking for
  an explanation to a message on my own dashboard:
  
  http://goo.gl/m99l6
  
  There are numerous Puppet Dashboard's exposed directly to the Internet
  and indexed by Google.  By default Dashboard runs on port 3000, so
  these are only sites that have reconfigured to run on port 80.  A
  machine search for...
  

  Tags:   

• 9:15

  PHP 5.2.x Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by Worawit Wang on Feb 17

  Release Date: 17 February 2012
  Affected Versions: 5.2.0 - 5.2.17 (unsupported version)
  
  ------------------------------------------------------------------------------------------
  
  Description:
  
  If PHP bails out in startup stage before setting PG(modules_activated)
  to 1, the filter_globals struct is not cleaned up on shutdown stage.
  The subsequence request will use uncleaned value in filter_globals
  struct. With special crafted request, this...
  

  Tags:   

• 9:07

  IETF I-D: Security and Interoperability Implications of Oversized IPv6 Header Chains

   » ‎ Bugtraq

  Posted by Fernando Gont on Feb 17

  Folks,
  
  FYI, we've published a new IETF I-D entitled "Security and
  Interoperability Implications of Oversized IPv6 Header Chains".
  
  The I-D is available at:
  <http://tools.ietf.org/id/draft-gont-6man-oversized-header-chain-00.txt>
  
  Any feedback will be very welcome.
  
  Thanks,
  

  Tags:   

• 8:55

  [security bulletin] HPSBPI02728 SSRT100692 rev.4 - Certain HP Printers and HP Digital Senders, Remote Firmware Update Enabled by Default

   » ‎ Bugtraq

  Posted by security-alert on Feb 17

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03102449
  Version: 4
  
  HPSBPI02728 SSRT100692 rev.4 - Certain HP Printers and HP Digital Senders, Remote Firmware Update Enabled by Default
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2011-11-30
  Last Updated: 2012-02-17
  
  Potential Security Impact: Remote firmware update enabled by default
  
  Source: Hewlett-Packard Company, HP...
  

  Tags:   

• 8:45

  Re: Fwd: 0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)

   » ‎ Bugtraq

  Posted by Rodrigo Rubira Branco \(BSDaemon\) on Feb 17

  Dear Kousuke,
  
  First of all, let me clarify that the disclosure process has been
  entirely coordinated by me, and thus, Wagner, Conviso and Check Point
  have no responsibilities over any mistake I eventually made.
  
  Anyway, just to clarify your points:
  
  I sent to the developer a complete advisory, including the exploit code.
  
  I never confused the vulnerabilities. And I never said the bug was
  patched... Maybe you should redirect this comment to...
  

  Tags:   

• 8:36

  0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)

   » ‎ Bugtraq

  Posted by Kousuke Ebihara on Feb 17

  I've reported the following XSS vulnerability in cforms II. This vulnerability has been fixed on February 14, 2012 by
  its developer.
  
  WordPress cformsII Plugin "rs" Cross-Site Scripting Vulnerability - Secunia.com
  http://secunia.com/advisories/47984/
  
  You might see this is a normal XSS vulnerability, but this isn't.
  
  Because EXPLOIT CODE IS PUBLISHED AS 0-DAY ON Oct 30, 2010 in this list!
  
  Are you puzzled?
  
  Actually, the...
  

  Tags:   

• 8:24

  [Spam] Skype v5.6.59.x - Memory Corruption Vulnerability

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 17

  Title:
  ======
  Skype v5.6.59.x - Memory Corruption Vulnerability
  
  Date:
  =====
  2012-02-17
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=315
  
  VL-ID:
  =====
  315
  
  Introduction:
  =============
  Skype is a software application that allows users to make voice and video calls and chats over the Internet. Calls to
  other users within the
  Skype service are free, while calls to both traditional landline telephones and mobile...
  

  Tags:   

• 8:15

  Pandora FMS v4.0.1 - Local File Include Vulnerability + VD Session

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 17

  Title:
  ======
  Pandora FMS v4.0.1 - Local File Include Vulnerability
  
  Date:
  =====
  2012-02-17
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=435
  
  VL-ID:
  =====
  435
  
  Introduction:
  =============
  Pandora FMS is a monitoring Open Source software. It watches your systems and applications, and allows you to
  know the status of any element of those systems. Pandora FMS could detect a network interface down, a defacement
  in...
  

  Tags:   

• February 16, 2012
• 8:41

  Hackito Ergo sum // HES2012 Final CFP // Call for Hackers

   » ‎ Bugtraq

  Posted by Jonathan Brossard on Feb 16

  °==============================================================°
  -= =-
  -= Hackito Ergo Sum 2012 - HES2012 Final CFP =-
  -= =-
  -= ** http://2012.hackitoergosum.org ** =-
  -= =-
  -=...
  

  Tags:   

• 8:30

  Re: sqlinjection bug in nova cms

   » ‎ Bugtraq

  Posted by Henri Salo on Feb 16

  As I did not receive any emails back from rezahmail@ on how author informed vendor I reported this as
  https://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461
  
  - Henri Salo
  

  Tags:   

• 7:54

  [PRE-SA-2012-01] Denial-of-service vulnerability in java.util.zip

   » ‎ Bugtraq

  Posted by Timo Warns on Feb 16

  PRE-CERT Security Advisory
  ==========================
  
  * Advisory: PRE-SA-2012-01
  * Released on: 16th February 2012
  * Affected products: Oracle Java SE 7 below Update 3
  Oracle Java SE 6 below Update 31
  IcedTea6 1.8.x below 1.8.13
  IcedTea6 1.9.x below 1.9.13
  IcedTea6 1.10.x below 1.10.6
  IcedTea6 1.11.x below 1.11.1
  IcedTea...
  

  Tags:   

• 7:42

  2012 Honeynet Project Security Workshop

   » ‎ Bugtraq

  Posted by Guillaume Arcas on Feb 16

  Hi.
  
  The Honeynet Project holds its second Public Event on March 19 - 20,
  2012 at Facebook HQ, SF Bay Area, Ca (USA).
  
  Public event consists on a one-day technical presentations and a one-day
  hands-on tutorial trainings.
  
  There even will be a CTF and a Forensic Challenge!
  
  All details available here:
  https://honeynet.org/SecurityWorkshops/2012_SF_Bay_Area
  
  If you have the opportunity to attend, let's join !
  
  Regards,
  
  Guillaume Arcas...
  

  Tags:   

• 7:27

  [SECURITY] [DSA 2410-1] libpng security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Feb 16

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2410-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 15, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : libpng
  Vulnerability : integer overflow
  Problem type :...
  

  Tags:   

• 7:17

  Cisco Security Advisory: Cisco NX-OS Malformed IP Packet Denial of Service Vulnerability

   » ‎ Bugtraq

  Posted by Cisco Systems Product Security Incident Response Team on Feb 16

  Cisco Security Advisory: Cisco NX-OS Malformed IP Packet Denial of
  Service Vulnerability
  
  Advisory ID: cisco-sa-20120215-nxos
  
  Revision 1.0
  
  For Public Release 2012 February 15 16:00 UTC (GMT)
  
  +--------------------------------------------------------------------
  
  Summary
  =======
  
  Cisco NX-OS Software is affected by a denial of service (DoS)
  vulnerability that could cause Cisco Nexus 1000v, 5000, and 7000 Series
  Switches that are running...
  

  Tags:   

• February 15, 2012
• 8:43

  TELUS Security Labs VR - Oracle Java Web Start Command Argument Injection Remote Code Execution

   » ‎ Bugtraq

  Posted by noreply on Feb 15

  Oracle Java Web Start Command Argument Injection Remote Code Execution
  
  TSL ID: TSL20120214-01
  
  1. Affected Software
  
  Oracle Java Development Kit (JDK) 6 Update 30 and prior
  Oracle Java Development Kit (JDK) 7 Update 2 and prior
  Oracle JavaFX 2.0.2 and prior
  Oracle Java Runtime Environment (JRE) 6 Update 30 and prior
  Oracle Java Runtime Environment (JRE) 7 Update 2 and prior
  
  Reference:...
  

  Tags:   

• 8:31

  [SECURITY] [DSA 2409-1] devscripts security update

   » ‎ Bugtraq

  Posted by Raphael Geissert on Feb 15

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2409-1 security () debian org
  http://www.debian.org/security/ Raphael Geissert
  February 15, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : devscripts
  Vulnerability : several
  Problem type : local...
  

  Tags:   

• 8:21

  Multiple vulnerabilities in LEPTON

   » ‎ Bugtraq

  Posted by advisory on Feb 15

  Advisory ID: HTB23072
  Product: LEPTON
  Vendor: LEPTON Project
  Vulnerable Version(s): 1.1.3 and probably prior
  Tested Version: 1.1.3
  Vendor Notification: 25 January 2012
  Vendor Patch: 4 February 2012
  Public Disclosure: 15 February 2012
  Vulnerability Type: Local File Inclusion, SQL Injection, Cross Site Scripting (XSS)
  Solution Status: Fixed by Vendor
  Risk Level: High
  Credit: High-Tech Bridge SA Security Research Lab (...
  

  Tags:   

• 8:08

  Multiple vulnerabilities in 11in1

   » ‎ Bugtraq

  Posted by advisory on Feb 15

  Advisory ID: HTB23071
  Product: 11in1
  Vendor: 11in1
  Vulnerable Version(s): 1.2.1 stable 12-31-2011 and probably prior
  Tested Version: 1.2.1 stable 12-31-2011
  Vendor Notification: 25 January 2012
  Public Disclosure: 15 February 2012
  Vulnerability Type: Local File Inclusion, Сross-Site Request Forgery (CSRF)
  Risk Level: High
  Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ )...
  

  Tags:   

• 7:59

  [ MDVSA-2012:020 ] phpldapadmin

   » ‎ Bugtraq

  Posted by security on Feb 15

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:020
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : phpldapadmin
  Date : February 15, 2012
  Affected: Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A...
  

  Tags:   

• 7:46

  FreePBX Remote Exploit

   » ‎ Bugtraq

  Posted by dougw on Feb 15

  FreePBX web interface remote vulnerability
  
  The admin username and password for the web interface is stored in plain
  text in this publicly accessible file:
  http://yourip/admin/modules/framework/bin/gen_amp_conf.php
  
  Which allows a hacker to access the web GUI and view the
  secrets(passwords) for each extension in plain test, as well as change the
  outbound routes.
  
  Further details on this exploit can be found here:...
  

  Tags:   

• 7:33

  [CAL-2011-0071]Adobe Shockwave Player Parsing cupt atom heap overflow

   » ‎ Bugtraq

  Posted by Code Audit Labs on Feb 15

  [CAL-2011-0071]Adobe Shockwave Player Parsing cupt atom heap overflow
  
  Discover: instruder of code audit labs of vulnhunt.com
  CAL: CAL-2011-0071
  CVE: CVE-2012-0758
  
  http://blog.vulnhunt.com/index.php/2012/02/15/cal-2011-0071_adobe-shockwave-player-parsing-cupt-atom-heap-overflow/
  
  adobe security bulletins
  http://www.adobe.com/support/security/bulletins/apsb12-02.html
  
  1 Affected Products
  =================
  adobe shockwave 11.6.3.633
  adobe...
  

  Tags:   

• 7:24

  [CAL-2011-0055]Adobe Shockwave Player Parsing block_cout memory corruption vulnerability

   » ‎ Bugtraq

  Posted by Code Audit Labs on Feb 15

  [CAL-2011-0055]Adobe Shockwave Player Parsing block_cout memory
  corruption vulnerability
  
  Discover: instruder of code audit labs of vulnhunt.com
  CAL: CAL-2011-0055
  CVE: CVE-2012-0759
  
  http://blog.vulnhunt.com/index.php/2012/02/15/cal-2011-0055_adobe-shockwave-player-parsing-block_cout-memory-corruption-vulnerability/
  
  adobe security bulletins
  http://www.adobe.com/support/security/bulletins/apsb12-02.html
  
  1 Affected Products
  =================...
  

  Tags:   

• February 14, 2012
• 6:58

  [ MDVSA-2012:019 ] apr

   » ‎ Bugtraq

  Posted by security on Feb 14

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:019
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : apr
  Date : February 14, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A...
  

  Tags:   

• February 13, 2012
• 11:34

  [SECURITY] [DSA 2408-1] php5 security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Feb 13

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2408-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 13, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : php5
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 9:39

  [Announcement] ClubHack Mag - Call for Articles

   » ‎ Bugtraq

  Posted by abhijeet on Feb 13

  Hello All,
  
  ClubHack Magazine is seeking submissions for next issue, Issue 26 - March 2012.
  
  Topics:-
  1. Web App Sec
  2. OS Exploitation and Security
  3. Cryptography and cryptanalysis
  
  Few guidelines :
  1) Keep the language as easy as possible. Screen shots will be of help.
  2) Along with article send us your photograph and small intro.
  3) Submissions due date - 27th of this month
  
  Send in your articles to abhijeet () clubhack com
  
  Regards,
  Abhijeet...
  

  Tags:   

• 9:28

  [ MDVSA-2012:018 ] mozilla-thunderbird

   » ‎ Bugtraq

  Posted by security on Feb 13

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:018
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : mozilla-thunderbird
  Date : February 13, 2012
  Affected: 2011.
  _______________________________________________________________________
  
  Problem Description:
  
  Use-after-free...
  

  Tags:   

• 9:16

  [ MDVSA-2012:017 ] firefox

   » ‎ Bugtraq

  Posted by security on Feb 13

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:017
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : firefox
  Date : February 12, 2012
  Affected: 2010.1, 2011.
  _______________________________________________________________________
  
  Problem Description:
  
  Use-after-free...
  

  Tags:   

• 9:03

  sqlinjection bug in nova cms

   » ‎ Bugtraq

  Posted by rezahmail on Feb 13

  # Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability
  # Date: 2/12/2012
  # Author: Dr.web
  # Software Link: http://sourceforge.net/projects/xraycms/files/latest/download
  # Version: 1.1.1
  # Tested on: Ubuntu
  XRay CMS is vulnerable to a SQL Injection attack which allows
  authentication bypass into the admins account. If a malicious
  user supplies ' or 1=1# into the applications user name field
  they will be logged into the applications admin...
  

