. *Credits*
This vulnerability was discovered and researched by Diego Juarez and
Sebastian Tello from Core Security Technologies during Bugweek 2009 [1].
The publication of this advisory was coordinated by Fernando Russ from
Core Security Advisories Team.
7. *Technical Description / Proof
vBulletin - Cross Site Script Redirection
Versions Affected: 3.8.4 / 3.7.6 / 3.6.12
Patches Available: 3.8.4PL1 / 3.7.6PL1 / 3.6.12PL1
Info: An XSS flaw within the user profile page has recently been discovered.
This could allow an attacker to carry out an action as a user or obtain
security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide develop
of vulnerabilities, novel solutions and prototypes for
new technologies. CoreLabs regularly publishes security advisories,
technical papers, project information and shared software tools for
public use at: http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security
)
2009-10-02 18:09:56 UTC (RELENG_6_3, 6.3-RELEASE-p13)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
Pipes are a form
information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
The device file system (devfs) provides access to system devices, such as
storage devices
solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security Technologies develops
Hello MustLive,
Thanks for your immediate reply.
I have now tested what you said, cause I suspected that it was only happening
because Google Chrome was installed, due to FireFox isn't able to know what
``chromehtml:ยดยด is on its own. (it has to be associated with an application in
this
Hi MustLive,
I can confirm that this consumed most ressources in FireFox 3.5.2 as well.
I have the newest Google Chrome browser installed which might explain why.
Best regards, hopes, peace and love,
MaXe - Founder of InterN0T - Undergrou...
http://www.intern0t.net/
PS: The extra long
for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
-RELEASE-p12)
CVE Name: CVE-2009-0696
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
NOTE: Due to this issue being accidentally disclosed early
and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security Technologies develops strategic solutions
===
Vulnerable Product: Cisco WLC 4402 (most likely among many others)
Vulnerability discovered: January 2009
Reported to vendor: Jan 01, 2009
Fix available: not yet
===
TIMELINE:
=
INTERNET SECURITY AUDITORS ALERT 2009-009
- Original release date: July 21st, 2009
- Last revised: July 23rd, 2009
- Discovered by: Juan Galiana Lara
- Severity: 5/10 (CVSS Base Score)
=
I. VULNERABILITY
vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project
=
INTERNET SECURITY AUDITORS ALERT 2009-NNN
- Original release date: July 7th, 2009
- Last revised: July 17th, 2009
- Discovered by: Vicente Aguilera Diaz
- Severity: 4.5/10 (CVSS Base Score)
=
I.
I agree completely with mz,
This is just how FireFox works, the data:text/html,base64;somestringinbase64==
is just pure functionality. The redirection parameters is not equal to a
vulnerability since as mz said, the attacker could just redirect to his own
site.
The best way to defend against
auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http
=
INTERNET SECURITY AUDITORS ALERT 2009-007
- Original release date: June 30th, 2009
- Last revised: July 2nd, 2009
- Discovered by: Juan Galiana Lara
- Severity: 6.8/10 (CVSS Base Score)
=
I. VULNERABILITY
Trustwave's SpiderLabs Security Advisory TWSL2009-002:
Cisco ASA Web VPN Multiple Vulnerabilities
Published: 2009-06-24 Version: 1.0
Vendor: Cisco Systems, Inc. (http://www.cisco.com)
Versions affected: 8.0(4), 8.1.2, and 8.2.1
Description: Cisco's Adaptive Security Appliance (ASA)
provides a
.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious
by MSRC, IE team member, Core security
advisories team and vulnerability researchers.
. 2009-06-04:
Core sends MSRC notes taken during the conference call. Actions items:
. MSRC to provide workaround and mitigations and to follow-up on
issues demonstrated by the second PoC.
