|
|
Prev week |
Colapse all |
Post message
Directory Traversal in 3D FTP Client 2010-08-22 advisory htbridge ch Vulnerability ID: HTB22565 Reference: http://www.htbridge.ch/advisory/directory_traversal_in_3d_ftp_client.htm l Product: 3D FTP Client Vendor: SiteDesigner Technologies, Inc. ( http://3dftp.com/3dftp.htm ) Vulnerable Version: 9.0 build 2 and Probably Prior Versions Vendor Notification: 05 August 20 [ more ] [ reply ] Google Chrome: HTTP AUTH Dialog Spoofing through Realm Manipulation (Restated) 2010-08-23 Aditya K Sood (0kn0ck secniche org) Hi Google Chrome ( 5.0.375.127 and previous versions) suffers from HTTP Auth Dialog spoofing vulnerability due to possible realm manipulation in the HTTP header. Previously, Google chrome has got a similar bug which can be seen on the following link http://code.google.com/p/chromium/issues/detail? [ more ] [ reply ] Directory Traversal in AutoFTP Manager 2010-08-22 advisory htbridge ch Vulnerability ID: HTB22566 Reference: http://www.htbridge.ch/advisory/directory_traversal_in_autoftp_manager.h tml Product: AutoFTP Manager Vendor: DeskShare ( http://www.deskshare.com/afm.aspx ) Vulnerable Version: 4.31 and Probably Prior Versions Vendor Notification: 05 August 2010 Vulnerability [ more ] [ reply ] phpMyAdmin 3.3.5 / 2.11.10 <= Cross Site Scripting (XSS) Vulnerability 2010-08-20 YGN Ethical Hacker Group (lists yehg net) ======================================================================== ====== phpMyAdmin 3.3.5 / 2.11.10 <= Cross Site Scripting (XSS) Vulnerability ======================================================================== ====== 1. OVERVIEW The phpMyAdmin web application was vulnerable to Cross [ more ] [ reply ] [SECURITY] [DSA 2094-1] New Linux 2.6.26 packages fix several issues 2010-08-20 dann frazier (dannf debian org) Re: Web Tool Announcement: ismymailsecure.com 2010-08-19 Chuck Swiger (cswiger mac com) Hi, Holger-- On Aug 18, 2010, at 2:59 AM, Holger Rabbach wrote: > I am happy to announce the immediate availability of a web based email > security testing tool at http://www.ismymailsecure.com. [ ... ] > If you have any concerns about having to enter a full email address, > please be advised that [ more ] [ reply ] Re: ACROS Security: Remote Binary Planting in Apple iTunes for Windows (ASPR #2010-08-18-1) 2010-08-19 larry larryseltzer com [security bulletin] HPSBMA02477 SSRT090177 rev.5 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial of Service (DoS) 2010-08-19 security-alert hp com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01926980 Version: 5 HPSBMA02477 SSRT090177 rev.5 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial of Service (DoS) NOTICE: The information in this Security [ more ] [ reply ] Flock Browser 3.0.0.3989 Malformed Bookmark XSS and script insertion 2010-08-19 Lostmon lords (lostmon gmail com) ######################################### Flock Browser 3.0.0.3989 Malformed Bookmark XSS Vendor URL: http://beta.flock.com/ Advisore: http://lostmon.blogspot.com/2010/08/flock-browser-3003989-malformed.html Vendor notify:NO exploits availables:YES ######################################### Flock is [ more ] [ reply ] [security bulletin] HPSBMA02424 SSRT080125 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code 2010-08-19 security-alert hp com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01723303 Version: 3 HPSBMA02424 SSRT080125 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted [ more ] [ reply ] [SECURITY] [DSA 2093-1] New ghostscript packages fix several vulnerabilities 2010-08-19 Giuseppe Iuculano (iuculano debian org) [security bulletin] HPSBST02536 SSRT100057 rev.2 - HP StorageWorks Storage Mirroring, Remote Unauthorized Access 2010-08-19 security-alert hp com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02056045 Version: 2 HPSBST02536 SSRT100057 rev.2 - HP StorageWorks Storage Mirroring, Remote Unauthorized Access NOTICE: The information in this Security Bulletin should be acted upon as soon as [ more ] [ reply ] NSOADV-2010-005: SonicWALL E-Class SSL-VPN ActiveX Control format string overflow 2010-08-19 NSO Research (nso-research sotiriu de) ______________________________________________________________________ -------------------------- NSOADV-2010-005 --------------------------- SonicWALL E-Class SSL-VPN ActiveX Control format string overflow ______________________________________________________________________ _________________ [ more ] [ reply ] MUSE v4.9.0.006 (.pls) Local Universal Buffer Overflow [SEH] 2010-08-18 glafkos astalavista com # Exploit Title: MUSE v4.9.0.006 (.pls) Local Universal Buffer Overflow [SEH] # Date: August 17, 2010 # Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com) # Software Link: http://download.cnet.com/MUSE/3000-2140_4-42511.html # Version: 4.9.0.006 # Tested on: Windows XP SP3 En payload = " [ more ] [ reply ] MUSE v4.9.0.006 (.m3u) Local Buffer Overflow Exploit 2010-08-18 glafkos