  Tags:   

• 8:50

  [Suspected Spam] eFront Community++ v3.6.10 - SQL Injection Vulnerability

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 13

  Title:
  ======
  eFront Community++ v3.6.10 - SQL Injection Vulnerability
  
  Date:
  =====
  2012-02-11
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=422
  
  VL-ID:
  =====
  422
  
  Introduction:
  =============
  Tailored with larger organizations in mind, eFront Community ++ offers solutions for the management of companies most
  valued asset - the people. Based on a coherent approach to human capital management which keeps the...
  

  Tags:   

• 8:40

  Yahoo! Messenger v11.5 - Buffer Overflow Vulnerability

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 13

  Title:
  ======
  Yahoo! Messenger v11.5 - Buffer Overflow Vulnerability
  
  Date:
  =====
  2012-02-11
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=434
  
  VL-ID:
  =====
  434
  
  Introduction:
  =============
  Der Yahoo Messenger (eigene Schreibung Yahoo! Messenger, kurz auch Y!M, YIM oder Yim) ist ein verbreiteter
  Instant-Messaging-Client, sowie ein Protokoll von Yahoo. Der Yahoo Messenger ist kostenlos und kann mit
  einem gültigen...
  

  Tags:   

• 8:31

  OWASP AppSec USA 2011 Video & Slides Posted

   » ‎ Bugtraq

  Posted by adam on Feb 13

  Sorry I forgot to post this earlier. The OWASP AppSec USA 2011 video and slides are posted:
  
  http://www.appsecusa.org/schedule.html#slides_video
  

  Tags:   

• 8:19

  [slackware-security] php (SSA:2012-041-02)

   » ‎ Bugtraq

  Posted by Slackware Security Team on Feb 13

  [slackware-security] php (SSA:2012-041-02)
  
  New php packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1,
  13.37, and -current to fix security issues.
  
  Here are the details from the Slackware 13.37 ChangeLog:
  +--------------------------+
  patches/packages/php-5.3.10-i486-1_slack13.37.txz: Upgraded.
  Fixed arbitrary remote code execution vulnerability reported by Stefan
  Esser, CVE-2012-0830. (Stas, Dmitry)
  For more information,...
  

  Tags:   

• 8:08

  [slackware-security] httpd (SSA:2012-041-01)

   » ‎ Bugtraq

  Posted by Slackware Security Team on Feb 13

  [slackware-security] httpd (SSA:2012-041-01)
  
  New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1,
  13.37, and -current to fix security issues. The apr-util package has also been
  updated to the latest version.
  
  Here are the details from the Slackware 13.37 ChangeLog:
  +--------------------------+
  patches/packages/apr-util-1.4.1-i486-1_slack13.37.txz: Upgraded.
  Version bump for httpd upgrade....
  

  Tags:   

• 7:56

  [slackware-security] proftpd (SSA:2012-041-04)

   » ‎ Bugtraq

  Posted by Slackware Security Team on Feb 13

  [slackware-security] proftpd (SSA:2012-041-04)
  
  New proftpd packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0,
  13.1, 13.37, and -current to fix security issues.
  
  Here are the details from the Slackware 13.37 ChangeLog:
  +--------------------------+
  patches/packages/proftpd-1.3.4a-i486-1_slack13.37.txz: Upgraded.
  This update fixes a use-after-free() memory corruption error,
  and possibly other unspecified issues.
  For more...
  

  Tags:   

• 7:46

  [slackware-security] glibc (SSA:2012-041-03)

   » ‎ Bugtraq

  Posted by Slackware Security Team on Feb 13

  [slackware-security] glibc (SSA:2012-041-03)
  
  New glibc packages are available for Slackware 13.1, 13.37, and -current to
  fix a security issue.
  
  Here are the details from the Slackware 13.37 ChangeLog:
  +--------------------------+
  patches/packages/glibc-2.13-i486-5_slack13.37.txz: Rebuilt.
  Patched an overflow in tzfile. This was evidently first reported in
  2009, but is only now getting around to being patched. To exploit it,
  one must be...
  

  Tags:   

• 7:34

  [slackware-security] vsftpd (SSA:2012-041-05)

   » ‎ Bugtraq

  Posted by Slackware Security Team on Feb 13

  [slackware-security] vsftpd (SSA:2012-041-05)
  
  New vsftpd packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0,
  13.1, 13.37, and -current to work around a vulnerability in glibc.
  
  Here are the details from the Slackware 13.37 ChangeLog:
  +--------------------------+
  patches/packages/vsftpd-2.3.5-i486-1_slack13.37.txz: Upgraded.
  Minor version bump, this also works around a hard to trigger heap overflow
  in glibc (glibc zoneinfo...
  

  Tags:   

• February 10, 2012
• 12:09

  [ MDVSA-2012:016 ] glpi

   » ‎ Bugtraq

  Posted by security on Feb 10

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:016
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : glpi
  Date : February 10, 2012
  Affected: Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A File Inclusion...
  

  Tags:   

• 11:56

  CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability

   » ‎ Bugtraq

  Posted by YGN Ethical Hacker Group on Feb 10

  1. OVERVIEW
  
  The CubeCart 3.0.20 and lower versions are vulnerable to Open URL Redirection.
  
  2. BACKGROUND
  
  CubeCart is an "out of the box" ecommerce shopping cart software
  solution which has been written to run on servers that have PHP &
  MySQL support. With CubeCart you can quickly setup a powerful online
  store which can be used to sell digital or tangible products to new
  and existing customers all over the world.
  
  3. VULNERABILITY...
  

  Tags:   

• 11:35

  Kloxo LxCenter Server CP v6.1.10 - Multiple Web Vulnerabilities

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 10

  Title:
  ======
  Kloxo LxCenter Server CP v6.1.10 - Multiple Web Vulnerabilities
  
  Date:
  =====
  2012-02-10
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=429
  
  VL-ID:
  =====
  429
  
  Introduction:
  =============
  Scriptable, distributed and object oriented Hosting Platform. Manage
  Clients, Resellers,
  Domains, Backups, Stats, Mails and Databases. Manage everything!
  
  (Copy of the Vendor Homepage: http://www.lxcenter.org/)...
  

  Tags:   

• 11:20

  Dolibarr CMS v3.2.0 Alpha - SQL Injection Vulnerabilities

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 10

  Title:
  ======
  Dolibarr CMS v3.2.0 Alpha - SQL Injection Vulnerabilities
  
  Date:
  =====
  2012-02-09
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=427
  
  VL-ID:
  =====
  427
  
  Introduction:
  =============
  Dolibarr ERP & CRM is a modern software to manage your company or foundation activity (contacts, suppliers,
  invoices, orders, stocks, agenda, ...). It s an opensource free software designed for small and medium...
  

  Tags:   

• 11:11

  OnxShop CMS v1.5.0 - Multiple Web Vulnerabilities

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 10

  Title:
  ======
  OnxShop CMS v1.5.0 - Multiple Web Vulnerabilities
  
  Date:
  =====
  2012-02-08
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=426
  
  VL-ID:
  =====
  426
  
  Introduction:
  =============
  Onxshop is not only great CMS offering integrated in-context editing and full design freedom without the constraints
  of limiting templates, but it s also stable ecommerce platform used in production environment since 2006. Flexible...
  

  Tags:   

• 11:02

  Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 10

  Title:
  ======
  Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities
  
  Date:
  =====
  2012-02-07
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=428
  
  VL-ID:
  =====
  428
  
  Introduction:
  =============
  Dolibarr ERP & CRM is a modern software to manage your company or foundation activity (contacts, suppliers,
  invoices, orders, stocks, agenda, ...). It s an opensource free software designed for small and medium
  companies,...
  

  Tags:   

• February 09, 2012
• 10:31

  [Suspected Spam] eFront Community++ v3.6.10 - Multiple Web Vulnerabilities

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 09

  Title:
  ======
  eFront Community++ v3.6.10 - Multiple Web Vulnerabilities
  
  Date:
  =====
  2012-02-09
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=421
  
  VL-ID:
  =====
  421
  
  Introduction:
  =============
  Tailored with larger organizations in mind, eFront Community ++ offers solutions for the management of companies most
  valued asset - the people. Based on a coherent approach to human capital management which keeps the...
  

  Tags:   

• 10:22

  [SECURITY] CVE-2011-4367 Apache MyFaces information disclosure vulnerability

   » ‎ Bugtraq

  Posted by Leonardo Uribe on Feb 09

  --------------------------------------------------------------------------------------------------
  
  CVE-2011-4367: Apache MyFaces information disclosure vulnerability
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  MyFaces Core 2.0.1 to 2.0.11
  MyFaces Core 2.1.0 to 2.1.5
  Earlier versions are not affected
  
  Description:
  
  MyFaces JavaServer Faces (JSF) allows relative paths in the...
  

  Tags:   

• 7:39

  [ MDVSA-2012:015 ] wireshark

   » ‎ Bugtraq

  Posted by security on Feb 09

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:015
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : wireshark
  Date : February 9, 2012
  Affected: 2011.
  _______________________________________________________________________
  
  Problem Description:
  
  Multiple file parser and NULL...
  

  Tags:   

• 7:27

  [SECURITY] [DSA 2407-1] cvs security update

   » ‎ Bugtraq

  Posted by Florian Weimer on Feb 09

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2407-1 security () debian org
  http://www.debian.org/security/ Florian Weimer
  February 09, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : cvs
  Vulnerability : heap overflow
  Problem type : remote...
  

  Tags:   

• February 08, 2012
• 11:56

  ZDI-12-031 : Novell iPrint Server attributes-natural-language Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-031 : Novell iPrint Server attributes-natural-language Remote
  Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-031
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-4194
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  Novell
  
  -- Affected Products:
  
  Novell iPrint
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine...
  

  Tags:   

• 11:46

  ZDI-12-030 : IBM Rational Rhapsody BBFlashBack.Recorder.1 TestCompatibilityRecordMode Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-030 : IBM Rational Rhapsody BBFlashBack.Recorder.1
  TestCompatibilityRecordMode Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-030
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-1388
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM Rational Rhapsody
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this...
  

  Tags:   

• 11:32

  ZDI-12-029 : IBM Rational Rhapsody BBFlashBack.Recorder.1 InsertMarker Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-029 : IBM Rational Rhapsody BBFlashBack.Recorder.1 InsertMarker
  Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-029
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-1391
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM Rational Rhapsody
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital...
  

  Tags:   

• 11:22

  ZDI-12-028 : IBM Rational Rhapsody BBFlashBack.FBRecorder.1 Control Multiple Remote Code Execution Vulnerabilities

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-028 : IBM Rational Rhapsody BBFlashBack.FBRecorder.1 Control
  Multiple Remote Code Execution Vulnerabilities
  http://www.zerodayinitiative.com/advisories/ZDI-12-028
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-1392
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM Rational Rhapsody
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by...
  

  Tags:   

• 11:12

  ZDI-12-027 : IBM SPSS VsVIEW6.ocx ActiveX Control SaveDoc Method Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-027 : IBM SPSS VsVIEW6.ocx ActiveX Control SaveDoc Method
  Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-027
  February 8, 2012
  
  -- CVE ID:
  CVE-2012-0189
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM SPSS
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine...
  

  Tags:   

• 11:03

  ZDI-12-026 : IBM SPSS ExportHTML.dll ActiveX Control Render Method Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-026 : IBM SPSS ExportHTML.dll ActiveX Control Render Method
  Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-026
  February 8, 2012
  
  -- CVE ID:
  CVE-2012-0190
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM SPSS
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine...
  

  Tags:   

• 10:53

  ZDI-12-025 : EMC Networker indexd.exe Opcode 0x01 Parsing Remote Code Execution

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-025 : EMC Networker indexd.exe Opcode 0x01 Parsing Remote Code
  Execution
  http://www.zerodayinitiative.com/advisories/ZDI-12-025
  February 8, 2012
  
  -- CVE ID:
  CVE-2012-0395
  
  -- CVSS:
  10, AV:N/AC:L/Au:N/C:C/I:C/A:C
  
  -- Affected Vendors:
  
  EMC
  
  -- Affected Products:
  
  EMC NetWorker
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine protection filter ID...
  

  Tags:   

• 10:41

  ZDI-12-024 : Total Defense Suite UNC Management Web Service uncsp_ViewReportsHomepage SQL Injection Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-024 : Total Defense Suite UNC Management Web Service
  uncsp_ViewReportsHomepage SQL Injection Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-024
  February 8, 2012
  
  -- CVE ID:
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  Total Defense
  
  -- Affected Products:
  
  Total Defense CA Total Defense
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this...
  

  Tags:   

• 10:30

  ZDI-12-023 : Total Defense Suite UNC Management Web Service Database Credentials Disclosure Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-023 : Total Defense Suite UNC Management Web Service Database
  Credentials Disclosure Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-023
  February 8, 2012
  
  -- CVE ID:
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  Total Defense
  
  -- Affected Products:
  
  Total Defense CA Total Defense
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by...
  

  Tags:   

• 10:21

  ZDI-12-022 : Total Defense Suite UNC Management Console ExportReport SQL Injection Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-022 : Total Defense Suite UNC Management Console ExportReport
  SQL Injection Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-022
  February 8, 2012
  
  -- CVE ID:
  
  -- CVSS:
  10, AV:N/AC:L/Au:N/C:C/I:C/A:C
  
  -- Affected Vendors:
  
  Total Defense
  
  -- Affected Products:
  
  Total Defense CA Total Defense
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital...
  

  Tags:   

• 10:11

  ZDI-12-021 : Adobe Reader BMP Resource Signedness Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-021 : Adobe Reader BMP Resource Signedness Remote Code
  Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-021
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-4373
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  Adobe
  
  -- Affected Products:
  
  Adobe Reader
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine protection filter...
  

  Tags:   

• 10:00

  [security bulletin] HPSBMU02742 SSRT100740 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Unauthorized Disclosure of Information

   » ‎ Bugtraq

  Posted by security-alert on Feb 08

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03164351
  Version: 1
  
  HPSBMU02742 SSRT100740 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Unauthorized
  Disclosure of Information
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-02-08
  Last Updated: 2012-02-08
  
  Potential Security Impact: Remote unauthorized disclosure of information
  
  Source:...
  