. Core to further
)
CVE Name: CVE-2009-1252
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
The ntpd(8) daemon is an implementation
-p11)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
IPv6 is a new Internet Protocol, designed to replace (and avoid many
-RELEASE-p11)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
One of the most commonly used forms of interprocess communication
=
INTERNET SECURITY AUDITORS ALERT 2009-006
- Original release date: April 5th, 2009
- Last revised: June 5th, 2009
- Discovered by: Juan Galiana Lara
- Severity: 6.4/10 (CVSS Base Score)
=
I. VULNERABILITY
include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About
-05-07:
Core requests a status update for this vulnerability and
notifies its plan to publish the advisory on May 18th, 2009. No reply
received.
. 2009-05-15:
Core requests an answer to the previous mail. No reply
received.
. 2009-05-18:
Core Advisories Team does not release the advisory
of the report and asks Core to
postpone publication of the security advisory in order to have enough
time to investigate and fix the bugs. Vendor requests GPG key of Core's
security Advisories team.
. 2009-01-12:
Core agrees to postpone the advisory publication but asks the vendor for
a feedback
)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
FreeBSD's C library (libc) contains code for creating and accessing
Berkeley DB 1.85
UTC (RELENG_6_3, 6.3-RELEASE-p10)
CVE Name: CVE-2009-0590
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
FreeBSD
auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http
GPG key of
Core's security Advisories team.
. 2009-01-12: Core agrees to postpone publication of the security
advisory but asks the vendor for a feedback of the vendor's engineering
team as soon as possible in order to coordinate the release date of
fixes and security advisories.
. 2009-01-21: Core
(RELENG_7_0, 7.0-RELEASE-p11)
CVE Name: CVE-2009-1041
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
In FreeBSD 7.0
, 7.53, and 7.53 with patch NNM_01195 were tested and all
of them were vulnerable. The two heap-based buffer overflows are
different vulnerabilities from those exposed publicly on CVE-2008-0067
because the vulnerabilities are not fixed with patch NNM_01195 and are
not mentioned on published advisories
=
INTERNET SECURITY AUDITORS ALERT 2009-001
- Original release date: February 25th, 2009
- Last revised: March 19th, 2009
- Discovered by: Juan Galiana Lara
- Severity: 7.8/10 (CVSS Base Scored)
=
I.
=
INTERNET SECURITY AUDITORS ALERT 2009-004
- Original release date: December 3rd, 2008
- Last revised: March 10th, 2009
- Discovered by: Juan Galiana Lara
- Severity: 6.3/10 (CVSS scored)
=
I. VULNERABILITY
publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide
=
INTERNET SECURITY AUDITORS ALERT 2009-002
- Original release date: January 7th, 2009
- Last revised: March 2nd, 2009
- Discovered by: Juan Galiana Lara
- Severity: 9/10 (CVSS scored)
=
I. VULNERABILITY
:56:17 UTC (RELENG_7_0, 7.0-RELEASE-p3)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
The FreeBSD telnet daemon, telnetd(8
and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public
advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
12. *About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide develop
-RELEASE-p9)
CVE Name: CVE-2009-0025
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
BIND 9 is an implementation
and that they are ready to release patches the following week.
. 2008-12-17: Core insists that advisories are published simultaneously
with the patched software releases.
. 2008-12-17: Vendor asks if the advisory will include complete
information on how to possibly exploit the bugs.
. 2008-12-17: Core
-p8)
CVE Name: CVE-2008-5077
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
FreeBSD includes software from the OpenSSL
-RELEASE-p8)
CVE Name: CVE-2008-4247
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
lukemftpd(8) is a general-purpose
=
INTERNET SECURITY AUDITORS ALERT 2008-004
- Original release date: 12th December, 2008
- Last revised: 22nd December, 2008
- Discovered by: Jesus Olmos Gonzalez
- Severity: 4/5
=
I. VULNERABILITY
information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
The FreeBSD kernel provides support for a variety of different types of
communications sockets
)
CVE Name: CVE-2008-4247
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
ftpd(8) is a general-purpose implementation of File
of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
10. *About Core Security Technologies*
Core Security Technologies
=
INTERNET SECURITY AUDITORS ALERT 2008-001
- Original release date: January 3rd, 2008
- Last revised: December 22nd, 2008
- Discovered by: Jesus Olmos Gonzalez
- Severity: 2/5
=
I. VULNERABILITY
---
[ iViZ Security Advisory 08-01110/12/2008 ]
---
iViZ Techno Solutions Pvt. Ltd.
