|
|
Colapse all |
Post message
C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness 2009-09-30 Eyal Udassin (eyal udassin c4-security com) Background ----------------- Vendor product information, from www.osisoft.com : The PI SystemT brings all operational data into a single system that can deliver it to users at all levels of the company - from the plant floor to the enterprise level. The PI System keeps business-critical data always [ more ] [ reply ] MD5 hash extension attack breaks API authentication of Flickr and others 2009-09-30 Juliano Rizzo (netiferasnospam netifera com) Flickr's API Signature Forgery Vulnerability http://netifera.com/research/flickr_api_signature_forgery.pdf September 29, 2009 --Affected Web Sites A lot of web sites provide API service whose architecture is the same as Flickr's API. They are potentially vulnerable. We don't have a complete list [ more ] [ reply ] FlatPress 0.804-0.812.1 Local File Inclusion to Remote Command Execution 2009-09-29 Giuseppe Fuggiano (giuseppe fuggiano gmail com) Security Advisory ----------------- FlatPress 0.804-0.812.1 Local File Inclusion to Remote Command Execution Researcher Information ---------------------- Discovered by: Giuseppe `Zmax` Fuggiano Website: http://www.giusef.net Contact: giuseppe(dot)fuggiano(at)gmail(dot)com Product Information -- [ more ] [ reply ] Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges 2009-09-29 nospam gmail it Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges by Nine:Situations:Group::bellick site: http://retrogod.altervista.org/ Tested on Microsoft Windows XP SP3 The "Adobe Active File Monitor V8" service is installed with an improper securit [ more ] [ reply ] Cross-Site Scripting vulnerability in eCaptcha 2009-09-28 MustLive (mustlive websecurity com ua) Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in eCaptcha (plugin for E107). I found this hole in July 2008 and disclosed it at 25.09.2008. XSS: POST query at page http://site/path/ecaptcha/?key=b7c9bf99e763252105f047a5ca5681d0 <script>alert(document.cookie)</scri [ more ] [ reply ] [security bulletin] HPSBMA02461 SSRT090187 rev.1 - HP Remote Graphics Software (RGS) Sender, Remote Unauthorized Access 2009-09-28 security-alert hp com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01859457 Version: 1 HPSBMA02461 SSRT090187 rev.1 - HP Remote Graphics Software (RGS) Sender, Remote Unauthorized Access NOTICE: The information in this Security Bulletin should be acted upon as [ more ] [ reply ] [SECURITY] [DSA 1896-1] New Shibboleth 1.x packages fix potential code execution 2009-09-28 Florian Weimer (fw deneb enyo de) Local privilege escalation vulnerability in Trustport security software 2009-09-28 ss_contacts hotmail com ShineShadow Security Report 28092009-10 TITLE Local privilege escalation vulnerability in Trustport security software BACKGROUND TrustPort is a major producer of software solutions for secure communication and reliable data protection. TrustPort products are characterized by a comprehe [ more ] [ reply ] [DSECRG-09-043] SAP GUI 7.1 Insecure Method 2009-09-28 Alexandr Polyakov (alexandr polyakov dsec ru) [USN-838-1] Dovecot vulnerabilities 2009-09-28 Marc Deslauriers (marc deslauriers canonical com) =========================================================== Ubuntu Security Notice USN-838-1 September 28, 2009 dovecot vulnerabilities CVE-2008-4577, CVE-2008-5301, CVE-2009-2632, CVE-2009-3235 =========================================================== A security issue affects the followi [ more ] [ reply ] Re: Regular Expression Denial of Service 2009-09-28 hackerwebzine gmail com Alex, it isn't a new technique in web-application security. If you queried Google, or did some research on recent (2007) Blackhat talks, you'll probably noticed that this is very well known and understood technique. Even Charles Miller talked about it (on the OSX Safari exploits). So the claim that [ more ] [ reply ] [MajorSecurity Advisory #57]PHP <=5.3 - preg_match() full path disclosure 2009-09-27 David Vieira-Kurz (david majorsecurity info) [MajorSecurity Advisory #57]PHP <=5.3 - preg_match() full path disclosure Details ======= Product: PHP <=5.3 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.php.net/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz http:// [ more ] [ reply ] [SECURITY] [DSA 1897-1] New horde3 packages fix arbitrary code execution 2009-09-28 Nico Golde (nion debian org) (edited) [DSECRG-09-044] SAP GUI 7.1 Insecure Methods 2009-09-28 Alexandr Polyakov (alexandr polyakov dsec ru) [MajorSecurity Advisory #59]PHP <=5.3 - mysqli_real_escape_string() full path disclosure 2009-09-28 David Vieira-Kurz (david majorsecurity info) [MajorSecurity Advisory #59]PHP <=5.3 - mysqli_real_escape_string() full path disclosure Details ======= Product: PHP <=5.3 Security-Risk: low Remote-Exploit: yes Vendor-URL: http://www.php.net/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Ku [ more ] [ reply ] Vulnerabilities in E107 2009-09-26 MustLive (mustlive websecurity com ua) Hello Bugtraq! I want to warn you about Insufficient Anti-automation and Cross-Site Scripting vulnerabilities in E107. I found XSS holes in October 2006 and Insufficient Anti-automation in November 2007, and disclosed them at 30.01.2009. Insufficient Anti-Automation: Vulnerability is in captcha a [ more ] [ reply ] Multiple Vulnerabilities 2009-09-25 Dr_IDE (dr_ide hushmail com) Usually I submit via milw0rm but it has been unresponsive all week. Here are a few new vulnerabilities and updates. -Dr_IDE#!/usr/bin/env python ######################################################################## ############################# # # CuteFTP v8.3.3 Home/Pro/Lite Create New S [ more ] [ reply ] |
|
Privacy Statement |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:177
http://www.mandriva.com/security/
_____________________________________________________________________
[ more ] [ reply ]