jetlib.sec » Full Disclosure » February 17, 2012

Feeds

133099 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Full Disclosure

• February 17, 2012
• 

  Re: Fwd: 0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)

  Posted: February 17th, 2012, 4:46pm PST

  Tags:   

  Posted by Kousuke Ebihara on Feb 17

  Dear Rodrigo,
  
  Thanks for your response. And I had misunderstood about some points. At first, I apologize about that.
  
  Is that advisory the same of http://seclists.org/bugtraq/2010/Nov/21 ? --(A)
  
  of users, so we are not fixing it"
  
  Oh, I think his the response is not good.
  
  However, wait, are there no bad points in your advisory? The above (A) question is for confirming that point.
  
  Indeed, his response to my first contact (and my...
  
• 

  0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)

  Posted: February 17th, 2012, 4:45pm PST

  Tags:   

  Posted by Kousuke Ebihara on Feb 17

  I've reported the following XSS vulnerability in cforms II. This vulnerability has been fixed on February 14, 2012 by
  its developer.
  
  WordPress cformsII Plugin "rs" Cross-Site Scripting Vulnerability - Secunia.com
  http://secunia.com/advisories/47984/
  
  You might see this is a normal XSS vulnerability, but this isn't.
  
  Because EXPLOIT CODE IS PUBLISHED AS 0-DAY ON Oct 30, 2010 in this list!
  
  Are you puzzled?
  
  Actually, the...
  
• 

  0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)

  Posted: February 17th, 2012, 4:44pm PST

  Tags:   

  Posted by Kousuke Ebihara on Feb 17

  I've reported the following XSS vulnerability in cforms II. This vulnerability has been fixed on February 14, 2012 by
  its developer.
  
  WordPress cformsII Plugin "rs" Cross-Site Scripting Vulnerability - Secunia.com
  http://secunia.com/advisories/47984/
  
  You might see this is a normal XSS vulnerability, but this isn't.
  
  Because EXPLOIT CODE IS PUBLISHED AS 0-DAY ON Oct 30, 2010 in this list!
  
  Are you puzzled?
  
  Actually, the...
  
• 

  Skype v5.6.59.x - Memory Corruption Vulnerability

  Posted: February 17th, 2012, 4:42pm PST

  Tags:   

  Posted by research () vulnerability-lab com on Feb 17

  Title:
  ======
  Skype v5.6.59.x - Memory Corruption Vulnerability
  
  Date:
  =====
  2012-02-17
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=315
  
  VL-ID:
  =====
  315
  
  Introduction:
  =============
  Skype is a software application that allows users to make voice and video calls and chats over the Internet. Calls to
  other users within the
  Skype service are free, while calls to both traditional landline telephones and mobile...
  
• 

  Facebook NYClubs - Multiple Web Vulnerabilities

  Posted: February 17th, 2012, 4:40pm PST

  Tags:   

  Posted by research () vulnerability-lab com on Feb 17

  Title:
  ======
  Facebook NYClubs - Multiple Web Vulnerabilities
  
  Date:
  =====
  2012-02-17
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=440
  
  VL-ID:
  =====
  440
  
  Introduction:
  =============
  The application is currently included and viewable by all facebook users.
  The service is an external 3rd party application sponsored by the Facebook NYClubs Development Team.
  
  (Copy from the Vendors Homepage:...
  
• 

  Pandora FMS v4.0.1 - Local File Include Vulnerability

  Posted: February 17th, 2012, 4:39pm PST

  Tags:   

  Posted by research () vulnerability-lab com on Feb 17

  Title:
  ======
  Pandora FMS v4.0.1 - Local File Include Vulnerability
  
  Date:
  =====
  2012-02-17
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=435
  
  VL-ID:
  =====
  435
  
  Introduction:
  =============
  Pandora FMS is a monitoring Open Source software. It watches your systems and applications, and allows you to
  know the status of any element of those systems. Pandora FMS could detect a network interface down, a defacement
  in...
  
• 

  Context IS Advisory - SAP AG Netweaver 7.02 Remote Code Execution

  Posted: February 17th, 2012, 4:37pm PST

  Tags:   

  Posted by Context IS - Disclosure on Feb 17

  ===============================ADVISORY===============================
  Systems Affected: SAP AG Netweaver 7.02
  Severity: High
  Category: Remote Code Execution
  Author: Nico Leidecker, Context Information Security Ltd
  Reported to vendor: 29th September 2011
  Advisory Issued: 17th February 2012
  ===============================ADVISORY===============================
  
  Buffer Overflow In...
  
• 

  [ MDVSA-2012:021 ] java-1.6.0-openjdk

  Posted: February 17th, 2012, 10:47am PST

  Tags:   

  Posted by security on Feb 17

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:021
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : java-1.6.0-openjdk
  Date : January 17, 2012
  Affected: 2010.1, 2011., Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem...
  
• 

  Downloads Folder: A Binary Planting Minefield

  Posted: February 17th, 2012, 8:41am PST

  Tags:   

  Posted by ACROS Security Lists on Feb 17

  This blog post reveals a bit of our research and provides an advance notification of
  a largely unknown remote exploit technique on Windows. More importantly, it provides
  instructions for protecting your computers from this technique while waiting for the
  affected software to correct its behavior.
  
  http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html
  
  or
  
  http://bit.ly/wmq00a
  
  Enjoy the reading!
  
  Mitja Kolsek, CEO / @mkolsek...
  
• 

  IETF I-D: Security and Interoperability Implications of Oversized IPv6 Header Chains

  Posted: February 17th, 2012, 4:56am PST

  Tags:   

  Posted by Fernando Gont on Feb 17

  Folks,
  
  FYI, we've published a new IETF I-D entitled "Security and
  Interoperability Implications of Oversized IPv6 Header Chains".
  
  The I-D is available at:
  <http://tools.ietf.org/id/draft-gont-6man-oversized-header-chain-00.txt>
  
  Any feedback will be very welcome.
  
  Thanks,
  
• 

  Re: Fwd: 0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)

  Posted: February 17th, 2012, 4:14am PST

  Tags:   

  Posted by Rodrigo Rubira Branco (BSDaemon) on Feb 17

  Dear Kousuke,
  
  First of all, let me clarify that the disclosure process has been
  entirely coordinated by me, and thus, Wagner, Conviso and Check Point
  have no responsibilities over any mistake I eventually made.
  
  Anyway, just to clarify your points:
  
  I sent to the developer a complete advisory, including the exploit code.
  
  I never confused the vulnerabilities. And I never said the bug was
  patched... Maybe you should redirect this comment to...
  
• 

  Operation Bring Peace To Machines - Mission 1 (nmap2cpe)

  Posted: February 17th, 2012, 2:27am PST

  Tags:   

  Posted by Jerome Athias on Feb 17

  "Your sound card works perfectly."
  "Enjoying yourself?"
  "It doesn't get any better than this!"
  
  "Ready to serve."
  "Yes?"
  "My lord?"
  
  "What is it?"
  
  http://seclists.org/nmap-dev/2010/q3/278
  
  Good luck!
  
  /JA
  
  Ref: http://www.wowwiki.com/Quotes_of_Warcraft_II