  Tags:   

• 8:26

  Multiple vulnerabilities in ZENphoto

   » ‎ Bugtraq

  Posted by advisory on Feb 08

  Advisory ID: HTB23070
  Product: ZENphoto
  Vendor: www.zenphoto.org
  Vulnerable Version: 1.4.2 and probably prior
  Tested Version: 1.4.2
  Vendor Notification: 18 January 2012
  Vendor Patch: 19 January 2012
  Public Disclosure: 8 February 2012
  Vulnerability Type: PHP Code Execution, SQL Injection, XSS
  Solution Status: Fixed by Vendor
  Risk Level: High
  Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ )...
  

  Tags:   

• 8:14

  Cyberoam Central Console v2.00.2 - File Include Vulnerability

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 08

  Title:
  ======
  Cyberoam Central Console v2.00.2 - File Include Vulnerability
  
  Date:
  =====
  2012-02-08
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=405
  
  VL-ID:
  =====
  405
  
  Introduction:
  =============
  Cyberoam Central Console (CCC) appliances offer the flexibility of hardware CCC appliances and virtual CCC
  appliances to provide centralized security management across distributed Cyberoam UTM appliances, enabling
  high...
  

  Tags:   

• 8:02

  [security bulletin] HPSBUX02741 SSRT100728 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass

   » ‎ Bugtraq

  Posted by security-alert on Feb 08

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03183543
  Version: 1
  
  HPSBUX02741 SSRT100728 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access
  Restriction Bypass
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-02-06
  Last Updated: 2012-02-06
  
  ------------------------------------------------------------------------------
  
  Potential...
  

  Tags:   

• 7:49

  Unauthenticated remote code execution on D-Link ShareCenter products

   » ‎ Bugtraq

  Posted by roberto . paleari on Feb 08

  Unauthenticated remote code execution on D-Link ShareCenter products
  ====================================================================
  
  [ADVISORY INFORMATION]
  Title: Unauthenticated remote code execution on D-Link ShareCenter products
  Release date: 08/02/2012
  Last update: 08/02/2012
  Credits: Roberto Paleari, Emaze Networks S.p.A (roberto.paleari () emaze net)
  
  [VULNERABILITY INFORMATION]
  Class: Authentication...
  

  Tags:   

• February 07, 2012
• 10:46

  eFronts Community++ v3.6.10 - Cross Site Vulnerability

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Feb 07

  Title:
  ======
  eFronts Community++ v3.6.10 - Cross Site Vulnerability
  
  Date:
  =====
  2012-02-07
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=423
  
  VL-ID:
  =====
  423
  
  Introduction:
  =============
  Tailored with larger organizations in mind, eFront Community ++ offers solutions for the management of companies most
  valued asset - the people. Based on a coherent approach to human capital management which keeps the workforce...
  

  Tags:   

• 9:25

  [security bulletin] HPSBMU02736 SSRT100699 rev.2 - HP Business Availability Center (BAC) and Business Service Management (BSM), Remote Unauthorized Access to Sensitive Information

   » ‎ Bugtraq

  Posted by security-alert on Feb 07

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03127140
  Version: 2
  
  HPSBMU02736 SSRT100699 rev.2 - HP Business Availability Center (BAC) and Business Service Management (BSM), Remote
  Unauthorized Access to Sensitive Information
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2011-12-18
  Last Updated: 2012-02-06
  
  Potential Security Impact: Remote unauthorized access to sensitive...
  

  Tags:   

• 8:21

  SQL Injection Vulnerability in Batavi 1.1.2

   » ‎ Bugtraq

  Posted by Netsparker Advisories on Feb 07

  Information
  --------------------
  Name :  SQL Injection Vulnerability in Batavi
  Software :  Batavi 1.1.2 and possibly below.
  Vendor Homepage :  http://www.batavi.org
  Vulnerability Type :  SQL Injection
  Severity :  Critical
  Researcher :  Onur Yılmaz
  Advisory Reference :  NS-12-003
  
  Description
  --------------------
  Batavi is an open source e-commerce platform.
  
  Details
  --------------------
  Batavi is affected by a SQL Injection vulnerability...
  

  Tags:   

• 8:05

  CVE-2012-0803: Apache CXF does not validate UsernameToken policies correctly

   » ‎ Bugtraq

  Posted by Colm O hEigeartaigh on Feb 07

  CVE-2012-0803: Apache CXF does not validate UsernameToken policies correctly
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected: Apache CXF 2.4.5 and 2.5.1
  
  Description: CXF does not validate a WS-Security UsernameToken received as part
  of the security header of a SOAP request against a WS-SP UsernameToken policy.
  
  A malicious client could send a request to the endpoint with no UsernameToken,
  and the UsernameToken...
  

  Tags:   

• 7:50

  DEF CON 20 Capture the Flag Announcement

   » ‎ Bugtraq

  Posted by The Dark Tangent on Feb 07

  The 20th anniversary of DEF CON is almost on us!
  
  To help make this year even more memorable I have been working with DDTEK
  and other CTF organizers to continue to grow the contest on a number of
  levels.
  
  Thinking of competing in the pre-qualifiers? Planning to seriously compete
  this year? This announcement is to get you up to speed on what we have been
  thinking.
  
  First - Grow the CTF.
  This year there will be more teams battling it out. 20 teams...
  

  Tags:   

• 7:39

  SimpleGroupware 0.742 Cross-Site-Scripting vulnerability

   » ‎ Bugtraq

  Posted by security on Feb 07

  Advisory: SimpleGroupware 0.742 Cross-Site-Scripting vulnerability
  Advisory ID: INFOSERVE-ADV2012-01
  Author: Stefan Schurtz
  Contact: security () infoserve de
  Affected Software: Successfully tested on SimpleGroupware 0.742
  Vendor URL: http://www.simple-groupware.de/
  Vendor Status: fixed (see Changelog)
  
  ==========================
  Vulnerability Description...
  

  Tags:   

• 6:53

  [SECURITY] [DSA 2403-2] php5 security update

   » ‎ Bugtraq

  Posted by Thijs Kinkhorst on Feb 07

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2403-2 security () debian org
  http://www.debian.org/security/ Thijs Kinkhorst
  February 06, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : php5
  Vulnerability : code injection
  Problem type :...
  

  Tags:   

• 6:41

  [ MDVSA-2012:014 ] glpi

   » ‎ Bugtraq

  Posted by security on Feb 07

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:014
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : glpi
  Date : February 6, 2012
  Affected: Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A vulnerability has...
  

  Tags:   

• February 06, 2012
• 7:44

  Mathopd - Directory Traversal Vulnerability

   » ‎ Bugtraq

  Posted by Mateusz Goik on Feb 06

  Hi,
  
  Mathopd - Security Alerts
  
  Directory Traversal Vulnerability
  
  Reported: 2 February 2012
  
  Older versions of the software have a vulnerability that could lead to
  directory traversal if the '*' construct for mass virtual hosting is used.
  
  Affected: all 1.4 versions, all 1.5 versions up to 1.5p7.
  
  Fixed in: Mathopd 1.5p7
  
  http://www.mathopd.org/security.html
  http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html
  

  Tags:   

• 7:31

  [SECURITY] [DSA 2405-1] apache2 security update

   » ‎ Bugtraq

  Posted by Stefan Fritsch on Feb 06

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2405-1 security () debian org
  http://www.debian.org/security/ Stefan Fritsch
  February 06, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : apache2
  Vulnerability : multiple issues
  Problem type :...
  

  Tags:   

• 7:21

  [SECURITY] [DSA 2404-1] xen-qemu-dm-4.0 security update

   » ‎ Bugtraq

  Posted by Florian Weimer on Feb 06

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2404-1 security () debian org
  http://www.debian.org/security/ Florian Weimer
  February 05, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : xen-qemu-dm-4.0
  Vulnerability : buffer overflow
  Problem...
  

  Tags:   

• 7:11

  [SECURITY] [DSA 2384-2] cacti regression

   » ‎ Bugtraq

  Posted by Luk Claes on Feb 06

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2384-2 security () debian org
  http://www.debian.org/security/
  February 04, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : cacti
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• February 03, 2012
• 14:07

  [ MDVSA-2012:013 ] mozilla

   » ‎ Bugtraq

  Posted by security on Feb 03

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:013
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : mozilla
  Date : February 3, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:...
  

  Tags:   

• 8:41

  ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability

   » ‎ Bugtraq

  Posted by Security_Alert on Feb 03

  ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability.
  
  EMC Identifier: ESA-2012-010
  EMC Identifier: SRCH-7949
  
  CVE Identifier: CVE-2012-0396
  
  Severity Rating: CVSS v2 Base Score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
  
  Affected products:
  EMC SW: EMC Documentum xPlore 1.0 (all patch versions)
  EMC SW: EMC Documentum xPlore 1.1 (all patch versions prior to 1.1 P07)
  EMC SW: EMC Documentum xPlore 1.2 (all patch versions)...
  

  Tags:   

• 8:26

  RFC 6528 on Defending against Sequence Number Attacks

   » ‎ Bugtraq

  Posted by Fernando Gont on Feb 03

  Folks,
  
  FYI. (the RFC is available at: <http://www.rfc-editor.org/rfc/rfc6528.txt>)
  
  A new Request for Comments is now available in online RFC libraries.
  
  RFC 6528
  
  Title: Defending against Sequence Number Attacks
  Author: F. Gont, S. Bellovin
  Status: Standards Track
  Stream: IETF
  Date: February 2012
  Pages: 12
  Characters: 26917
  Obsoletes:...
  

  Tags:   

• 8:16

  [SECURITY] [DSA 2403-1] php5 security update

   » ‎ Bugtraq

  Posted by Thijs Kinkhorst on Feb 03

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2403-1 security () debian org
  http://www.debian.org/security/ Thijs Kinkhorst
  February 02, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : php5
  Vulnerability : code injection
  Problem type :...
  

  Tags:   

• 8:06

  [SECURITY] [DSA 2402-1] iceape security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Feb 03

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2402-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 02, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : iceape
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 7:55

  [SECURITY] [DSA 2400-1] iceweasel security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Feb 03

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2400-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 02, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : iceweasel
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 7:44

  [SECURITY] [DSA 2401-1] tomcat6 security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Feb 03

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2401-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 02, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : tomcat6
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 6:59

  [security bulletin] HPSBGN02740 SSRT100741 rev.1 - HP Operations Manager, Operations Agent, Performance Agent, Service Health Reporter, Service Health Optimizer, Performance Manager, Remote Execution of Arbitrary Code

   » ‎ Bugtraq

  Posted by security-alert on Feb 03

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03179825
  Version: 1
  
  HPSBGN02740 SSRT100741 rev.1 - HP Operations Manager, Operations Agent, Performance Agent, Service Health Reporter,
  Service Health Optimizer, Performance Manager, Remote Execution of Arbitrary Code
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-02-02
  Last Updated: 2012-02-02
  
  Potential Security Impact:...
  

  Tags:   

• February 02, 2012
• 11:03

  GLSA (Gentoo Linux Security Advisory) publication changes

   » ‎ Bugtraq

  Posted by Alex Legler on Feb 02

  Like other Linux distribution vendors, Gentoo is currently CC'ing advisories
  to the full-disclosure and bugtraq mailing lists.
  Starting today, we will be *no longer* publishing our advisories to full-
  disclosure or bugtraq.
  We are following our colleagues at Ubuntu with this decision.
  
  Users who want to receive advisories via email in the future should subscribe
  to the gentoo-announce mailing list, as described here:...
  

  Tags:   

• 10:52

  [security bulletin] HPSBMU02739 SSRT100280 rev.1 - HP Data Protector Media Operations, Remote Execution of Arbitrary Code

   » ‎ Bugtraq

  Posted by security-alert on Feb 02

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03179046
  Version: 1
  
  HPSBMU02739 SSRT100280 rev.1 - HP Data Protector Media Operations, Remote Execution of Arbitrary Code
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-02-01
  Last Updated: 2012-02-01
  
  ------------------------------------------------------------------------------
  
  Potential Security Impact: Remote execution...
  

  Tags:   

• 10:38

  [CAL-2012-0004] opera array integer overflow

   » ‎ Bugtraq

  Posted by Code Audit Labs on Feb 02

  CAL-2012-0004 opera array integer overflow
  
  1 Affected Products
  =================
  11.60 and prior
  
  2 Vulnerability Details
  =====================
  
  Code Audit Labs http://www.vulnhunt.com has discovered a integer
  overflow vulnerability in array functions like
  Int32Array,Int16Array... .
  
  Opear vendor say "We have reproduced the problem, and determined that it
  does not have any security implications, since the crash is a caused by
  a memory...
  

  Tags:   

• 10:28

  Fwd: RA-Guard: Advice on the implementation (feedback requested)

   » ‎ Bugtraq

  Posted by Fernando Gont on Feb 02

  Folks,
  
  We have talked about this one quite a few times (including
  <http://blog.si6networks.com/2011/09/router-advertisement-guard-ra-guard.html>).
  -- still, most implementations remain broken.
  
  If you care to get this fixed, please provide feedback about this I-D on
  the IETF *v6ops* mailing-list <v6ops () ietf org>, and CC me if possible.
  
  Thanks!
  
  Best regards,
  Fernando
  
  -------- Original Message --------
  Subject: RA-Guard: Advice...
  

  Tags:   

• 10:17

  Call For Paper

   » ‎ Bugtraq

  Posted by asemailing on Feb 02

  CALL FOR PAPER
  
  2012 ASE/IEEE International Conference on Privacy, Security, Risk, and Trust
  Amsterdam, The Netherlands, September 3-6, 2012
  WebSite: http://www.asesite.org/conferences/PASSAT/2012/
  Workshop Proposal Submission Deadline: March 1, 2012
  Paper Submission Deadline: May 11, 2012
  
  ================================================================
  2012 ASE/IEEE International Conference on Cyber Security
  Washington D.C., USA, October 5-7,...
  

  Tags:   

• 10:06

  APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001

   » ‎ Bugtraq

  Posted by Apple Product Security on Feb 02

  APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001
  
  OS X Lion v10.7.3 and Security Update 2012-001 is now available and
  addresses the following:
  
  Address Book
  Available for: OS X Lion v10.7 to v10.7.2,
  OS X Lion Server v10.7 to v10.7.2
  Impact: An attacker in a privileged network position may intercept
  CardDAV data
  Description: Address Book supports Secure Sockets Layer (SSL) for
  accessing CardDAV. A downgrade issue caused...
  

