[Full-disclosure] Deutsche Post Security Cup 2013

2013-03-20 Thread Juergen.Pabel
Dear all, as in 2010 (http://seclists.org/fulldisclosure/2010/Sep/318) we will be conducting the Deutsche Post Security Cup this year again. Unfortunately, this year only participants from Germany are allowed to the contest (because of legal complications if international participants would

Re: [Full-disclosure] Deutsche Post Security Cup 2013

2013-03-20 Thread Harry Behrens
I guess this is strong encouragement for all international participants to supply their services in a ..well...unsolicited and unmonitored manner ;-)) -h On 20.03.2013 10:24, juergen.pa...@deutschepost.de wrote: Dear all, as in 2010 (http://seclists.org/fulldisclosure/2010/Sep/318) we

Re: [Full-disclosure] Deutsche Post Security Cup 2013

2013-03-20 Thread Hurgel Bumpf
Most of the subscribers are single individuals. Why bother sending them a invitaton when 99.9% are rejected because they dont have a company or a big team. There a lot of valuable and competent individualsĀ out there which are rejected because of their team size in the first place. Don't be so

Re: [Full-disclosure] Deutsche Post Security Cup 2013

2013-03-20 Thread Daniel Preussker
On 20.03.2013, at 13:34, Hurgel Bumpf wrote: Most of the subscribers are single individuals. Why bother sending them a invitaton when 99.9% are rejected because they dont have a company or a big team. There a lot of valuable and competent individuals out there which are rejected because of

Re: [Full-disclosure] Deutsche Post Security Cup 2013

2013-03-20 Thread Benji
I think its getting ridiculous, if you don't have a name in the industry you're getting sued for the vast majority of bugs you solve... And on the other hand, those same companies give away 3-15.000 for a single bug if the researcher happens to be known :| Examples please On Wed, Mar 20, 2013

[Full-disclosure] CVE-2013-186y: tokend (Apple, Gemalto) - privacy leak arbitrary file creation (OSX, All versions)

2013-03-20 Thread Dirk-Willem van Gulik
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSC.tokend (1,2) is a Tokend module for OS X CDSA/Keychain subsystem for accessing smart cards. As is common in such bridges to a relatively slow medium (chipcards in readers on serial/USB); tokend relies on a cache. This cache is kept in

[Full-disclosure] CVE-2013-1866: OpenSC.tokend - privacy leak arbitrary file creation (OSX, All versions)

2013-03-20 Thread Dirk-Willem van Gulik
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSC.tokend (1,2) is a Tokend module for OS X CDSA/Keychain subsystem for accessing smart cards. As is common in such bridges to a relatively slow medium (chipcards in readers on serial/USB); tokend relies on a cache. This cache is kept in

[Full-disclosure] CVE-2013-1867: tokend (Apple, Gemalto) - privacy leak arbitrary file creation (OSX, All versions)

2013-03-20 Thread Dirk-Willem van Gulik
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tokend is a module for OS X CDSA/Keychain subsystem for accessing smart cards. It acts as a bridge between the apple KeyChain and PKCS#11 libraries for smartcards, hardware security modules, cryptographic accelerators and various other security

Re: [Full-disclosure] Deutsche Post Security Cup 2013

2013-03-20 Thread Juergen.Pabel
Hi, we do accept individuals as a team of one - however, that single person would have to proove in their application that they by themselve have enough expertise in order to beat out other team applications (which would definitively be possible). Teams are evaluated based on the skillset they

Re: [Full-disclosure] Deutsche Post Security Cup 2013

2013-03-20 Thread Daniel Preussker
On 20.03.2013, at 14:59, Benji wrote: I think its getting ridiculous, if you don't have a name in the industry you're getting sued for the vast majority of bugs you solve... And on the other hand, those same companies give away 3-15.000 for a single bug if the researcher happens to be known

[Full-disclosure] [SECURITY] [DSA 2641-2] libapache2-mod-perl2 update related to DSA 2641-1

2013-03-20 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2641-2 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso March 20, 2013

[Full-disclosure] [Security-news] SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS)

2013-03-20 Thread security-news
View online: http://drupal.org/node/1948358 * Advisory ID: DRUPAL-SA-CONTRIB-2013-035 * Project: Views [1] (third-party module) * Version: 7.x * Date: 2013-March-20 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting