[Full-disclosure] Drupal Wikitools 6.x-1.2 and 5.x-1.3 XSS Vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Full details of this report are also posted at http://www.madirish.net/?article=430 Description of Vulnerability: - - - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL tha

[Full-disclosure] [ MDVSA-2009:266 ] awstats

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:266 http://www.mandriva.com/security/

[Full-disclosure] Drupal Wikitools 6.x-1.2 and 5.x-1.3 XSS Vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Full details of this report are posted at http://www.madirish.net/?article=430 Description of Vulnerability: - - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL that provi

[Full-disclosure] Drupal 5.20 and 6.14 Filter Module (Core) XSS Vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The full text of this advisory is also posted at http://www.madirish.net/?article=431 Description of Vulnerability: - - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL tha

[Full-disclosure] Drupal 5.20 and 6.14 (Core) XSS Vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The full text of this disclosure is posted at http://www.madirish.net/?article=429 Description of Vulnerability: - - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL that p

[Full-disclosure] [SECURITY] [DSA 1895-2] New opensaml2 and shibboleth-sp2 packages fix regression

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1895-2 secur...@debian.org http://www.debian.org/security/ Florian Weimer October 09, 2009

[Full-disclosure] [ MDVSA-2009:264 ] gd

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:264 http://www.mandriva.com/security/

[Full-disclosure] [ MDVSA-2009:265 ] egroupware

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:265 http://www.mandriva.com/security/

Re: [Full-disclosure] When is it valid to claim that a vulnerability leads to a remote attack?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, 09 Oct 2009 10:24:02 -0400 Paul Schmehl wrote: >--On Thursday, October 08, 2009 22:16:01 -0500 Jonathan Leffler > wrote: > >> >> A reputable security defect reporting organization is claiming >that a Windows >> program is subject to a remote

Re: [Full-disclosure] [Dailydave] R. RHEL, RHCS, and Selinux : hype, reality or dream?

2009/9/9 yersinia: > So it seems that it is not necessary to be a clever hacker as spender to > disable SELinux on a system (http://grsecurity.net/~spender/exploit.txt). > Just follow the directions of the vendor. This one require to disable > selinux for the proper function of one of its HA produc

Re: [Full-disclosure] Attack pattern selection criteria for IPS products

Why would Cisco, Juniper, etc. maintain the signature sets? Presumably, each company maintains its own set of allow/deny rules. --Rohit Patnaik 2009/10/9 srujan : > I agree with your word let "customer network admin selects it". But Tipping > Point, Juniper, Cisco and Snort will have a wide rang

[Full-disclosure] [ MDVSA-2009:263 ] sympa

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:263 http://www.mandriva.com/security/

Re: [Full-disclosure] When is it valid to claim that a vulnerability leads to a remote attack?

--On Thursday, October 08, 2009 22:16:01 -0500 Jonathan Leffler wrote: > > A reputable security defect reporting organization is claiming that a Windows > program is subject to a remote attack because: > > * The vulnerable program (call it 'pqrminder') is registered as the 'handler' > for files

[Full-disclosure] [USN-847-2] devscripts vulnerability

=== Ubuntu Security Notice USN-847-2 October 09, 2009 devscripts vulnerability CVE-2009-2946 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This

[Full-disclosure] [ MDVSA-2009:262 ] netpbm

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:262 http://www.mandriva.com/security/

[Full-disclosure] CA20091008-01: Security Notice for CA Anti-Virus Engine

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CA20091008-01: Security Notice for CA Anti-Virus Engine Issued: October 8, 2009 CA's support is alerting customers to multiple security risks associated with CA Anti-Virus Engine. Vulnerabilities exist in the arclib component that can allow a re

Re: [Full-disclosure] Attack pattern selection criteria for IPS products

I agree with your word let "customer network admin selects it". But Tipping Point, Juniper, Cisco and Snort will have a wide range of customers, and maintaining different signature set for different Orgs is a big headache. All these guys are maintaining 95% to 99% detection coverage at NSS testing

[Full-disclosure] Cellphone with USB host

anybody know of a cellphone widely available able to get connected to a USB disk , see its content and copy , read , write and make snapshots ?i'm going to measure if its possible to steal private information over corporate USB flash disks using guest's cellphones any hint is appreciated __

[Full-disclosure] [SECURITY] [DSA 1904-1] New wget packages fix SSL certificate verification weakness

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1904-1 secur...@debian.org http://www.debian.org/security/ Giuseppe Iuculano October 09, 2009

Re: [Full-disclosure] When is it valid to claim that a vulnerability leads to a remote attack?

On Fri, 09 Oct 2009 12:09:08 +0200, Thierry Zoller said: > IMHO it generally is classified as remote. Some vendors call it > "user assisted remote arbitrary code execution" which, in my opinion > is just downplaying the issue - there are virtually unlimited means to > get somebody or somethi

Re: [Full-disclosure] When is it valid to claim that a vulnerability leads to a remote attack?

Hi Jonathan, IMHO it generally is classified as remote. Some vendors call it "user assisted remote arbitrary code execution" which, in my opinion is just downplaying the issue - there are virtually unlimited means to get somebody or something to open such a file some less assisted but still