  Tags:   

• 9:55

  [ MDVSA-2012:012 ] apache

   » ‎ Bugtraq

  Posted by security on Feb 02

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:012
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : apache
  Date : February 2, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:...
  

  Tags:   

• February 01, 2012
• 10:04

  XSS phpLDAPadmin: 1.2.0.5 (Debian package) and 1.2.2 (sourceforge)

   » ‎ Bugtraq

  Posted by andsarmiento on Feb 01

  Attach some PoC analysis related to a XSS vulnerability to phpldapadmin. I previously coordinate with the Cert-US in
  order they contact with Sourceforge and Debian, but receive they was unable to put in contact with them.
  
  The first discover was on January 10 for 1.1.6 version, where after noticed that the same vulnerability was discover
  previously. For that reason I tested later for version 1.2.2 (sourceforge) and 1.2.0.5 (Debian package)....
  

  Tags:   

• 9:54

  ESA-2012-009: EMC Documentum Content Server privilege elevation vulnerability

   » ‎ Bugtraq

  Posted by Security_Alert on Feb 01

  ESA-2012-009: EMC Documentum Content Server privilege elevation vulnerability.
  
  EMC Identifier: ESA-2012-009
  EMC Identifier: CS-16072
  EMC Identifier: CS-16073
  
  CVE Identifier: CVE-2011-4144
  
  Severity Rating: CVSS v2 Base Score: 6.8 (AV:L/AC:L/Au:S/C:C/I:C/A:C)
  
  Affected prodcuts:
  EMC Documentum Content Server 6.0
  EMC Documentum Content Server 6.5
  EMC Documentum Content Server 6.6
  
  Vulnerability Summary:
  EMC Documentum Content Server...
  

  Tags:   

• 9:43

  Multiple vulnerabilities in OpenEMR

   » ‎ Bugtraq

  Posted by advisory on Feb 01

  Advisory ID: HTB23069
  Product: OpenEMR
  Vendor: OEMR
  Vulnerable Version: 4.1.0 and probably prior
  Tested Version: 4.1.0
  Vendor Notification: 11 January 2012
  Vendor Patch: 29 January 2012
  Public Disclosure: 01 February 2012
  Vulnerability Type: Local File Inclusion, Arbitrary Command Execution
  Solution Status: Fixed by Vendor
  Risk Level: High
  Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ )...
  

  Tags:   

• 9:32

  Security advisory for Bugzilla 4.2rc2, 4.0.4, 3.6.8 and 3.4.14

   » ‎ Bugtraq

  Posted by LpSolit on Feb 01

  Summary
  =======
  
  Bugzilla is a Web-based bug-tracking system used by a large number of
  software projects. The following security issues have been discovered
  in Bugzilla:
  
  * When a user creates a new account, Bugzilla doesn't correctly
  reject email addresses containing non-ASCII characters, which
  could be used to impersonate another user account.
  
  * A CSRF vulnerability in the implementation of the JSON-RPC API
  could be used to make...
  

  Tags:   

• 9:21

  802.1X password exploit on many HTC Android devices

   » ‎ Bugtraq

  Posted by Bret Jordan on Feb 01

  February 1, 2012
  
  --------------------------------------------------------------------------------
  Subject
  --------------------------------------------------------------------------------
  802.1X password exploit on many HTC Android devices
  
  --------------------------------------------------------------------------------
  Abstract
  --------------------------------------------------------------------------------
  There is an issue in certain HTC...
  

  Tags:   

• 9:08

  [Announce] Apache HTTP Server 2.2.22 Released

   » ‎ Bugtraq

  Posted by William A. Rowe Jr. on Feb 01

  Apache HTTP Server 2.2.22 Released
  
  The Apache Software Foundation and the Apache HTTP Server Project are
  pleased to announce the release of version 2.2.22 of the Apache HTTP
  Server ("Apache"). This version of Apache is principally a security
  and bug fix release, including the following significant security fixes:
  
  * SECURITY: CVE-2011-3368 (cve.mitre.org)
  Reject requests where the request-URI...
  

  Tags:   

• January 31, 2012
• 8:59

  [SECURITY] [DSA 2399-2] php5 regression fix

   » ‎ Bugtraq

  Posted by Thijs Kinkhorst on Jan 31

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2399-2 security () debian org
  http://www.debian.org/security/ Thijs Kinkhorst
  January 31, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : php5
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 8:48

  [SECURITY] [DSA 2399-1] php5 security update

   » ‎ Bugtraq

  Posted by Thijs Kinkhorst on Jan 31

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2399-1 security () debian org
  http://www.debian.org/security/ Thijs Kinkhorst
  January 31, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : php5
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 8:37

  VMSA-2012-0001 VMware ESXi and ESX updates to third party library and ESX Service Console

   » ‎ Bugtraq

  Posted by VMware Security Team on Jan 31

  ----------------------------------------------------------------------
  VMware Security Advisory
  
  Advisory ID: VMSA-2012-0001
  Synopsis: VMware ESXi and ESX updates to third party library
  and ESX Service Console
  Issue date: 2012-01-30
  Updated on: 2012-01-30 (initial advisory)
  
  CVE numbers: --- COS Kernel ---
  CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,
  CVE-2011-1080, CVE-2011-1093,...
  

  Tags:   

• 8:26

  [security bulletin] HPSBUX02724 SSRT100650 rev.3 - HP-UX Running System Administration Manager (SAM), Local Increase in Privilege

   » ‎ Bugtraq

  Posted by security-alert on Jan 31

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03089106
  Version: 3
  
  HPSBUX02724 SSRT100650 rev.3 - HP-UX Running System Administration Manager (SAM), Local Increase in Privilege
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2011-11-16
  Last Updated: 2012-01-30
  
  -------------------------------------------------------------------------------
  
  Source: Hewlett-Packard Company, HP...
  

  Tags:   

• 8:13

  [security bulletin] HPSBUX02697 SSRT100591 rev.2 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities

   » ‎ Bugtraq

  Posted by security-alert on Jan 31

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c02945548
  Version: 2
  
  HPSBUX02697 SSRT100591 rev.2 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other
  Vulnerabilities
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2011-12-14
  Last Updated: 2012-01-30
  
  ------------------------------------------------------------------------------
  
  Potential...
  

  Tags:   

• 8:00

  [security bulletin] HPSBUX02737 SSRT100747 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS)

   » ‎ Bugtraq

  Posted by security-alert on Jan 31

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03169289
  Version: 1
  
  HPSBUX02737 SSRT100747 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS)
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-01-25
  Last Updated: 2012-01-26
  
  ------------------------------------------------------------------------------
  Potential Security Impact: Remote Denial of Service (DoS)...
  

  Tags:   

• 7:50

  [security bulletin] HPSBMU02738 SSRT100748 rev.1 - HP Network Automation Running on Linux, Solaris, and Windows, Remote Unauthorized Access

   » ‎ Bugtraq

  Posted by security-alert on Jan 31

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03171149Version: 1
  HPSBMU02738 SSRT100748 rev.1 - HP Network Automation Running on Linux, Solaris, and Windows, Remote Unauthorized Access
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-01-30Last Updated: 2012-01-30
  

  Tags:   

• 7:37

  [SECURITY] [DSA 2398-1] curl security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Jan 31

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2398-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  January 30, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : curl
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 7:28

  ZDI-12-019 : IBM SPSS mraboutb.dll ActiveX Control SetLicenseInfoEx Method Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 31

  ZDI-12-019 : IBM SPSS mraboutb.dll ActiveX Control SetLicenseInfoEx
  Method Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-019
  January 30, 2012
  
  -- CVE ID:
  CVE-2012-0188
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM SPSS
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine...
  

  Tags:   

• January 30, 2012
• 11:29

  Advisory: sudo 1.8 Format String Vulnerability

   » ‎ Bugtraq

  Posted by joernchen of Phenoelit on Jan 30

  Hi,
  
  FYI, see attached.
  
  cheers,
  
  joernchen
  

  Tags:   

• 11:18

  [ GLSA 201201-19 ] Adobe Reader: Multiple vulnerabilities

   » ‎ Bugtraq

  Posted by Alex Legler on Jan 30

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-19
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: Normal
  Title: Adobe Reader: Multiple vulnerabilities
  Date: January...
  

  Tags:   

• 11:07

  [ GLSA 201201-18 ] bip: Multiple vulnerabilities

   » ‎ Bugtraq

  Posted by Alex Legler on Jan 30

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-18
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: High
  Title: bip: Multiple vulnerabilities
  Date: January 30, 2012...
  

  Tags:   

• 10:55

  Multiple vulnerabilities in OSClass

   » ‎ Bugtraq

  Posted by Filippo Cavallarin on Jan 30

  Advisory ID: CSA-12003
  Title: Multiple vulnerabilities in OSClass
  Product: OSClass
  Version: 2.3.4 and probably prior
  Vendor: osclass.org
  Vulnerability type: SQL injection, XSS, Remote file inclusion
  Vendor notification: 2012-01-12
  Public disclosure: 2012-01-27
  
  OSClass version 2.3.4 and probably below suffers from multiple vulnerabilities:
  
  1) Remote file inclusion in osc_downloadFile(). This vuln allows an attacker...
  

  Tags:   

• 10:46

  Multiple vulnerabilities in postfixadmin

   » ‎ Bugtraq

  Posted by Filippo Cavallarin on Jan 30

  Advisory ID: CSA-12002
  Title: Multiple vulnerabilities in postfixadmin
  Product: postfixadmin
  Version: 2.3.4 and probably prior
  Vendor: www.postifixadmin.org
  Vulnerability type: SQL injection, XSS
  Vendor notification: 2012-01-10
  Public disclosure: 2012-01-26
  
  postfixadmin version 2.3.4 and probably below suffers from multiple vulnerabilities:
  
  1) SQL injection in pacrypt function: if postfixadmin is configured with...
  

  Tags:   

• 10:34

  Mibew messenger multiple XSS

   » ‎ Bugtraq

  Posted by Filippo Cavallarin on Jan 30

  Advisory ID: CSA-12001
  Title: Mibew messenger multiple XSS
  Product: mibew messenger
  Version: 1.6.4 and probably prior
  Vendor: mibew.org
  Vulnerability type: XSS
  Vendor notification: 2012-01-07
  Public disclosure: 2012-01-24
  
  Mibew messenger version 1.6.4 an probably below is vulnerable to multiple XSS (and persistent XSS).
  They are all an POSTs and can be exploited due to the lack of CSRF protection
  
  1) Input passed...
  

  Tags:   

• 10:21

  [ MDVSA-2012:011 ] openssl

   » ‎ Bugtraq

  Posted by security on Jan 30

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:011
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : openssl
  Date : January 29, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A...
  

  Tags:   

• 10:09

  [SECURITY] [DSA 2397-1] icu security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Jan 30

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2397-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  January 29, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : icu
  Vulnerability : buffer underflow
  Problem type :...
  

  Tags:   

• 9:59

  FAA US Academy (AFS) - Auth Bypass Vulnerability

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Jan 30

  Title:
  ======
  FAA US Academy (AFS) - Auth Bypass Vulnerability
  
  Date:
  =====
  2012-01-28
  
  References:
  ===========
  http://vulnerability-lab.com/get_content.php?id=171
  
  VL-ID:
  =====
  171
  
  Introduction:
  =============
  This is a FAA computer system. FAA computer systems are provided for the processing of Official U.S. Government
  information only.
  All data contained on FAA computer systems is owned by the FAA may be monitored, intercepted, recorded,...
  

  Tags:   

• 9:48

  eBank IT Online Banking - Multiple Web Vulnerabilities

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Jan 30

  Title:
  ======
  eBank IT Online Banking - Multiple Web Vulnerabilities
  
  Date:
  =====
  2012-01-26
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=313
  
  VL-ID:
  =====
  313
  
  Introduction:
  =============
  As a leading provider of innovative online banking software solutions, eBank-IT! provides
  an accessible venue for offering a full-valued online banking platform to your clients,
  using a cross-browser interface that`s secure and...
  

  Tags:   

• 9:38

  [ GLSA 201201-17 ] Chromium: Multiple vulnerabilities

   » ‎ Bugtraq

  Posted by Tim Sammut on Jan 30

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-17
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: Normal
  Title: Chromium: Multiple vulnerabilities
  Date: January 28,...
  

  Tags:   

• 9:27

  [ GLSA 201201-16 ] X.Org X Server/X Keyboard Configuration Database: Screen lock bypass

   » ‎ Bugtraq

  Posted by Alex Legler on Jan 30

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-16
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: Normal
  Title: X.Org X Server/X Keyboard Configuration Database: Screen...
  

  Tags:   

• 9:17

  [SECURITY] [DSA 2396-1] qemu-kvm security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Jan 30

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2396-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  January 27, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : qemu-kvm
  Vulnerability : buffer underflow
  Problem type :...
  

  Tags:   

• 9:04

  [SECURITY] [DSA 2395-1] wireshark security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on Jan 30

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2395-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  January 27, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : wireshark
  Vulnerability : buffer underflow
  Problem type...
  

  Tags:   

• January 27, 2012
• 10:21

  AdaCore Security Advisory SA-2012-L119-003 Hash collisions in AWS

   » ‎ Bugtraq

  Posted by Thomas Quinot on Jan 27

  AdaCore Security Advisory
  =========================
  
  SA-2012-L119-003 Hash collisions in AWS
  
  Problem: Impacted versions of AWS store key/value pairs from submitted
  form data in hash tables using a hash function that has
  predictable collisions. As a result, a single specially crafted
  HTTP request can cause the server to use hours of CPU time,
  thus causing a denial of service.
  
  Impact:...
  

  Tags:   

• 7:29

  [HITB-Announce] Reminder: HITB2012AMS Call For Papers Closing Soon

   » ‎ Bugtraq

  Posted by Hafez Kamal on Jan 27

  This is a gentle reminder that the Call for Papers for the third annual
  HITBSecConf in Europe closes on the 18th of February! Send in your
  submissions now!
  
  http://cfp.hackinthebox.org/
  
  ---
  
  This year, we're moving to a new, bigger and better venue -- the
  award winning Okura Hotel right in middle of Amsterdam with easy access
  via public transportation. #HITB2012AMS will be a quad-track conference
  featuring keynote speakers Andy Ellis (Chief...
  

  Tags:   

• 7:21

  [ GLSA 201201-15 ] ktsuss: Privilege escalation

   » ‎ Bugtraq

  Posted by Sean Amoss on Jan 27

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-15
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: High
  Title: ktsuss: Privilege escalation
  Date: January 27, 2012...
  

  Tags:   

• 6:59

  [SECURITY] [DSA 2394-1] libxml2 security update

   » ‎ Bugtraq

  Posted by Luciano Bello on Jan 27

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2394-1 security () debian org
  http://www.debian.org/security/ Luciano Bello
  January 27, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : libxml2
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• January 26, 2012
• 12:37

  ESA-2012-007: RSA, The Security Division of EMC, announces security fixes for RSA enVision

   » ‎ Bugtraq

  Posted by Security_Alert on Jan 26

  ESA-2012-007: RSA, The Security Division of EMC, announces security fixes for RSA enVision
  
  Advisories
  Updated January 25, 2012
  
  Summary:
  
  RSA, The Security Division of EMC, announces security fixes to address a security vulnerability and provide an
  enhancement in RSA enVision®.
  
  Affected Products:
  
  RSA enVision 4.x
  
  Description:
  
  CVE Identifier: CVE-2011-4143
  
  This release addresses an environmental variable disclosure vulnerability. The...
  

  Tags:   

• 12:22

  ESA-2012-005: EMC NetWorker buffer overflow vulnerability

   » ‎ Bugtraq

  Posted by Security_Alert on Jan 26

  ESA-2012-005: EMC NetWorker buffer overflow vulnerability.
  
  EMC Identifier: ESA-2012-005
  EMC Identifier: NW135173
  
  CVE Identifier: CVE-2012-0395
  
  Severity Rating: CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
  
  Affected products:
  EMC NetWorker Server 7.5.x
  EMC NetWorker Server 7.6.x
  
  Vulnerability Summary:
  EMC NetWorker Server 7.5.x and 7.6.x contain a buffer overflow vulnerability which may possibly be exploited to cause a
  denial...
  

  Tags:   

• 12:11

  Cisco Security Advisory: Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by Cisco Systems Product Security Incident Response Team on Jan 26

  Cisco Security Advisory: Cisco IronPort Appliances Telnet Remote Code
  Execution Vulnerability
  
  Advisory ID: cisco-sa-20120126-ironport
  
  Revision 1.0
  
  For Public Release 2012 January 26 17:00 UTC (GMT)
  
  +--------------------------------------------------------------------
  
  Summary
  =======
  
  Cisco IronPort Email Security Appliances (ESA) and Cisco IronPort
  Security Management Appliances (SMA) contain a vulnerability that may
  allow a remote,...
  

  Tags:   

• January 25, 2012
• 12:08

  ZDI-12-018 : Symantec PCAnywhere awhost32 Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 25

  ZDI-12-018 : Symantec PCAnywhere awhost32 Remote Code Execution
  Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-018
  January 25, 2012
  
  -- CVE ID:
  CVE-2011-3478
  
  -- CVSS:
  9.7, AV:N/AC:L/Au:N/C:C/I:C/A:P
  
  -- Affected Vendors:
  
  Symantec
  
  -- Affected Products:
  
  Symantec PCAnywhere
  
  -- Vulnerability Details:
  This vulnerability allows remote attackers to execute arbitrary code on
  vulnerable installations of Symantec PCAnywhere....
  

  Tags:   

• 9:26

  NX Web Companion Spoofing Arbitrary Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by otr on Jan 25

  # Vuln Title: NX Web Companion Spoofing Arbitrary Code Execution
  # Vulnerability
  # Date: 25.01.2012
  # Author: otr
  # Software Link: http://www.nomachine.com/documents/plugin/install.php
  # Version: <= 3.x
  # Tested on: Linux, Windows, Mac OS X x86, Mac OS X PPC, Solaris
  # CVE : None, yet
  
  Summary
  
  The No Machine NX Web Companion is a Java applet that allows to
  download and update the No Machine software from a server. The No
  Machine software...
  

  Tags:   

• 9:18

  [SECURITY] [DSA-2393-1] bip security update

   » ‎ Bugtraq

  Posted by dann frazier on Jan 25

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2393-1 security () debian org
  http://www.debian.org/security/ dann frazier
  January 25, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : bip
  Vulnerability : buffer overflow
  Problem type :...
  

  Tags:   

• 9:05

  D-Link DIR-601 TFTP Directory Traversal Vulnerability

   » ‎ Bugtraq

  Posted by robkraus on Jan 25

  Vulnerability title: D-Link DIR-601 TFTP Directory Traversal Vulnerability
  
  CVSS Risk Rating: 7.8 (High)
  
  Product: D-Link DIR-601 Wireless N 150 Home Router
  
  Application Vendor: D-Link
  
  Vendor URL: www.dlink.com
  
  Public disclosure date: 1/20/2012
  
  Discovered by: Rob Kraus and Solutionary Engineering Research Team (SERT)
  
  Solutionary ID: SERT-VDN-1013
  
  Solutionary public disclosure URL:...
  

  Tags:   

• 8:56

  CSRF (Cross-Site Request Forgery) in DClassifieds

   » ‎ Bugtraq

  Posted by advisory on Jan 25

  Advisory ID: HTB23067
  Reference: https://www.htbridge.ch/advisory/csrf_cross_site_request_forgery_in_dclassifieds.html
  Product: DClassifieds
  Vendor: www.dclassifieds.eu ( http://www.dclassifieds.eu/ )
  Vulnerable Version: 0.1 final and probably prior
  Tested Version: 0.1 final
  Vendor Notification: 04 January 2012
  Vulnerability Type: CSRF (Cross-Site Request Forgery)
  Risk Level: Low
  Credit: High-Tech Bridge SA Security Research Lab (...
  

  Tags:   

• 8:47

  Multiple vulnerabilities in OSclass

   » ‎ Bugtraq

  Posted by advisory on Jan 25

  Advisory ID: HTB23068
  Reference: https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html
  Product: OSclass
  Vendor: osclass.org ( http://osclass.org/ )
  Vulnerable Version: 2.3.3 and probably prior
  Tested Version: 2.3.3
  Vendor Notification: 04 January 2012
  Vendor Patch: 16 January 2012
  Vulnerability Type: SQL Injection, XSS (Cross Site Scripting)
  Status: Fixed by Vendor
  Risk Level: High
  Credit: High-Tech Bridge SA Security...
  

  Tags:   

• 8:36

  NGS00117 Patch Notification: Symantec PCAnywhere Local Privilege Escalation

   » ‎ Bugtraq

  Posted by Research () NGSSecure on Jan 25

  High Risk Vulnerability in Symantec PCAnywhere
  
  25 January 2012
  
  Edward Torkington of NGS Secure has discovered a high risk vulnerability in Symantec PCAnywhere
  
  Impact: Local Privilege Escalation
  
  Versions affected:
  
  Symantec pcAnywhere 12.5.x
  IT Management Suite 7.0 pcAnywhere Solution 12.5.x
  IT Management Suite 7.1 pcAnywhere Solution 12.6.x
  
  An updated version of the software has been released to address these vulnerabilities:...
  

  Tags:   

• 8:21

  NGS00118 Patch Notification: Symantec PCAnywhere Remote Code Execution as SYSTEM

   » ‎ Bugtraq

  Posted by Research () NGSSecure on Jan 25

  Critical Vulnerability in Symantec PCAnywhere
  
  25 January 2012
  
  Edward Torkington of NGS Secure has discovered a critical vulnerability in Symantec PCAnywhere
  
  Impact: Remote Code Execution (pre-auth) as SYSTEM
  
  Versions affected:
  Symantec pcAnywhere 12.5.x
  IT Management Suite 7.0 pcAnywhere Solution 12.5.x
  IT Management Suite 7.1 pcAnywhere Solution 12.6.x
  
  An updated version of the software has been released to address these vulnerabilities:...
  

  Tags:   

• 8:13

  [security bulletin] HPSBUX02729 SSRT100687 rev.3 - HP-UX Running BIND, Remote Denial of Service (DoS)

   » ‎ Bugtraq

  Posted by security-alert on Jan 25

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03105548
  Version: 3
  
  HPSBUX02729 SSRT100687 rev.3 - HP-UX Running BIND, Remote Denial of Service (DoS)
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2011-12-01
  Last Updated: 2012-01-20
  
  ------------------------------------------------------------------------------
  
  Potential Security Impact: Remote Denial of Service (DoS)...
  

  Tags:   

• 8:03

  [security bulletin] HPSBUX02719 SSRT100658 rev.4 - HP-UX Running BIND, Remote Denial of Service (DoS)

   » ‎ Bugtraq

  Posted by security-alert on Jan 25

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03070783
  Version: 4
  
  HPSBUX02719 SSRT100658 rev.4 - HP-UX Running BIND, Remote Denial of Service (DoS)
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2011-10-27
  Last Updated: 2012-01-20
  
  -------------------------------------------------------------------------------
  
  Potential Security Impact: Remote Denial of Service (DoS)...
  

  Tags:   

• 7:51

  [security bulletin] HPSBUX02734 SSRT100729 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Unauthorized Access

   » ‎ Bugtraq

  Posted by security-alert on Jan 25

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03141193
  Version: 1
  
  HPSBUX02734 SSRT100729 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Unauthorized Access
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-01-19
  Last Updated: 2012-01-19
  
  ------------------------------------------------------------------------------
  
  Potential Security Impact: Remote Denial...
  

  Tags:   

• 7:41

  [security bulletin] HPSBUX02730 SSRT100710 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities

   » ‎ Bugtraq

  Posted by security-alert on Jan 25

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03122753
  Version: 1
  
  HPSBUX02730 SSRT100710 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other
  Vulnerabilities
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-01-23
  Last Updated: 2012-01-23
  
  ------------------------------------------------------------------------------
  
  Potential...
  

  Tags:   

• 7:29

  TWSL2012-002: Multiple Vulnerabilities in WordPress

   » ‎ Bugtraq

  Posted by Trustwave Advisories on Jan 25

  Trustwave's SpiderLabs Security Advisory TWSL2012-002:
  Multiple Vulnerabilities in WordPress
  
  https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt
  
  Published: 1/24/12
  Version: 1.0
  
  Vendor: WordPress (http://wordpress.org/)
  Product: WordPress
  Version affected: 3.3.1 and prior
  
  Product description:
  WordPress is a free and open source blogging tool and publishing platform
  powered by PHP and MySQL.
  
  Credit: Jonathan Claudius of...
  

  Tags:   

• January 24, 2012
• 8:57

  Only 7 Days Left: SANS AppSec 2012 CFP

   » ‎ Bugtraq

  Posted by SANS AppSec CFP on Jan 24

  Hi everyone,
  
  This is the final CFP reminder for SANS AppSec 2012 being held in Las
  Vegas, Nevada on April 30 - May 1, 2012.
  
  The call for papers ends in seven days on February 1, 2012 so submit today!
  
  ============
  
  The theme for this conference is "Application Security at Scale".
  
  Billions of records in the cloud. Millions of smart mobile devices.
  Millions of developers writing new code. Hundreds of apps in your
  enterprise. Untold...
  

  Tags:   

• 8:46

  NGS00193 Patch Notification: Trend Micro DataArmor and DriveArmor - Restricted Environment breakout, Privilege Escalation and Full Disk Decryption

   » ‎ Bugtraq

  Posted by Research () NGSSecure on Jan 24

  Critical Vulnerability in DataArmor and DriveArmor
  
  24 January 2012
  
  Stuart Passe of NGS Secure has discovered a Critical vulnerability in DataArmor and DriveArmor.
  
  Impact: Restricted Environment breakout, Privilege Escalation and Full Disk Decryption
  
  Versions affected:
  DataArmor 3.0.10 or greater
  DriveArmor 3.0.0 or greater
  
  An updated version of the software has been released to address these vulnerabilities:...
  

  Tags:   

• 8:22

  [ GLSA 201201-14 ] MIT Kerberos 5 Applications: Multiple vulnerabilities

   » ‎ Bugtraq

  Posted by Sean Amoss on Jan 24

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-14
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: Normal
  Title: MIT Kerberos 5 Applications: Multiple vulnerabilities...
  

  Tags:   

• January 23, 2012
• 13:20

  [ GLSA 201201-13 ] MIT Kerberos 5: Multiple vulnerabilities

   » ‎ Bugtraq

  Posted by Sean Amoss on Jan 23

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-13
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: High
  Title: MIT Kerberos 5: Multiple vulnerabilities
  Date: January...
  

  Tags:   

• 13:10

  Wordpress Kish Guest Posting Plugin 1.0 (uploadify.php) Unrestricted File Upload Vulnerability

   » ‎ Bugtraq

  Posted by n0b0d13s on Jan 23

  --------------------------------------------------------------------------------
  Wordpress Kish Guest Posting Plugin 1.0 (uploadify.php) Unrestricted File Upload
  --------------------------------------------------------------------------------
  
  author............: Egidio Romano aka EgiX
  mail..............: n0b0d13s[at]gmail[dot]com
  software link.....: http://kishpress.com/guest-posting-plugin/...
  

  Tags:   

• 12:58

  [ GLSA 201201-12 ] Tor: Multiple vulnerabilities

   » ‎ Bugtraq

  Posted by Sean Amoss on Jan 23

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-12
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: Normal
  Title: Tor: Multiple vulnerabilities
  Date: January 23, 2012...
  

  Tags:   

• 12:50

  SQL injection in Bigware shop software

   » ‎ Bugtraq

  Posted by rwenzel on Jan 23

  The Bigware shop software prior to version 2.15 contains a SQL injection, resulting in full database compromise. The
  injection point is the POST parameter 'lastname' in the module main_bigware_43.php. A user must be created before
  exploitation.
  
  Proof of concept is at http://files.dw-itsecurity.de/43.zip
  
  Do it manually: Create a valid user at www.shopsite.com/main_bigware_10.php. Open www.shopsite.com/main_bigware_43.php
  and add the...
  

  Tags:   

• 12:39

  [SECURITY] [DSA 2392-1] openssl security update

   » ‎ Bugtraq

  Posted by Florian Weimer on Jan 23

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2392-1 security () debian org
  http://www.debian.org/security/ Florian Weimer
  January 23, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : openssl
  Vulnerability : out-of-bounds read
  Problem type...
  

  Tags:   

• 10:56

  [SECURITY] [DSA 2301-2] rails regression

   » ‎ Bugtraq

  Posted by Florian Weimer on Jan 23

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2392-1 security () debian org
  http://www.debian.org/security/
  January 23, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : rails
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 8:46

  DDIVRT-2011-39 SolarWinds Storage Manager Server SQL Injection Authentication Bypass

   » ‎ Bugtraq

  Posted by ddivulnalert on Jan 23

  Title
  -----
  DDIVRT-2011-39 SolarWinds Storage Manager Server SQL Injection
  Authentication Bypass
  
  Severity
  --------
  High
  
  Discovered By
  -------------
  Digital Defense, Inc. Vulnerability Research Team
  Credit: r () b13$
  
  Date Discovered
  ---------------
  December 7, 2011
  
  Vulnerability Description
  -------------------------
  The 'LoginServlet' page on port 9000 of the SolarWinds Storage Manager
  Server is vulnerable to a SQL injection within...
  

  Tags:   

• 8:36

  [Suspected Spam] Bart`s CMS - SQL Injection Vulnerability

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Jan 23

  Title:
  ======
  Bart`s CMS - SQL Injection Vulnerability
  
  Date:
  =====
  2012-01-23
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=390
  
  VL-ID:
  =====
  390
  
  Introduction:
  =============
  It is a website Content Management System that is build with Codecharge Studio. There will also be a
  commercial package, which contains all source code AND the Codecharge Studio project files.
  More information on Codecharge Studio can be...
  

  Tags:   

• 8:26

  Re: pwgen: non-uniform distribution of passwords

   » ‎ Bugtraq

  Posted by Solar Designer on Jan 23

  ...
  
  Here's some further analysis of the 1 billion sample used as a training
  set along with a separate 1 million sample used as a test set:
  
  Applying the 697 million unique passwords (from the 1 billion sample
  above) as a wordlist (6 GB file size) to crack another 1 million of
  pwgen'ed passwords cracks 418168 of them (41.8%). For a uniform
  distribution (which is not the case), this would correspond to total
  keyspace size of about 1.67...
  

  Tags:   

• 8:14

  AllWebMenus < 1.1.9 WordPress Menu Plugin Arbitrary file upload

   » ‎ Bugtraq

  Posted by pavel on Jan 23

  #Exploit Title: AllWebMenus WordPress Menu Plugin Arbitrary file upload
  #Version: < 1.1.9
  #Date: 2012-01-19
  #Author: 6Scan (http://6scan.com) security team
  #Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/
  #Official fix: This advisory is released after the vendor was contacted and fixed the issue promptly.
  #Description: Unauthorized users could upload arbitrary files to the vulnerable server, potentially...
  

  Tags:   

• 7:37

  [SECURITY] [DSA 2391-1] phpmyadmin security update

   » ‎ Bugtraq

  Posted by Thijs Kinkhorst on Jan 23

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2391-1 security () debian org
  http://www.debian.org/security/ Thijs Kinkhorst
  January 22, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : phpmyadmin
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 7:25

  ZDI-12-017 : Oracle Outside In OOXML Relationship Tag Parsing Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 23

  ZDI-12-017 : Oracle Outside In OOXML Relationship Tag Parsing Remote
  Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-017
  January 20, 2012
  
  -- CVE ID:
  
  -- CVSS:
  9.7, AV:N/AC:L/Au:N/C:C/I:C/A:P
  
  -- Affected Vendors:
  
  Oracle
  
  -- Affected Products:
  
  Oracle Outside In
  
  -- Vulnerability Details:
  This vulnerability allows remote attackers to execute arbitrary code on
  vulnerable installations of Oracle Outside In....
  

  Tags:   

• January 20, 2012
• 11:32

  [ GLSA 201201-04 ] Logsurfer: Arbitrary code execution

   » ‎ Bugtraq

  Posted by Sean Amoss on Jan 20

  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Gentoo Linux Security Advisory GLSA 201201-04
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  http://security.gentoo.org/
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  
  Severity: Normal
  Title: Logsurfer: Arbitrary code execution
  Date: January 20,...
  

  Tags:   

• 11:25

  [ MDVSA-2012:010 ] cacti

   » ‎ Bugtraq

  Posted by security on Jan 20

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:010
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : cacti
  Date : January 20, 2012
  Affected: Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  Multiple...
  

  Tags:   

• 9:33

  DC4420 - London DEFCON - 24 January 2012

   » ‎ Bugtraq

  Posted by Major Malfunction on Jan 20

  Calling all survivors of 2011!
  
  We're back! Hopefully, so are you...
  
  Not only are we back, but we are back in the same old place in London's
  lovely West End... The Phoenix.
  
  And this year, to kick off, we have:
  
  Duncan Alderson/webantix of upSploit hoping to start a lively
  discussion on the subject of full/responsible disclosure.
  
  We do not yet have a 'fun' talk, so if you've got something short and/or
  sweet then...
  

  Tags:   

• 9:23

  InfoSec Southwest 2012 Open Registration

   » ‎ Bugtraq

  Posted by I\)ruid on Jan 20

  Hello,
  
  I just wanted to drop everyone a quick note and let you all know that
  registration for InfoSec Southwest 2012 is now open. You can register
  for the conference using the links to our registration portal provided
  on the conference registration page:
  
  http://www.infosecsouthwest.com/registration.html
  
  If you intend to attend the conference, we ask that you please register
  as early as possible using our registration portal. As this is our...
  

  Tags:   

• 9:11

  [Suspected Spam] Barracuda Spam/Virus WAF 600 - Multiple Web Vulnerabilities

   » ‎ Bugtraq

  Posted by research () vulnerability-lab com on Jan 20

  Title:
  ======
  Barracuda Spam/Virus WAF 600 - Multiple Web Vulnerabilities
  
  Date:
  =====
  2012-01-19
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=28
  
  VL-ID:
  =====
  28
  
  Introduction:
  =============
  Barracuda Networks - Worldwide leader in email and Web security.
  The Barracuda Spam & Virus Firewall is an integrated hardware and software solution for complete protection of
  your email server. It provides a powerful,...
  

  Tags:   

• 9:01

  Webcalendar 1.2.4 'location' XSS

   » ‎ Bugtraq

  Posted by tom on Jan 20

  # Exploit Title: Webcalendar 1.2.4 'location' XSS
  # Date: 01/11/12
  # Author: G13
  # Software Link:
  https://sourceforge.net/projects/webcalendar/?source=directory
  # Version: 1.2.5
  # Category: webapps (php)
  #
  
  ##### Vulnerability #####
  
  There is no sanitation on the input of the location variable. This
  allows malicious scripts to be added. This is a stored XSS
  
  ##### Vendor Notification #####
  
  01/11/12 - Vendor Notified
  01/19/12 - No...
  

  Tags:   

• 8:50

  appRain CMF

   » ‎ Bugtraq

  Posted by n0b0d13s on Jan 20

  ---------------------------------------------------------------------------
  appRain CMF <= 0.1.5 (uploadify.php) Unrestricted File Upload Vulnerability
  ---------------------------------------------------------------------------
  
  author............: Egidio Romano aka EgiX
  mail..............: n0b0d13s[at]gmail[dot]com
  software link.....: http://www.apprain.com/
  
  [-] vulnerable code in /webroot/addons/uploadify/uploadify.php
  
  27. if...
  

  Tags:   

• 8:40

  Re: pwgen: non-uniform distribution of passwords

   » ‎ Bugtraq

  Posted by Solar Designer on Jan 20

  John the Ripper, indeed - generating a custom .chr file (which is based
  on trigraph frequencies) from a sample of 1 million of pwgen'ed
  passwords and then using this file to crack another (non-overlapping)
  sample of pwgen'ed passwords. My initial notification to oss-security
  and Bugtraq included these links, which describe this in more detail:
  
  http://www.openwall.com/lists/john-users/2010/11/17/7...
  

  Tags:   

• January 19, 2012
• 8:55

  Advisory 01/2012: Suhosin PHP Extension Transparent Cookie Encryption Stack Buffer Overflow

   » ‎ Bugtraq

  Posted by Stefan Esser on Jan 19

  SektionEins GmbH
  www.sektioneins.de
  
  -= Security Advisory =-
  
  Advisory: Suhosin PHP Extension Transparent Cookie Encryption Stack
  Buffer Overflow
  Release Date: 2012/01/19
  Last Modified: 2012/01/19
  Author: Stefan Esser [stefan.esser[at]sektioneins.de]
  
  Application: Suhosin Extension <= 0.9.32.1
  Severity: A possible stack buffer overflow in Suhosin...
  

  Tags:   

• 7:15

  Microsoft Anti-XSS Library Bypass (MS12-007)

   » ‎ Bugtraq

  Posted by adic on Jan 19

  Introduction
  -------------
  Microsoft Anti-XSS Library is used to protect applications from Cross-Site Scripting attacks, by providing methods for
  input sanitization.
  
  Vulnerability
  -------------
  Microsoft Anti-XSS Library 3.0 and 4.0 are vulnerable to an attack in which an attacker is able to create a specially
  formed CSS, that after passing through the GetSafeHTML or GetSafeHtmlFragment methods, contains an expression that
  triggers a...
  

  Tags:   

• 7:05

  [security bulletin] HPSBMU02736 SSRT100699 rev.1 - HP Business Availability Center (BAC) and Business Service Management (BSM), Remote Unauthorized Access to Sensitive Information

   » ‎ Bugtraq

  Posted by security-alert on Jan 19

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03127140
  Version: 1
  
  HPSBMU02736 SSRT100699 rev.1 - HP Business Availability Center (BAC) and Business Service Management (BSM), Remote
  Unauthorized Access to Sensitive Information
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2011-12-18
  Last Updated: 2012-01-18
  
  Potential Security Impact: Remote unauthorized access to sensitive...
  

  Tags:   

• January 18, 2012
• 13:58

  Xpra memory disclosure

   » ‎ Bugtraq

  Posted by Antoine Martin on Jan 18

  Xpra is screen for X11. This is the fork located at:
  http://xpra.org/
  
  Xpra versions 0.0.7.28 (r191) through to 0.0.7.34 (r443) return random
  chunks of memory to the clients by using the wrong size (multiplying by
  4) for the X11 cursor memory buffer. (from XFixesGetCursorImage)
  The byte order of the data returned is only slightly off (argb -> rgba)
  
  Clients can easily trigger this bug by using X11 applications with
  custom cursors, potentially...
  

  Tags:   

• 13:45

  Drupal CKEditor 3.0 - 3.6.2 - Persistent EventHandler XSS

   » ‎ Bugtraq

  Posted by InterN0T Advisories on Jan 18

  # Exploit Title: Drupal CKEditor 3.0 - 3.6.2 - Persistent EventHandler XSS
  # Google Dork: "inurl:"sites/all/modules/ckeditor" -drupalcode.org"
  # Google Results: Approximately 379.000 results
  # Date: 18th January 2012
  # Author: MaXe @InterN0T (Found in a private Hatforce.com Penetration
  Test)
  # Software Link: http://ckeditor.com/ & http://drupal.org/node/1332022
  # Version: 3.0 - Current 3.6.2 (Drupal module: 6.x-1.8)
  #...
  

  Tags:   

• 13:34

  Cisco Security Advisory: Cisco IP Video Phone E20 Default Root Account

   » ‎ Bugtraq

  Posted by Cisco Systems Product Security Incident Response Team on Jan 18

  Cisco IP Video Phone E20 Default Root Account
  
  Advisory ID: cisco-sa-20120118-te
  
  Revision 1.0
  
  For Public Release 2012 January 18 16:00 UTC (GMT)
  +---------------------------------------------------------------------
  
  Summary
  =======
  
  Cisco TelePresence Software version TE 4.1.0 contains a default
  account vulnerability that could allow an unauthenticated, remote
  attacker to take complete control of the affected device.
  
  The vulnerability is due...
  

  Tags:   

• 9:07

  Cisco Security Advisory: Cisco Digital Media Manager Privilege Escalation Vulnerability

   » ‎ Bugtraq

  Posted by Cisco Systems Product Security Incident Response Team on Jan 18

  Cisco Digital Media Manager Privilege Escalation Vulnerability
  
  Advisory ID: cisco-sa-20120118-dmm
  
  Revision 1.0
  
  For Public Release 2012 January 18 16:00 UTC (GMT)
  +---------------------------------------------------------------------
  
  Summary
  =======
  
  Cisco Digital Media Manager contains a vulnerability that may allow a
  remote, authenticated attacker to elevate privileges and obtain full
  access to the affected system.
  
  Cisco Show and Share is...
  

  Tags:   

• 8:55

  [ MDVSA-2012:009 ] perl

   » ‎ Bugtraq

  Posted by security on Jan 18

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:009
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : perl
  Date : January 18, 2012
  Affected: Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A vulnerability has...
  

  Tags:   

• 8:45

  [ MDVSA-2012:008 ] perl

   » ‎ Bugtraq

  Posted by security on Jan 18

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:008
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : perl
  Date : January 18, 2012
  Affected: 2010.1, 2011.
  _______________________________________________________________________
  
  Problem Description:
  
  Multiple vulnerabilities...
  

  Tags:   

• 8:33

  XSS in OneOrZero AIMS

   » ‎ Bugtraq

  Posted by advisory on Jan 18

  Advisory ID: HTB23066
  Reference: https://www.htbridge.ch/advisory/xss_in_oneorzero_aims.html
  Product: OneOrZero AIMS
  Vendor: www.oneorzero.com ( http://www.oneorzero.com/ )
  Vulnerable Version: 2.8.0 Trial build231211 and probably prior
  Tested Version: 2.8.0 Trial build231211
  Vendor Notification: 28 December 2011
  Vulnerability Type: XSS (Cross Site Scripting)
  Risk Level: Medium
  Credit: High-Tech Bridge SA Security Research Lab (...
  

  Tags:   

• 8:22

  Reflection Scan: an Off-Path Attack on TCP

   » ‎ Bugtraq

  Posted by Jan Wrobel on Jan 18

  Hi,
  
  This TCP session hijacking technique might be of interest to some of you.
  
