[Full-disclosure] Cross-Site Scripting vulnerability in Icinga

2011-06-01 Thread sschu...@t-online.de
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Advisory: Cross-Site Scripting vulnerability in Icinga Advisory ID:SSCHADV2011-005 Author: Stefan Schurtz Affected Software: Successfully tested on: icinga-1.3.0 / icinga-1.4.0 Vendor URL: http://www.icinga.org Ve

[Full-disclosure] Cross-Site Scripting vulnerability in Nagios

2011-06-01 Thread sschu...@t-online.de
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Advisory: Cross-Site Scripting vulnerability in Nagios Advisory ID:SSCHADV2011-006 Author: Stefan Schurtz Affected Software: Successfully tested on: nagios 3.2.3 Vendor URL: http://www.nagios.org Vendor Status:

Re: [Full-disclosure] What's Inside: June 22 Webcast - State of SSL on the Internet - Register Now

2011-06-01 Thread Thor (Hammer of God)
Hmm I tested before sending - the original link had a bit longer querystring, but I wasn't sure if that was somehow linked to my "account" so I truncated it - but it still worked :) Just going to https://rsa-email.rsa.com works as well :) On my box anyway. t > -Original Message- > Fro

[Full-disclosure] FW: What’s Inside: June 22 Webcast – State of SSL on the Internet - Register Now

2011-06-01 Thread Thor (Hammer of God)
This was too good to pass up. This is a link to sign up for the RSA Webcast for "The State of SSL on the Internet." It generates a "cert is not trusted" error. LOLOL. https://rsa-email.rsa.com/servlet/cc6?jkHQAQSVlohjxoHuuL t From: RSA Conference [mailto:r...@info.rsa.com] Sent: Wednes

Re: [Full-disclosure] MSN Live Password Decryptor v2.0 is Released

2011-06-01 Thread Thor (Hammer of God)
You know, I've basically ignored the triviality of your tools (and the spamming of this list) in the past because I figure you've got as much right as anyone else to publish whatever tools you want. I've published lame tools myself. But when you try to present this crap as "Exposing the Passwo

[Full-disclosure] Cisco Security Advisory: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client

2011-06-01 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client Advisory ID: cisco-sa-20110601-ac Revision 1.0 For Public Release 2011 June 01 1600 UTC (GMT

[Full-disclosure] Cisco Security Advisory: Default Credentials for root Account on the Cisco Media Experience Engine 5600

2011-06-01 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Default Credentials for root Account on the Cisco Media Experience Engine 5600 Advisory ID: cisco-sa-20110601-mxe Revision 1.0 For Public Release 2011 June 01 1600 UTC (GMT

[Full-disclosure] New CSRF and XSS vulnerabilities in ADSL modem Callisto 821+

2011-06-01 Thread MustLive
Hello list! I want to warn you about security vulnerabilities in ADSL modem Callisto 821+ (SI2000 Callisto821+ Router). These are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities. Which I've found in your modem. In April I've already drew attention of Ukrtelecom's representat

[Full-disclosure] Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified IP Phones 7900 Series

2011-06-01 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified IP Phones 7900 Series Advisory ID: cisco-sa-20110601-phone Revision 1.0 For Public Release 2011 June 1 1600 UTC (GMT

[Full-disclosure] Cisco Security Advisory: Default Credentials Vulnerability in Cisco Network Registrar

2011-06-01 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Default Credentials Vulnerability in Cisco Network Registrar Advisory ID: cisco-sa-20110601-cnr Revision 1.0 For Public Release 2011 June 01 1600 UTC (GMT

[Full-disclosure] Netgear WNDAP350 root password leak

2011-06-01 Thread Juerd Waalboer
https://revspace.nl/RevelationSpace/NewsItem11x05x30x0 Summary: * http://192.168.0.237/downloadFile.php reveals secrets * http://192.168.0.237/BackupConfig.php reveals secrets * Included in the exposed secrets: root password and WPA2 keys * The PHPs do not require authentication