---
[ iViZ Security Advisory 08-01210/12/2008 ]
---
iViZ Techno Solutions Pvt. Ltd.
---
[ iViZ Security Advisory 08-01310/12/2008 ]
---
iViZ Techno Solutions Pvt. Ltd.
---
[ iViZ Security Advisory 08-01410/12/2008 ]
---
iViZ Techno Solutions Pvt. Ltd.
---
[ iViZ Security Advisory 08-01510/12/2008 ]
---
iViZ Techno Solutions Pvt. Ltd.
---
[ iViZ Security Advisory 08-01610/12/2008 ]
---
iViZ Techno Solutions Pvt. Ltd.
security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories
vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project
-2008-2086
Reference: http://www.vsecurity.com/bulletins/advisories/2008/JWS-props.txt
-
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Product Description
- ---
- From [1]:
Using Java Web Start technology, standalone Java software
planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software
.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com
-10-01 00:32:59 UTC (RELENG_7_0, 7.0-RELEASE-p5)
2008-10-01 00:32:59 UTC (RELENG_6, 6.4-PRERELEASE)
2008-10-01 00:32:59 UTC (RELENG_6_3, 6.3-RELEASE-p5)
CVE Name: CVE-2008-2476
For general information regarding FreeBSD Security Advisories,
including descriptions
:
http://www.apple.com/support/downloads/
6.2. *Cross-References*
We generally do not publish advisories for denial of service issues
unless there are more serious security consequences. As such, we are not
planning to describe the fix for this issue, but we do appreciate your
having reported
:47 UTC (RELENG_7_0, 7.0-RELEASE-p4)
CVE Name: CVE-2008-3531
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
The mount(2
:47 UTC (RELENG_7_0, 7.0-RELEASE-p4)
2008-09-03 19:09:47 UTC (RELENG_6, 6.4-PRERELEASE)
2008-09-03 19:09:47 UTC (RELENG_6_3, 6.3-RELEASE-p4)
CVE Name: CVE-2008-3890
For general information regarding FreeBSD Security Advisories,
including descriptions
-09-03 19:09:47 UTC (RELENG_7_0, 7.0-RELEASE-p4)
2008-09-03 19:09:47 UTC (RELENG_6, 6.4-PRERELEASE)
2008-09-03 19:09:47 UTC (RELENG_6_3, 6.3-RELEASE-p4)
CVE Name: CVE-2008-3530
For general information regarding FreeBSD Security Advisories,
including
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- ---
[ iViZ Security Advisory 08-00825/08/2008 ]
- ---
iViZ Techno Solutions Pvt. Ltd.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- ---
[ iViZ Security Advisory 08-00725/08/2008 ]
- ---
iViZ Techno Solutions Pvt. Ltd.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- ---
[ iViZ Security Advisory 08-00325/08/2008 ]
- ---
iViZ Techno Solutions Pvt. Ltd.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- ---
[ iViZ Security Advisory 08-00425/08/2008 ]
- ---
iViZ Techno Solutions Pvt. Ltd.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- ---
[ iViZ Security Advisory 08-00225/08/2008 ]
- ---
iViZ Techno Solutions Pvt. Ltd.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- ---
[ iViZ Security Advisory 08-00525/08/2008 ]
- ---
iViZ Techno Solutions Pvt. Ltd.
---
[ iViZ Security Advisory 08-00625/08/2008 ]
---
iViZ Techno Solutions Pvt. Ltd.
.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs/.
*About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious
security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs/.
*About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide develop
://www.security-objectives.com/advisories/SECOBJADV-2008-02.txt
AFFECTED: Cygwin setup.exe 2.573.2.2
PLATFORM: Intel / Windows
CLASSIFICATION: Insufficient Verification of Data Authenticity (CWE-345)
RESEARCHER: Derek Callaway
IMPACT: Client-side code execution
SEVERITY: Medium
DIFFICULTY
=
INTERNET SECURITY AUDITORS ALERT 2006-006
- Original release date: February 28, 2006
- Last revised: July 18th, 2008
- Discovered by: Jesus Olmos Gonzalez
- Severity: 5/5
=
I. VULNERABILITY
)
2008-07-13 18:42:38 UTC (RELENG_7, 7.0-STABLE)
2008-07-13 18:42:38 UTC (RELENG_7_0, 7.0-RELEASE-p3)
CVE Name: CVE-2008-1447
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
*** NETRAGARD ADVISORY ***
http://www.netragard.com
We make IT Safe
[Advisory Summary]
-
auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http
vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project
in an upcoming update and the vulnerabilities in the
iCal client application will be fixed in an update following the early
March software update.
. 2008-02-19:
Core indicated that it will split the report in two security advisories.
CORE-2008-0123 will address the vulnerability in iCal server
(CVE
to the previous
inquiry about the advisory's content, Core states that the purpose of
publishing security advisories and the rationale used to define their
content is simple and hopefully, once explained, both reasonable and
understandable. Core publishes advisories not only to make users aware
solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs/.
*About Core Security Technologies*
Core Security Technologies develops strategic
-RELEASE-p24)
2008-04-17 00:00:41 UTC (RELENG_5, 5.5-STABLE)
2008-04-17 00:00:54 UTC (RELENG_5_5, 5.5-RELEASE-p20)
CVE Name: CVE-2008-1483
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches
and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs/.
*About Core Security Technologies*
Core Security Technologies develops strategic solutions
include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs/.
*About
auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http
.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs/.
*About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious
, cyber attack
planning and simulation, source code auditing, and cryptography. Our
results include problem formalization, identification of vulnerabilities,
novel solutions and prototypes for new technologies. CoreLabs regularly
publishes security advisories, technical papers, project information
-RELEASE-p23)
2008-02-14 11:49:39 UTC (RELENG_5, 5.5-STABLE)
2008-02-14 11:50:28 UTC (RELENG_5_5, 5.5-RELEASE-p19)
CVE Name: CVE-2008-0777
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches
, 5.5-RELEASE-p19)
CVE Name: CVE-2008-0177
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit URL:http://security.FreeBSD.org/.
I. Background
The IPsec suite of protocols
IOActive Security Advisory
Title: Multiple Buffer Overflows in Legacy mod_jk2 = 2.0.3-DEV
Severity: High
Date Discovered:05.01.2007
Date Reported: 06.27.2007
Date Disclosed: 09.20.2007
Affected Products:
mod_jk2 = v2.0.3-DEV
F5 BIG-IP =
IOActive Security Advisory
Title: Multiple Remote Vulnerabilities in Mercury SiteScope
Severity: Critical
Date Discovered:10.05.2006
Date Reported: 05.21.2007
Date Disclosed: 09.20.2007
Affected Products:
Mercury SiteScope - All Versions
The following pre-advisory is also available in PDF format for download at:
http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_Documentum_dmclTrace_Arbitrary_file_overwrite.pdf
Advisory Name: Arbitrary file overwrite in Documentum Administrator /
Documentum Webtop
==
vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project
security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories
, cyber attack planning and simulation,
source code auditing, and cryptography. Our results include problem
formalization, identification of vulnerabilities, novel solutions and
prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information
and simulation,
source code auditing, and cryptography. Our results include problem
formalization, identification of vulnerabilities, novel solutions and
prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public
501 - 600 of 858 matches
Mail list logo