astalavista com # Exploit Title: MUSE v4.9.0.006 (.m3u) Local Buffer Overflow Exploit # Date: August 17, 2010 # Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com) # Software Link: http://download.cnet.com/MUSE/3000-2140_4-42511.html # Version: 4.9.0.006 # Tested on: Windows XP SP3 En buffersize = 205 no [ more ] [ reply ] Better Security Through Sacrificing Maidens 2010-08-18 Pete Herzog (lists isecom org) Hi, The typical enterprise security today is one that is properly prepared to sacrifice something to an attacker now so they will be 100% prepared against it later. There's something wrong with that method and it's part of the reason why ISECOM is taking some very new directions in security tha [ more ] [ reply ] Web Tool Announcement: ismymailsecure.com 2010-08-18 Holger Rabbach (hrabbach crossroad-networks com) Dear Bugtraq community, I am happy to announce the immediate availability of a web based email security testing tool at http://www.ismymailsecure.com. The tool is an end-user friendly way to determine if the mail servers for a certain email address support the STARTTLS capability to encrypt the ema [ more ] [ reply ] ACROS Security: Remote Binary Planting in Apple iTunes for Windows (ASPR #2010-08-18-1) 2010-08-18 Mitja Kolsek (mitja kolsek acros si) =====[BEGIN-ACROS-REPORT]===== PUBLIC ======================================================================== = ACROS Security Problem Report #2010-08-18-1 ------------------------------------------------------------------------ - ASPR #2010-08-18-1: Remote Binary Planting in Apple iTunes for Windo [ more ] [ reply ] Medium security hole in Rekonq web browser 2010-08-18 Tim Brown (timb nth-dimension org uk) I've identified that that Rekonq versions up to and including 0.5 were vulnerable to universal XSS affecting the error page. CVE-2010-2536 was assigned for this vulnerability. Cheers, Tim -- Tim Brown <mailto:timb (at) nth-dimension.org (dot) uk [email concealed]> <http://www.nth-dimension.org.uk/> -----BEGIN PGP SIGNED ME [ more ] [ reply ] [SECURITY] [DSA 1919-2] New smarty packages fix regression 2010-08-17 Thijs Kinkhorst (thijs debian org) [SECURITY] [DSA 2092-1] New lxr-cvs packages fix cross-site scripting 2010-08-17 Sebastien Delafond (seb debian org) [USN-973-1] KOffice vulnerabilities 2010-08-17 Jamie Strandboge (jamie canonical com) =========================================================== Ubuntu Security Notice USN-973-1 August 17, 2010 koffice vulnerabilities CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0166, CVE-2009-0195, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181, CVE-20 [ more ] [ reply ] Geolocation spoofing and other UI woes 2010-08-17 Michal Zalewski (lcamtuf coredump cx) Hi, This may be of some interest to people on the list: http://lcamtuf.blogspot.com/2010/08/on-designing-uis-for-non-robots.html In general, there is a class of UI design problems that trace back to the failure to account for the inherent limitations of human cognition; the specific example explo [ more ] [ reply ] [USN-972-1] FreeType vulnerabilities 2010-08-17 Marc Deslauriers (marc deslauriers canonical com) =========================================================== Ubuntu Security Notice USN-972-1 August 17, 2010 freetype vulnerabilities CVE-2010-1797, CVE-2010-2541, CVE-2010-2805, CVE-2010-2806, CVE-2010-2807, CVE-2010-2808 =========================================================== A sec [ more ] [ reply ] Triologic Media Player 8 (.m3u) Local Universal Unicode Buffer Overflow [SEH] 2010-08-17 glafkos astalavista com # Exploit Title: Triologic Media Player 8 (.m3u) Local Universal Unicode Buffer Overflow [SEH] # Date: August 17, 2010 # Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com) # Software Link: http://download.cnet.com/Triologic-Media-Player/3000-2139_4-10691520.htm l # Version: 8 # Tested [ more ] [ reply ] CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack 2010-08-17 Jan Lehnardt (jan apache org) CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache CouchDB 0.8.0 to 0.11.0 Description: Apache CouchDB versions prior to version 0.11.1 are vulnerable to cross site request forgery (CSRF) attacks. [ more ] [ reply ] Windows Kerberos Authentication Bypass 2010-08-13 Tommaso Malgherini (mamaragan gmail com) OVERVIEW: A vulnerability was found in all recent Windows operating systems. The attack allows a malicious user to physically login on a target host in a Kerberos-based network, under the assumption that he knows a valid user principal and has the ability to manipulate network traffic. Our research [ more ] [ reply ] |
|
Privacy Statement |
RUXCON 2010 FINAL CALL FOR PAPERS
Ruxcon would like to announce the final call for papers for the sixth annual Ruxcon conference.
This year the conference will take place over the weekend of 20th and 21st of November.
Ruxcon will be held at CQ, Melbourne, Australia.
The deadline for submission
[ more ] [ reply ]