  Abstract:
  The paper demonstrates how traffic load of a shared packet queue can
  be exploited as a side channel through which protected information
  leaks to an off-path attacker. The attacker sends to a victim a
  sequence of identical spoofed segments. The victim responds to each
  segment in the sequence (the sequence is reflected by the victim) if
  the segments satisfy a...
  

  Tags:   

• 8:12

  Re: pwgen: non-uniform distribution of passwords

   » ‎ Bugtraq

  Posted by Solar Designer on Jan 18

  ...
  
  It was just pointed out to me off-list that the man page for pwgen
  specifically mentions that this kind of passwords "should not be used in
  places where the password could be attacked via an off-line brute-force
  attack." I had missed that detail or at least I did not recall it.
  
  This kind of documentation certainly mitigates the problem to some extent.
  
  Yet I think this gives users the perception that only the keyspace is
  smaller,...
  

  Tags:   

• January 17, 2012
• 10:13

  ESA-2012-003: EMC SourceOne Web Search Sensitive Information Disclosure Vulnerability.

   » ‎ Bugtraq

  Posted by Security_Alert on Jan 17

  ESA-2012-003: EMC SourceOne Web Search Sensitive Information Disclosure Vulnerability.
  
  EMC Identifier: ESA-2012-003
  
  CVE Identifier: CVE-2011-4142
  
  Severity Rating: CVSS v2 Base Score: 6.8 (AV:L/AC:L/Au:S/C:C/I:C/A:C)
  
  Affected products:
  
  EMC SourceOne Email Management 6.5 (6.5.2.3668) (SP2 HF3) and earlier
  EMC SourceOne Email Management 6.6 (6.6.1.2108) (SP1 HF1) and earlier
  EMC SourceOne Email Management 6.7 (6.7.2.0017) (SP2) and...
  

  Tags:   

• 6:56

  pwgen: non-uniform distribution of passwords

   » ‎ Bugtraq

  Posted by Solar Designer on Jan 17

  Hi,
  
  I never heard back from Ted on the below. I am not complaining -
  I understand that Ted is super busy with great stuff like ext4 - yet I
  think it's time to bring this to oss-security (for distros) and to
  Bugtraq (for end-users). (Not really "to make this public" since the
  issue was already discussed in public on john-users.)
  
  Some highlights (excerpts from the longer message below):
  
  "Time running (D:HH:MM) - Keyspace...
  

  Tags:   

• 6:46

  [SECURITY] CVE-2012-0022 Apache Tomcat Denial of Service

   » ‎ Bugtraq

  Posted by Mark Thomas on Jan 17

  CVE-2012-0022 Apache Tomcat Denial of Service
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.22
  - Tomcat 6.0.0 to 6.0.33
  - Tomcat 5.5.0 to 5.5.34
  - Earlier, unsupported versions may also be affected
  
  Description:
  Analysis of the recent hash collision vulnerability identified unrelated
  inefficiencies with Apache Tomcat's handling of large numbers of
  parameters and parameter values. These...
  

  Tags:   

• 6:36

  [SECURITY] CVE-2011-3375 Apache Tomcat Information disclosure

   » ‎ Bugtraq

  Posted by Mark Thomas on Jan 17

  CVE-2011-3375 Apache Tomcat Information disclosure
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.21
  - Tomcat 6.0.30 to 6.0.33
  - Earlier versions are not affected
  
  Description:
  For performance reasons, information parsed from a request is often
  cached in two places: the internal request object and the internal
  processor object. These objects are not recycled at exactly the same time.
  When...
  

  Tags:   

• 6:26

  Re: p0f3 release candidate

   » ‎ Bugtraq

  Posted by Michal Zalewski on Jan 17

  So just for the record, version 3.00 is now officially out:
  http://lcamtuf.coredump.cx/p03/. Many thanks to countless people who
  submitted signatures and bug fixes, including:
  
  Phil Ames
  Jason DePriest
  Dalibor Dukic
  Mark Martinec
  Damien Miller
  Nibbler
  Bernhard Rabe
  Chris John Riley
  Sebastian Roschke
  Peter Valchev
  Jeff Weisberg
  
  I won't be spamming the list with any further updates on p0f, but this
  being a major rewrite...
  

  Tags:   

• January 16, 2012
• 13:37

  [ MDVSA-2012:007 ] openssl

   » ‎ Bugtraq

  Posted by security on Jan 16

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:007
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : openssl
  Date : January 16, 2012
  Affected: 2011.
  _______________________________________________________________________
  
  Problem Description:
  
  Multiple vulnerabilities has...
  

  Tags:   

• 13:28

  [ MDVSA-2012:006 ] openssl

   » ‎ Bugtraq

  Posted by security on Jan 16

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:006
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : openssl
  Date : January 16, 2012
  Affected: 2010.1, Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  Multiple...
  

  Tags:   

• 13:16

  [ MDVSA-2012:005 ] libxml2

   » ‎ Bugtraq

  Posted by security on Jan 16

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:005
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : libxml2
  Date : January 16, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  A...
  

  Tags:   

• 9:55

  Re: Multiple XSS in KnowledgeTree Community Edition

   » ‎ Bugtraq

  Posted by advisory on Jan 16

  15.01.2012 18:30, Henri Salo пишет:
  
  Hello,
  
  We have managed to contact the Vendor by sourceforge website:
  
  http://sourceforge.net/projects/knowledgetree/
  http://sourceforge.net/users/danielchalef
  
  Regards,
  
  High-Tech Bridge SA Security Research Lab
  

  Tags:   

• 9:43

  [Announcement] ClubHack Mag - Call for Articles

   » ‎ Bugtraq

  Posted by abhijeet on Jan 16

  Hello All,
  
  ClubHack Mag is seeking submissions for next issue, Issue 25 - Feb 2012.
  
  Topics:-
  1. Network Exploitation and Security
  2. OS Exploitation and Security
  3. Web App Sec
  
  Few guidelines :
  1) Keep the language as easy as possible. Screen shots will be of help.
  2) Along with article send us your photograph and small intro.
  3) Submissions due date - 27th of this month
  
  *You too can design and submit poster for the magazine!
  
  Send in your...
  

  Tags:   

• 9:32

  (CFP) LACSEC 2012: 7th Network Security Event for Latin America and the Caribbean

   » ‎ Bugtraq

  Posted by Fernando Gont on Jan 16

  ***********************************************************************
  CALL FOR PRESENTATIONS
  ***********************************************************************
  LACSEC 2012
  7th Network Security Event for Latin America and the Caribbean
  May 6-11, 2012, Quito, Ecuador
  http://lacnic.net/en/eventos/lacnicxvii/
  
  LACNIC (http://www.lacnic.net) is the...
  

  Tags:   

• 9:23

  Beehive Forum 101 Multiple XSS vulnerabilities

   » ‎ Bugtraq

  Posted by sschurtz on Jan 16

  Advisory: Beehive Forum 101 Multiple XSS vulnerabilities
  Advisory ID: SSCHADV2011-042
  Author: Stefan Schurtz
  Affected Software: Successfully tested on Beehive Forum 101
  Vendor URL: http://www.beehiveforum.co.uk/
  Vendor Status: informed
  
  ==========================
  Vulnerability Description
  ==========================
  
  Beehive Forum 101 is prone to multiple XSS vulnerabilities...
  

  Tags:   

• 9:13

  phpVideoPro Multiple XSS vulnerabilities

   » ‎ Bugtraq

  Posted by sschurtz on Jan 16

  Advisory: phpVideoPro Multiple XSS vulnerabilities
  Advisory ID: SSCHADV2011-041
  Author: Stefan Schurtz
  Affected Software: Successfully tested on phpVideoPro 0.9.7
  Vendor URL: http://sourceforge.net/projects/phpvideopro/
  Vendor Status: fix in the latest development code
  
  ==========================
  Vulnerability Description
  ==========================
  
  phpVideoPro 0.9.7 is prone to...
  

  Tags:   

• 9:04

  Family Connections 2.7.2 Multiple XSS

   » ‎ Bugtraq

  Posted by tom on Jan 16

  # Exploit Title: Family Connections 2.7.2 Multiple XSS
  # Date: 01/14/12
  # Author: G13
  # CVE: 2012-0699
  # Software Link: https://sourceforge.net/projects/fam-connections/
  # Version: 2.7.2
  # Category: webapps (php)
  # Google dork: "powered by Family Connections"
  
  ##### Vulnerability #####
  
  Family Connections 2.7.2 has multiple XSS vulnerabilities. These
  exsist in the prayers and news sections.
  
  For familynews.php the 'post'...
  

  Tags:   

• 8:53

  Re: Multiple XSS in KnowledgeTree Community Edition

   » ‎ Bugtraq

  Posted by Henri Salo on Jan 16

  Main page says: "KnowledgeTree Community Edition is unsupported, untested software and not designed for production use.
  KnowledgeTree Inc. does not warrant this software in any way." and atest version is 3.7, which is released December
  2009. Could you give me the URL where they responded to your contact and fixed this vulnerability?
  
  Even their https://issues.knowledgetree.com/ says "Your KnowledgeTree account has been...
  

  Tags:   

• 8:42

  First-hop security in IPv6

   » ‎ Bugtraq

  Posted by Fernando Gont on Jan 16

  Folks,
  
  FYI:
  <http://searchenterprisewan.techtarget.com/tip/First-hop-security-in-IPv6>
  
  "This article provides an introduction to the concept of first-hop
  security and discusses the challenge of trying to apply the techniques
  currently enforced in IPv4 networks to emerging IPv6 deployments."
  
  P.S.: The whole article is available online, and you can read it even
  without registering... just scroll the web page...
  
  Best regards,
  

  Tags:   

• 8:33

  [Announcement] ClubHack Mag Issue 24-Jan 2012 Released

   » ‎ Bugtraq

  Posted by abhijeet on Jan 16

  Hello,
  
  Happy new year to all. ClubHack Magazine's Issue-24, Jan 2012 is released.
  
  This issue covers following articles:-
  
  0x00 Tech Gyan - One Line Facebook
  0x01 Tool Gyan - SQLMAP – Automated Sql Injection Testing Tool
  0x02 Mom's Guide - Social Networking and its Application Security
  0x03 Legal Gyan - Powers of Government under the Information Technology Act, 2000
  0x04 Matriux Vibhag - Setting up and Getting started with Matriux...
  

  Tags:   

• 8:19

  [SECURITY] [DSA 2389-1] linux-2.6 security update

   » ‎ Bugtraq

  Posted by dann frazier on Jan 16

  ----------------------------------------------------------------------
  Debian Security Advisory DSA-2389-1 security () debian org
  http://www.debian.org/security/ Dann Frazier
  January 15, 2012 http://www.debian.org/security/faq
  ----------------------------------------------------------------------
  
  Package : linux-2.6
  Vulnerability : privilege escalation/denial of...
  

  Tags:   

• 8:08

  [SECURITY] [DSA 2390-1] openssl security update

   » ‎ Bugtraq

  Posted by Florian Weimer on Jan 16

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2390-1 security () debian org
  http://www.debian.org/security/ Florian Weimer
  January 15, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : openssl
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 7:59

  [SECURITY] [DSA 2388-1] t1lib security update

   » ‎ Bugtraq

  Posted by Yves-Alexis Perez on Jan 16

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2388-1 security () debian org
  http://www.debian.org/security/ Yves-Alexis Perez
  January 14, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : t1lib
  Vulnerability : several
  Problem type : local...
  

  Tags:   

• 7:49

  ATutor 2.0.3 Multiple XSS vulnerabilities

   » ‎ Bugtraq

  Posted by sschurtz on Jan 16

  Advisory: ATutor 2.0.3 Multiple XSS vulnerabilities
  Advisory ID: SSCHADV2012-002
  Author: Stefan Schurtz
  Affected Software: Successfully tested on ATutor 2.0.3
  Vendor URL: http://atutor.ca
  Vendor Status: informed
  
  ==========================
  Vulnerability Description
  ==========================
  
  ATutor 2.0.3 is prone to multiple XSS vulnerabilities
  
  ==================
  PoC-Exploit...
  

  Tags:   

• 7:39

  BoltWire 3.4.16 Multiple XSS vulnerabilities

   » ‎ Bugtraq

  Posted by sschurtz on Jan 16

  Advisory: BoltWire 3.4.16 Multiple XSS vulnerabilities
  Advisory ID: SSCHADV2012-001
  Author: Stefan Schurtz
  Affected Software: Successfully tested on BoltWire 3.4.16
  Vendor URL: http://www.boltwire.com/
  Vendor Status: informed
  
  ==========================
  Vulnerability Description
  ==========================
  
  BoltWire 3.4.16 is prone to multiple XSS vulnerabilities...
  

  Tags:   

• 7:28

  PHP 5.3.8 Multiple vulnerabilities

   » ‎ Bugtraq

  Posted by cxib on Jan 16

  [ PHP 5.3.8 Multiple vulnerabilities ]
  
  Author: Maksymilian Arciemowicz
  Website: http://cxsecurity.com/
  Date: 14.01.2012
  
  CVE:
  CVE-2011-4153 (zend_strndup)
  
  Original link:
  http://cxsecurity.com/research/103
  
  [--- 1. Multiple NULL Pointer Dereference with zend_strndup() [CVE-2011-4153] ---]
  As we can see in zend_strndup()
  
  -zend_alloca.c---
  ZEND_API char *zend_strndup(const char *s, uint length)
  {
  char *p;
  
  p = (char *)...
  

  Tags:   

• 6:46

  [security bulletin] HPSBST02735 SSRT100516 rev.1 - HP StorageWorks Modular Smart Array P2000 G3, Remote Execution of Arbitrary Code

   » ‎ Bugtraq

  Posted by security-alert on Jan 16

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03153338
  Version: 1
  
  HPSBST02735 SSRT100516 rev.1 - HP StorageWorks Modular Smart Array P2000 G3, Remote Execution of Arbitrary Code
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-01-13
  Last Updated: 2012-01-13
  
  Potential Security Impact: Remote execution of arbitrary code
  
  Source: Hewlett-Packard Company, HP Software...
  