[Full-disclosure] [ MDVSA-2011:105 ] wireshark

2011-06-01 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2011:105 http://www.mandriva.com/security/ _

[Full-disclosure] MSN Live Password Decryptor v2.0 is Released

2011-06-01 Thread SecurityXploded Group
Hi all, MSNLivePasswordDecryptor is the FREE software to instantly recover MSN/Hotmail/Windows Live Messenger passwords stored by applications such as MSN, Windows Live Messenger, Hotmail, web browsers and other messengers. It has both GUI as well as command-line interface making it useful for P

[Full-disclosure] [ MDVSA-2011:104 ] bind

2011-06-01 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2011:104 http://www.mandriva.com/security/ _

Re: [Full-disclosure] packet replay tools for wlan

2011-06-01 Thread Ross . Bushby
Aireplay http://www.aircrack-ng.org/doku.php?id=interactive_packet_replay&DokuWiki=29d7926cab990d025beca0e13e588b06 김무성 Sent by: full-disclosure-boun...@lists.grok.org.uk 01/06/2011 11:45 To cc Subject [Full-disclosure] packet replay tools for wlan Hello. List I’m looking for

[Full-disclosure] Last Mile, June 5th | CfP: VALID 2011 || October 23-28, 2011 - Barcelona, Spain

2011-06-01 Thread Cristina Pascual
INVITATION: = Please consider to contribute to and/or forward to the appropriate groups the following opportunity to submit and publish original scientific results. The submission deadline is June 5, 2011 In addition, authors of selected papers will be invited to submit extended

Re: [Full-disclosure] Ra-Guard evasion (new Internet-Drafts)

2011-06-01 Thread Marc Heuse
Hi Fernando, to quote from your drafts: > As part of the project "Security Assessment of the Internet Protocol > version 6 (IPv6)" [CPNI-IPv6], we devised a number of techniques for > circumventing the RA-Guard protection, which are described in the > following sections of this document. These t

[Full-disclosure] packet replay tools for wlan

2011-06-01 Thread 김무성
Hello. List I’m looking for packet repaly tools for WLAN. It have to be possible that .pacp replay on Wireless LAN through Wireless NIC. Regards, MuSung Kim. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclos

Re: [Full-disclosure] find11.html

2011-06-01 Thread Hartley, Christopher J.
Seen (links to) 90 separate web servers... no obvious commonalities between them. On May 31, 2011, at 5:06 AM, Giles Coochey wrote: > On Tue, May 31, 2011 05:16, Daniel Hood wrote: >> Anyone else seen this going around? >> >> I've got a couple of links coming through for this via hacked email

[Full-disclosure] [SECURITY] [DSA 2250-1] citadel security update

2011-06-01 Thread Nico Golde
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2250-1 secur...@debian.org http://www.debian.org/security/Nico Golde March 31, 2011

[Full-disclosure] [SECURITY] [DSA 2249-1] jabberd14 security update

2011-06-01 Thread Nico Golde
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2249-1 secur...@debian.org http://www.debian.org/security/Nico Golde March 31, 2011

[Full-disclosure] [SECURITY] [DSA 2248-1] ejabberd security update

2011-06-01 Thread Nico Golde
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2248-1 secur...@debian.org http://www.debian.org/security/Nico Golde March 31, 2011

[Full-disclosure] [SECURITY] [DSA 2247-1] rails security update

2011-06-01 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2247-1 secur...@debian.org http://www.debian.org/security/ Thijs Kinkhorst May 31, 2011

[Full-disclosure] cherokee server admin vulnerable to csrf

2011-06-01 Thread dave b
Vendor response: "This isn't an issue." Problem: the cherokee server admin configuration web interface is vulnerable to csrf. Impact: if an admin is logged into the cherokee admin interface and visits a site which runs "bad tm scripts" cherokee can be reconfigured to run as $user and set log hand