  Tags:   

• January 13, 2012
• 9:55

  ME020567: MailEnable webmail cross-site scripting vulnerability CVE-2012-0389

   » ‎ Bugtraq

  Posted by Henri Salo on Jan 13

  ME020567: MailEnable webmail cross-site scripting vulnerability (CWE-79)
  References: CVE-2012-0389
  Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah
  Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567
  Vendor contact: 2012-01-04 09:49:36 UTC
  Vendor response: 2012-01-04 10:27:13 UTC (Peter Fregon from MailEnable)
  Vendor fix and announcement: 2012-01-10 00:50:31 UTC
  
  Vulnerability description:
  
  MailEnable...
  

  Tags:   

• January 12, 2012
• 13:37

  ZDI-12-016 : (0Day) HP Diagnostics Server magentservice.exe Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 12

  ZDI-12-016 : (0Day) HP Diagnostics Server magentservice.exe Remote
  Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-016
  January 12, 2012
  
  -- CVE ID:
  CVE-2011-4789
  
  -- CVSS:
  10, AV:N/AC:L/Au:N/C:C/I:C/A:C
  
  -- Affected Vendors:
  
  Hewlett-Packard
  
  -- Affected Products:
  
  Hewlett-Packard Diagnostics Server
  
  -- Vulnerability Details:
  This vulnerability allows remote attackers to execute arbitrary code on
  vulnerable...
  

  Tags:   

• 13:29

  ZDI-12-015 : (0Day) HP StorageWorks P2000 G3 Directory Traversal and Default Account Vulnerabilities

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 12

  ZDI-12-015 : (0Day) HP StorageWorks P2000 G3 Directory Traversal and
  Default Account Vulnerabilities
  http://www.zerodayinitiative.com/advisories/ZDI-12-015
  January 12, 2012
  
  -- CVE ID:
  CVE-2011-4788
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:C/I:P/A:P
  
  -- Affected Vendors:
  
  Hewlett-Packard
  
  -- Affected Products:
  
  Hewlett-Packard StorageWorks P2000 G3
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this...
  

  Tags:   

• 13:16

  ZDI-12-014 : HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 12

  ZDI-12-014 : HP Easy Printer Care XMLSimpleAccessor Class ActiveX
  Control Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-014
  January 12, 2012
  
  -- CVE ID:
  CVE-2011-4787
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  Hewlett-Packard
  
  -- Affected Products:
  
  Hewlett-Packard Easy Printer Care
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this...
  

  Tags:   

• 13:05

  ZDI-12-013 : HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution Vulnerability

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 12

  ZDI-12-013 : HP Easy Printer Care XMLCacheMgr Class ActiveX Control
  Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-013
  January 12, 2012
  
  -- CVE ID:
  CVE-2011-4786
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  Hewlett-Packard
  
  -- Affected Products:
  
  Hewlett-Packard Easy Printer Care
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this...
  

  Tags:   

• 12:54

  ZDI-12-012 : (0Day) McAfee SaaS myCIOScn.dll ShowReport Method Remote Command Execution

   » ‎ Bugtraq

  Posted by ZDI Disclosures on Jan 12

  ZDI-12-012 : (0Day) McAfee SaaS myCIOScn.dll ShowReport Method Remote
  Command Execution
  http://www.zerodayinitiative.com/advisories/ZDI-12-012
  January 12, 2012
  
  -- CVE ID:
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  McAfee
  
  -- Affected Products:
  
  McAfee Security-as-a-Service
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine protection...
  

  Tags:   

• 9:57

  [ MDVSA-2012:004 ] t1lib

   » ‎ Bugtraq

  Posted by security on Jan 12

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:004
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : t1lib
  Date : January 12, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:...
  

  Tags:   

• 8:58

  SafeSEH+SEHOP all-at-once bypass explotation method principles

   » ‎ Bugtraq

  Posted by geinblues on Jan 12

  Hello,
  
  I wrote this to introduce a small paper for my exploitation method of SafeSEH+SEHOP bypass in Oct, 2010.
  (http://www.x90c.org/SEH all-at-once attack.pdf, http://www.exploit-db.com/exploits/15184)
  
  Sadly it's not portable. But leave some thoughts about the method.
  
  - SafeSEH+SEHOP all-at-once bypass explotation method principles
  http://www.x90c.org/SafeSEH+SEHOP principles.pdf
  
  - sehop_chain_validation.c (Reverse Engineering code)...
  

  Tags:   

• 8:45

  Revised IETF I-D: IPv6 Neighbor Discovery, SEND, and IPv6 Fragmentation

   » ‎ Bugtraq

  Posted by Fernando Gont on Jan 12

  Folks,
  
  We have published a revision of our IETF Internet-Draft "Security
  Implications of the Use of IPv6 Extension Headers with IPv6 Neighbor
  Discovery".
  
  The revised I-D is available at:
  <http://tools.ietf.org/id/draft-gont-6man-nd-extension-headers-02.txt>
  
  This revision includes, among other thing, a discussion of possible
  issues with SEND as a result of IPv6 fragmentation.
  
  Any feedback will be very appreciated.
  
  Thanks!...
  

  Tags:   

• 8:35

  AthCon 2012 CFP is now OPEN!

   » ‎ Bugtraq

  Posted by Christian Papathanasiou on Jan 12

  The Call For Papers (CFP) for AthCon 2012 which will take place in
  Athens, Greece on the 3-4th of May, 2012 will only be open for a
  30-day window.
  The important dates are as follows:
  
  • 01/01/2012: CFP Opens
  • 31/01/2012: CFP Closes
  • 15/02/2012: Acceptance Notification
  • 30/02/2012: Conference Schedule Publication
  • 20/03/2012: Camera Ready Material
  
  As AthCon is a single track conference this year, we are expecting
  fierce competition....
  

  Tags:   

• 8:23

  Office arbitrary ClickOnce application execution vulnerability

   » ‎ Bugtraq

  Posted by Akita Software Security on Jan 12

  ------------------------------------------------------------------------
  Office arbitrary ClickOnce application execution vulnerability
  ------------------------------------------------------------------------
  Yorick Koster, June 2010
  
  ------------------------------------------------------------------------
  Abstract
  ------------------------------------------------------------------------
  A logic flaw has been found in the way .NET grants...
  

  Tags:   

• 8:10

  GreenBrowser iframe content Double Free Vulnerability

   » ‎ Bugtraq

  Posted by vuln on Jan 12

  GreenBrowser searchbar <iframe> content Double Free Vulnerability
  ------------------------------------------------------------------
  I. Summary
  All versions of GreenBrowser is prone to a vulnerability which leads to arbitrary code execution. A Double Free of
  iframe object is triggered by its shortcut button F6 (use to search the content of current page). A simple poc html
  that cause the corruption contains: <iframe...
  

  Tags:   

• 7:55

  [security bulletin] HPSBPI02698 SSRT100404 rev.2 - HP Easy Printer Care Software Running on Windows, Remote Execution of Arbitrary Code

   » ‎ Bugtraq

  Posted by security-alert on Jan 12

  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c02949847
  Version: 2
  
  HPSBPI02698 SSRT100404 rev.2 - HP Easy Printer Care Software Running on Windows, Remote Execution of Arbitrary Code
  
  NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
  
  Release Date: 2012-01-11
  Last Updated: 2012-01-11
  
  Potential Security Impact: Remote execution of arbitrary code
  
  Source: Hewlett-Packard Company, HP Software...
  

  Tags:   

• 7:45

  [SECURITY] [DSA 2386-1] openttd security update

   » ‎ Bugtraq

  Posted by Luk Claes on Jan 12

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2386-1 security () debian org
  http://www.debian.org/security/
  January 10, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : openttd
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• January 11, 2012
• 12:28

  [SECURITY] [DSA 2387-1] simplesamlphp security update

   » ‎ Bugtraq

  Posted by Thijs Kinkhorst on Jan 11

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2387-1 security () debian org
  http://www.debian.org/security/ Thijs Kinkhorst
  January 11, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : simplesamlphp
  Vulnerability : insufficient input...
  

  Tags:   

• 10:57

  Secunia Research: NTR ActiveX Control "StopModule()" Input Validation Vulnerability

   » ‎ Bugtraq

  Posted by Secunia Research on Jan 11

  ======================================================================
  
  Secunia Research 11/01/2012
  
  - NTR ActiveX Control "StopModule()" Input Validation Vulnerability -
  
  ======================================================================
  Table of Contents
  
  Affected Software....................................................1
  Severity.............................................................2
  Description...
  

  Tags:   

• 10:45

  Secunia Research: NTR ActiveX Control Four Buffer Overflow Vulnerabilities

   » ‎ Bugtraq

  Posted by Secunia Research on Jan 11

  ======================================================================
  
  Secunia Research 11/01/2012
  
  - NTR ActiveX Control Four Buffer Overflow Vulnerabilities -
  
  ======================================================================
  Table of Contents
  
  Affected Software....................................................1
  Severity.............................................................2
  Description of...
  

  Tags:   

• 10:35

  [PT-2011-04] Cross-Site Scripting in Kayako Support Suite

   » ‎ Bugtraq

  Posted by noreply on Jan 11

  -----------------------------------------------------------------
  (PT-2011-04) Positive Technologies Security Advisory
  Cross-Site Scripting in Kayako Support Suite
  -----------------------------------------------------------------
  
  ---[ Vulnerable software ]
  
  Kayako Support Suite
  Version: 3.70.02-stable and earlier
  
  Application link:
  http://www.kayako.com/
  
  ---[ Severity level ]
  
  Severity level: Medium
  Impact: Cross-Site Scripting
  Access...
  

  Tags:   

• 10:25

  [PT-2011-03] Information disclosure in Kayako Support Suite

   » ‎ Bugtraq

  Posted by noreply on Jan 11

  -----------------------------------------------------------------
  (PT-2011-03) Positive Technologies Security Advisory
  Information disclosure in Kayako Support Suite
  -----------------------------------------------------------------
  
  ---[ Vulnerable software ]
  
  Kayako Support Suite
  Version: 3.70.02-stable and earlier
  
  Application link:
  http://www.kayako.com/
  
  ---[ Severity level ]
  
  Severity level: Low
  Impact: Information disclosure
  Access...
  

  Tags:   

• 10:13

  [PT-2011-03] Information disclosure in Kayako Support Suite

   » ‎ Bugtraq

  Posted by noreply on Jan 11

  -----------------------------------------------------------------
  (PT-2011-03) Positive Technologies Security Advisory
  Information disclosure in Kayako Support Suite
  -----------------------------------------------------------------
  
  ---[ Vulnerable software ]
  
  Kayako Support Suite
  Version: 3.70.02-stable and earlier
  
  Application link:
  http://www.kayako.com/
  
  ---[ Severity level ]
  
  Severity level: Low
  Impact: Information disclosure
  Access...
  

  Tags:   

• 10:01

  Multiple XSS in KnowledgeTree Community Edition

   » ‎ Bugtraq

  Posted by advisory on Jan 11

  Advisory ID: HTB23065
  Reference: https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_knowledgetree_community_edition.html
  Product: KnowledgeTree Commercial and Community Editions
  Vendor: KnowledgeTree Inc. ( http://knowledgetree.org )
  Vulnerable Version: 3.7.0.2 and probably prior
  Tested Version: 3.7.0.2
  Vendor Notification: 21 December 2011
  Vendor Patch: 23 December 2011
  Vulnerability Type: XSS
  Status: Fixed by Vendor
  Risk Level:...
  

  Tags:   

• 9:48

  [PT-2011-02] PHP code Injection in Kayako Support Suite

   » ‎ Bugtraq

  Posted by noreply on Jan 11

  -----------------------------------------------------------------
  (PT-2011-02) Positive Technologies Security Advisory
  PHP code Injection in Kayako Support Suite
  -----------------------------------------------------------------
  
  ---[ Vulnerable software ]
  
  Kayako Support Suite
  Version: 3.70.02-stable and earlier
  
  Application link:
  http://www.kayako.com/
  
  ---[ Severity level ]
  
  Severity level: High
  Impact: Arbitrary PHP code execution...
  

  Tags:   

• 9:35

  [PT-2011-01] Cross-Site Scripting in Kayako Support Suite

   » ‎ Bugtraq

  Posted by noreply on Jan 11

  ------------------------------------------------------------------
  (PT-2011-01) Positive Technologies Security Advisory
  Cross-Site Scripting in Kayako Support Suite
  ------------------------------------------------------------------
  
  ---[ Vulnerable software ]
  
  Kayako Support Suite
  Version: 3.70.02-stable and earlier
  
  Application link:
  http://www.kayako.com/
  
  ---[ Severity level ]
  
  Severity level: Medium
  Impact: Cross-Site Scripting
  Access...
  

  Tags:   

• 9:24

  VUPEN Security Research - Adobe Acrobat and Reader Image Processing Integer Overflow (APSB12-01)

   » ‎ Bugtraq

  Posted by VUPEN Security Research on Jan 11

  VUPEN Security Research - Adobe Acrobat and Reader Image Processing Integer
  Overflow Vulnerability (APSB12-01)
  
  Website : http://www.vupen.com/english/research.php
  
  Twitter : http://twitter.com/vupen
  
  I. BACKGROUND
  ---------------------
  
  "Adobe Acrobat and Reader are the global standards for electronic
  document sharing. They are used to create, view, search, digitally
  sign, verify, print, and collaborate on Adobe PDF files."
  
  II....
  

  Tags:   

• 9:12

  Multiple Cross-Site-Scripting vulnerabilities in x3cms

   » ‎ Bugtraq

  Posted by security on Jan 11

  Advisory: Multiple Cross-Site-Scripting vulnerabilities in x3cms
  Advisory ID: INFOSERVE-ADV2011-04
  Author: Stefan Schurtz
  Contact: security () infoserve de
  Affected Software: Successfully tested on x3cms 0.4.3 other versions may also be affected
  Vendor URL: http://www.x3cms.net/
  Vendor Status: Partial Fix
  Secunia-ID: SA46748
  
  ==========================...
  

  Tags:   

• January 10, 2012
• 13:21

  [SECURITY] [DSA 2385-1] pdns security update

   » ‎ Bugtraq

  Posted by Florian Weimer on Jan 10

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2385-1 security () debian org
  http://www.debian.org/security/ Florian Weimer
  January 10, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : pdns
  Vulnerability : packet loop
  Problem type : remote...
  

  Tags: