Bugtraq

• Thread Index

• Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE
  • From: Ronen Z
• [ MDVSA-2014:038 ] kernel
  • From: security
• [ MDVSA-2014:037 ] ffmpeg
  • From: security
• Recon 2014 Call For Papers - June 27-29, 2014 - Montreal, Quebec
  • From: cfp2014
• [ MDVSA-2014:036 ] varnish
  • From: security
• [ MDVSA-2014:035 ] libpng
  • From: security
• My PDF Creator & DE DM v1.4 iOS - Multiple Vulnerabilities
  • From: Vulnerability Lab
• [SECURITY] [DSA 2862-1] chromium-browser security update
  • From: Michael Gilbert
• [SECURITY] [DSA 2861-1] file security update
  • From: Salvatore Bonaccorso
• File Hub v1.9.1 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• mbDriveHD v1.0.7 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Office Assistant Pro v2.2.2 iOS - File Include Vulnerability
  • From: Vulnerability Lab
• Full Disclosure - Linksys EA2700, EA3500, E4200 and EA4500 - Authentication Bypass to Administrative Console
  • From: kyle Lovett
• [ MDVSA-2014:033 ] socat
  • From: security
• phpMyBackupPro-2.4 Cross-Site Scripting vulnerability
  • From: iedb . team
• [SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection
  • From: no-reply
• CISTI'2014: List of Workshops
  • From: ML
• [ MDVSA-2014:032 ] flite
  • From: security
• [ MDVSA-2014:031 ] drupal
  • From: security
• [ MDVSA-2014:034 ] yaml
  • From: security
• [slackware-security] ntp (SSA:2014-044-02)
  • From: Slackware Security Team
• [ MDVSA-2014:029 ] mysql
  • From: security
• [slackware-security] curl (SSA:2014-044-01)
  • From: Slackware Security Team
• [ MDVSA-2014:028 ] mariadb
  • From: security
• RE: CVE-2014-1219 - Unauthenticated Privilege Escalation in CA 2E Web Option
  • From: Williams, James K
• Critical security flaws in Nagios NRPE client/server crypto
  • From: Aaron Zauner
• [ISecAuditors Security Advisories] - Reflected XSS vulnerability in Boxcryptor (www.boxcryptor.com)
  • From: ISecAuditors Security Advisories
• Wordpress plugin Buddypress <= 1.9.1 privilege escalation vulnerability
  • From: Pietro Oliva
• Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability
  • From: Pietro Oliva
• Re: ASUS RT Series Routers FTP Service - Default anonymous access
  • From: kyle Lovett
• [ MDVSA-2014:027 ] php
  • From: security
• ASUS RT Series Routers FTP Service - Default anonymous access
  • From: kyle Lovett
• APPLE-SA-2014-02-11-1 Boot Camp 5.1
  • From: Apple Product Security
• Mybb All Version Denial of Service Vulnerability
  • From: iedb . team
• [ MDVSA-2014:026 ] openldap
  • From: security
• jDisk (stickto) v2.0.3 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• [SECURITY] [DSA 2850-2] libyaml regression update
  • From: Salvatore Bonaccorso
• [CVE-2014-1903] FreePBX 2.9 through 12 RCE
  • From: rob . thomas
• [SECURITY] [DSA 2860-1] parcimonie security update
  • From: Salvatore Bonaccorso
• [ MDVSA-2014:025 ] pidgin
  • From: security
• WiFi Camera Roll v1.2 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Wordpress all_in_one_carousel Plugin /XSS/CSRF/ Vuln
  • From: iedb . team
• [mwrlabs advisory][CVE-2014-0748] Cray Aprun/Apinit Privilege Escalation
  • From: john . fitzpatrick
• Phpbb Forum Denial of Service Vulnerability
  • From: iedb . team
• [SECURITY] [DSA 2859-1] pidgin security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2858-1] iceweasel security update
  • From: Moritz Muehlenhoff
• Open-Xchange Security Advisory 2014-02-10
  • From: Martin Braun
• [slackware-security] mozilla-thunderbird (SSA:2014-039-02)
  • From: Slackware Security Team
• ASUS AiCloud Enabled Routers 12 Models - Authentication bypass and Sensitive file/path disclosure
  • From: kyle Lovett
• [slackware-security] seamonkey (SSA:2014-039-03)
  • From: Slackware Security Team
• #CONFidence 2014- Call for Papers, only 0111 days left to become CONFidence ninja
  • From: Andrzej Targosz
• [slackware-security] mozilla-firefox (SSA:2014-039-01)
  • From: Slackware Security Team
• [SECURITY] [DSA 2857-1] libspring-java security update
  • From: Moritz Muehlenhoff
• [oCERT-2014-001] MantisBT input sanitization errors
  • From: Andrea Barisani
• [SECURITY] [DSA 2856-1] libcommons-fileupload-java security update
  • From: Florian Weimer
• WHMCS Denial of Service Vulnerability
  • From: iedb . team
• Facebook Bug Bounty #12 - Client Side Exception Web Vulnerability
  • From: Vulnerability Lab
• gpEasy v4.3.x CMS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Information on recently-fixed Oracle VM VirtualBox vulnerabilities
  • From: Matthew Daley
• [SECURITY] [DSA 2852-1] libgadu security update
  • From: Florian Weimer
• CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability
  • From: CORE Advisories Team
• AlienVault OSSIM SQL Injection vulnerability
  • From: jakx . ppr
• German Telekom Bug Bounty #11 - Remote SQL Injection Vulnerability
  • From: Vulnerability Lab
• German Telekom Bug Bounty #10 - Arbitrary File Upload Vulnerability
  • From: Vulnerability Lab
• CVE-2014-1214 - Remote Code Execution in Projoom NovaSFH Plugin
  • From: advisories
• German Telekom Bug Bounty #9 - Code Execution Vulnerability
  • From: Vulnerability Lab
• [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS
  • From: Mark Thomas
• [SECURITY] [DSA 2855-1] libav security update
  • From: Moritz Muehlenhoff
• [ISecAuditors Security Advisories] Multiple reflected XSS vulnerabilities in Atmail WebMail
  • From: ISecAuditors Security Advisories
• Inteno DG301 Command Injection
  • From: post
• [SECURITY] [DSA 2853-1] horde3 security update
  • From: Luciano Bello
• SQL Injection in doorGets CMS
  • From: High-Tech Bridge Security Research
• Multiple SQL Injection Vulnerabilities in AuraCMS
  • From: High-Tech Bridge Security Research
• ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability
  • From: Security Alert
• Security Advisory: NETGEAR Router D6300B Firmware: V1.0.0.14_1.0.14
  • From: marcel . mangold
• [slackware-security] pidgin (SSA:2014-034-01)
  • From: Slackware Security Team
• [SECURITY] [DSA 2851-1] drupal6 security update
  • From: Salvatore Bonaccorso
• Security advisory, LedgerSMB 1.3.0-1.3.36
  • From: Chris Travers
• CVE-2014-1213 - Denial of Service in Sophos Anti Virus
  • From: advisories
• [SECURITY] [DSA 2850-1] libyaml security update
  • From: Salvatore Bonaccorso
• Joomla! JomSocial component < 3.1.0.1 - Remote code execution
  • From: Matias Fontanini
• [SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service
  • From: Security Explorations
• [SECURITY] [DSA 2849-1] curl security update
  • From: Florian Weimer
• Ektron CMS Take Over - Hijacking Accounts
  • From: Mark Litchfield
• [slackware-security] bind (SSA:2014-028-01)
  • From: Slackware Security Team
• SimplyShare v1.4 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• SiteCore XML Control Script Insertion
  • From: Mark Litchfield
• [slackware-security] mozilla-nss (SSA:2014-028-02)
  • From: Slackware Security Team
• Vulnerabilities within Mura CMS / Sitecore MCS / SmarterMail
  • From: Mark Litchfield
• Multiple Vulnerabilities in Eventum
  • From: High-Tech Bridge Security Research
• Mozilla Bug Bounty #5 - WireTap Remote Web Vulnerability
  • From: Vulnerability Lab
• DC4420 - London DEFCON - January meet - Tuesday 28th January 2014
  • From: Major Malfunction
• [ MDVSA-2014:021 ] perl-Proc-Daemon
  • From: security
• [ MDVSA-2014:024 ] graphviz
  • From: security
• [ MDVSA-2014:023 ] hplip
  • From: security
• [ MDVSA-2014:022 ] augeas
  • From: security
• Security Vulnerabilities in Apache Cordova / PhoneGap
  • From: mgeorgiev
• [CVE-2013-6235] - Multiple Reflected XSS vulnerabilities in JAMon v2.7
  • From: Christian Catalano
• [CTF] nullcon HackIM 2014 will start at 24-01-2014, when the clock will strike at 11:59 (+5:30 GMT)
  • From: nullcon
• [CVE-2014-1664] GoToMeeting Information Disclosure via Logging Output (Android)
  • From: cjlacayo
• [SECURITY] [DSA 2826-2] denyhosts regression update
  • From: Yves-Alexis Perez
• [CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module
  • From: ali . hussein
• [SECURITY] [DSA 2848-1] mysql-5.5 security update
  • From: Salvatore Bonaccorso
• APPLE-SA-2014-01-22-1 iTunes 11.1.4
  • From: Apple Product Security
• Cross-Site Scripting (XSS) in Komento Joomla Extension
  • From: High-Tech Bridge Security Research
• SQL Injection in JV Comment Joomla Extension
  • From: High-Tech Bridge Security Research
• Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page
  • From: tudor . enache
• CONFidence 2014- Call for Papers
  • From: Andrzej Targosz
• CISTI'2014: CFP - Doctoral Symposium
  • From: ML
• [ MDVSA-2014:020 ] x11-server
  • From: security
• Cisco Security Advisory: Cisco TelePresence System Software Command Execution Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco TelePresence Video Communication Server SIP Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• [ MDVSA-2014:019 ] elinks
  • From: security
• [ MDVSA-2014:018 ] net-snmp
  • From: security
• [ MDVSA-2014:017 ] net-snmp
  • From: security
• [ MDVSA-2014:016 ] spice
  • From: security
• [ MDVSA-2014:015 ] cups
  • From: security
• SEC Consult SA-20140122-0 :: Critical vulnerabilities in T-Mobile HOME NET Router LTE (Huawei B593u-12)
  • From: SEC Consult Vulnerability Lab
• [FFRRA-20131213] Crafted ICMP ECHO REQUEST can cause denial of service on Juniper SSG20
  • From: research-feedback
• [ MDVSA-2014:014 ] php
  • From: security
• [ MDVSA-2014:013 ] libxfont
  • From: security
• [SECURITY] [DSA 2847-1] drupal7 security update
  • From: Salvatore Bonaccorso
• [ MDVSA-2014:012 ] nss
  • From: security
• [ MDVSA-2014:011 ] java-1.7.0-openjdk
  • From: security
• Secunia Research: OpenPNE PHP Object Injection Vulnerability
  • From: Secunia Research
• [ MDVSA-2014:009 ] librsvg
  • From: security
• [SECURITY] [DSA 2846-1] libvirt security update
  • From: Moritz Muehlenhoff
• SI6 Networks' IPv6 Toolkit v1.5.2 released!
  • From: Fernando Gont
• [SECURITY] [DSA 2831-2] puppet regression update
  • From: Salvatore Bonaccorso
• Ammyy Admin - Hidden hard-coded option and Access Control vulnerability.
  • From: bhadresh . k . patel
• [SECURITY] [DSA 2845-1] mysql-5.1 security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2014:010 ] memcached
  • From: security
• [ MDVSA-2014:008 ] openjpeg
  • From: security
• [ MDVSA-2014:007 ] openssl
  • From: security
• Open-Xchange Security Advisory 2014-01-17
  • From: Martin Braun
• [security bulletin] HPSBUX02961 SSRT101420 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS)
  • From: security-alert
• [ MDVSA-2014:003 ] nrpe
  • From: security
• CVE-2013-4200 - Plone URL redirection / Forwarding of cookie data (session hijack) in certain browsers
  • From: Alexandre Herzog
• [ MDVSA-2014:002 ] bind
  • From: security
• SQL Injection in Sexy Polling Joomla Extension
  • From: High-Tech Bridge Security Research
• [ MDVSA-2014:004 ] nagios
  • From: security
• [ MDVSA-2014:006 ] libxslt
  • From: security
• [ MDVSA-2014:005 ] ejabberd
  • From: security
• [HITB-Announce] #HITB2014AMS Call for Papers - FINAL CALL
  • From: Hafez Kamal
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Access Control System
  • From: Cisco Systems Product Security Incident Response Team
• [slackware-security] openssl (SSA:2014-013-02)
  • From: Slackware Security Team
• Online OWASP Security Challenges
  • From: Ivan Buetler
• [SECURITY] [DSA 2844-1] djvulibre security update
  • From: Raphael Geissert
• FreeBSD Security Advisory FreeBSD-SA-14:01.bsnmpd
  • From: FreeBSD Security Advisories
• CVE-2013-6430 Possible XSS when using Spring MVC
  • From: Pivotal Security Team
• FreeBSD Security Advisory FreeBSD-SA-14:02.ntpd
  • From: FreeBSD Security Advisories
• CVE-2013-6429 Fix for XML External Entity (XXE) injection (CVE-2013-4152) in Spring Framework was incomplete
  • From: Pivotal Security Team
• [CVE-2014-1238] Cross Site Scripting(XSS) in q-pulse application
  • From: ali . hussein
• FreeBSD Security Advisory FreeBSD-SA-14:04.bind
  • From: FreeBSD Security Advisories
• FreeBSD Security Advisory FreeBSD-SA-14:03.openssl
  • From: FreeBSD Security Advisories
• [slackware-security] libXfont (SSA:2014-013-01)
  • From: Slackware Security Team
• [slackware-security] samba (SSA:2014-013-04)
  • From: Slackware Security Team
• [slackware-security] php (SSA:2014-013-03)
  • From: Slackware Security Team
• [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application
  • From: Daniel Wood
• [security bulletin] HPSBUX02960 SSRT101419 rev.1 - HP-UX Running NTP, Remote Denial of Service (DoS)
  • From: security-alert
• [SECURITY] [DSA 2843-1] graphviz security update
  • From: Salvatore Bonaccorso
• [ MDVSA-2014:001 ] kernel
  • From: security
• [SECURITY] [DSA 2842-1] libspring-java security update
  • From: Moritz Muehlenhoff
• NETGEAR WNR1000v3 Password Recovery Vulnerability
  • From: c1ph04mail
• CISTI'2014: List of Workshops
  • From: ML
• [SECURITY] [DSA 2841-1] movabletype-opensource security update
  • From: Moritz Muehlenhoff
• Cisco Security Advisory: Undocumented Test Interface in Cisco Small Business Devices
  • From: Cisco Systems Product Security Incident Response Team
• [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow
  • From: Pedro Ribeiro
• [SECURITY] [DSA 2840-1] srtp security update
  • From: Salvatore Bonaccorso
• Updated [CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall rules allowing additional access
  • From: David Nalley
• Updated [CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users
  • From: David Nalley
• [CVE-2013-7204] CSRF in Conceptronic IP Camera (CIPCAMPTIWL)
  • From: Felipe Molina
• nullcon Blackshield Awards 2014
  • From: nullcon
• [SECURITY] [DSA 2839-1] spice security update
  • From: Salvatore Bonaccorso
• Improper Authentication in Burden
  • From: High-Tech Bridge Security Research
• Multiple Vulnerabilities in Horizon QCMS
  • From: High-Tech Bridge Security Research
• [SECURITY] [DSA 2838-1] libxfont security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2837-1] openssl security update
  • From: Moritz Muehlenhoff
• SPAMINA EMAIL FIREWALL 3.3.1.1 - Directory Traversal -
  • From: sisco . barrera
• AusCERT2014 Call for Presentations and Tutorials
  • From: AusCERT
• [HITB-Announce] HITB Magazine Issue 10 Out Now
  • From: Hafez Kamal
• Open-Xchange Security Advisory 2014-01-06
  • From: Martin Braun
• [SECURITY] [DSA 2836-1] devscripts security update
  • From: Raphael Geissert
• [SECURITY] [DSA 2835-1] asterisk security update
  • From: Moritz Muehlenhoff
• [security bulletin] HPSBMU02895 SSRT101253 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code
  • From: security-alert
• Path Traversal in eduTrac
  • From: High-Tech Bridge Security Research
• [CVE-2013-6480] Libcloud doesn't send scrub_data query parameter when destroying a DigitalOcean node
  • From: Tomaz Muraus
• [SECURITY] [DSA 2834-1] typo3-src security update
  • From: Salvatore Bonaccorso
• CFP - IEEE Co-sponsored CyberSec2014 - Lebanon Section
  • From: The Third International Conference on Cyber Security, Cyber Warfare, and Digital Forensic
• [SECURITY] [DSA 2833-1] openssl security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2832-1] memcached security update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 2831-1] puppet security update
  • From: Luciano Bello
• [SECURITY] [DSA 2830-1] ruby-i18n security update
  • From: Florian Weimer
• [security bulletin] HPSBMU02959 rev.1 - HP Service Manager WebTier and Windows Client, Cross-Site Scripting (XSS), Execution of Arbitrary Code and other Vulnerabilities
  • From: security-alert
• CALL FOR PAPERS - Hackers 2 Hackers Conference 11th edition
  • From: Rodrigo Rubira Branco (BSDaemon)
• [SECURITY] [DSA 2829-1] hplip security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2828-1] drupal6 security update
  • From: Salvatore Bonaccorso
• SEC Consult SA-20131227-0 :: IBM Web Content Manager (WCM) XPath Injection
  • From: SEC Consult Vulnerability Lab
• Cross-Site Scripting (XSS) in WP-Cron Dashboard Wordpress plugin
  • From: High-Tech Bridge Security Research
• Cross-Site Scripting (XSS) in Ad-minister Wordpress plugin
  • From: High-Tech Bridge Security Research
• Сross-Site Request Forgery (CSRF) in AskApache Firefox Adsense Wordpress plugin
  • From: High-Tech Bridge Security Research
• [ MDVSA-2013:302 ] pixman
  • From: security
• ESA-2013-092: EMC Replication Manager Unquoted File Path Enumeration Vulnerability
  • From: Security Alert
• ESA-2013-091: EMC Watch4net Information Disclosure Vulnerability
  • From: Security Alert
• [SECURITY] [DSA 2827-1] libcommons-fileupload-java security update
  • From: Salvatore Bonaccorso
• [ MDVSA-2013:301 ] nss
  • From: security
• Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities
  • From: Vulnerability Lab
• [ MDVSA-2013:300 ] asterisk
  • From: security
• ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability
  • From: Security Alert
• NEW VMSA-2013-0016 VMware ESXi and ESX unauthorized file access through vCenter Server and ESX
  • From: "VMware Security Response Center"
• [SECURITY] [DSA 2826-1] denyhosts security update
  • From: Yves-Alexis Perez
• [ MDVSA-2013:299 ] samba
  • From: security
• [slackware-security] gnupg (SSA:2013-354-01)
  • From: Slackware Security Team
• Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities
  • From: Vulnerability Lab
• [ MDVSA-2013:298 ] php
  • From: security
• [SECURITY] [DSA 2825-1] wireshark security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2013:297 ] munin
  • From: security
• [ MDVSA-2013:296 ] wireshark
  • From: security
• [REVIVE-SA-2013-001] Revive Adserver 3.0.2 fixes SQL injection vulnerability
  • From: Matteo Beccati
• [SECURITY] [DSA 2824-1] curl security update
  • From: Salvatore Bonaccorso
• [ MDVSA-2013:295 ] gnupg
  • From: security
• [security bulletin] HPSBGN02950 rev.1 - HP Autonomy Ultraseek, Cross-Site Scripting (XSS)
  • From: security-alert
• ESA-2013-079: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities
  • From: Security Alert
• APPLE-SA-2013-12-19-1 Motion 5.1
  • From: Apple Product Security
• CORE-2013-0903 - RealPlayer Heap-based Buffer Overflow Vulnerability
  • From: CORE Advisories Team
• [SECURITY] [DSA 2822-1] xorg-server security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2823-1] pixman security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2821-1] gnupg security update
  • From: Thijs Kinkhorst
• [ MDVSA-2013:294 ] gimp
  • From: security
• [ MDVSA-2013:293 ] gimp
  • From: security
• [ MDVSA-2013:292 ] links
  • From: security
• [ MDVSA-2013:291 ] kernel
  • From: security
• [ MDVSA-2013:289 ] owncloud
  • From: security
• [ MDVSA-2013:290 ] mediawiki
  • From: security
• [ MDVSA-2013:291 ] kernel
  • From: security
• [CVE-2013-2627, CVE-2013-2628, CVE-2013-2629] Leed (Light Feed) - Multiple vulnerabilities
  • From: Alexandre Herzog
• [CVE-2013-2764] Secure Entry Server - URL Redirection
  • From: Alexandre Herzog
• [CVE-2013-5676] Plain Text Password In SonarQube Jenkins Plugin
  • From: Christian Catalano
• [CVE-2013-5573] Jenkins v1.523 Default markup formatter permits offsite-bound forms
  • From: Christian Catalano
• InfoSec Southwest 2014 CFP now open!
  • From: ISSW CFP
• [ MDVSA-2013:288 ] subversion
  • From: security
• [ MDVSA-2013:287-1 ] drupal
  • From: security
• Hancom Office '.hml' file heap-based buffer overflow
  • From: diroverflow
• [slackware-security] seamonkey (SSA:2013-350-07)
  • From: Slackware Security Team
• [slackware-security] ruby (SSA:2013-350-06)
  • From: Slackware Security Team
• [slackware-security] libjpeg (SSA:2013-350-02)
  • From: Slackware Security Team
• [slackware-security] llvm (SSA:2013-350-03)
  • From: Slackware Security Team
• [slackware-security] mozilla-thunderbird (SSA:2013-350-05)
  • From: Slackware Security Team
• [slackware-security] libiodbc (SSA:2013-350-01)
  • From: Slackware Security Team
• [SECURITY] [DSA 2820-1] nspr security update
  • From: Raphael Geissert
• [slackware-security] mozilla-firefox (SSA:2013-350-04)
  • From: Slackware Security Team
• QuickHeal AntiVirus 7.0.0.1 - Stack Overflow Vulnerability
  • From: Vulnerability Lab
• AST-2013-007: Asterisk Manager User Dialplan Permission Escalation
  • From: Asterisk Security Team
• AST-2013-006: Buffer Overflow when receiving odd length 16 bit SMS message
  • From: Asterisk Security Team
• FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1
  • From: Apple Product Security
• APPLE-SA-2013-12-16-2 OS X Mavericks v10.9.1
  • From: Apple Product Security
• [security bulletin] HPSBHF02953 rev.1 - HP B-series SAN Network Advisor, Remote Code Execution
  • From: security-alert
• [SECURITY] [DSA 2818-1] mysql-5.5 security update
  • From: Salvatore Bonaccorso
• User Identity Spoofing in Bitrix Site Manager
  • From: High-Tech Bridge Security Research
• XSS and Full Path Disclosure in MijoSearch Joomla Extension
  • From: High-Tech Bridge Security Research
• [SECURITY] [DSA 2819-1] End-of-life announcement for iceape
  • From: Moritz Muehlenhoff
• Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities
  • From: Vulnerability Lab
• Command injection in Ruby Gem Webbynode 1.0.5.3
  • From: Larry W. Cashdollar
• LiveZilla 5.1.2.0 PHP Object Injection
  • From: zoczus
• Command injection vulnerability in Ruby Gem sprout 0.7.246
  • From: Larry W. Cashdollar
• Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line
  • From: Larry W. Cashdollar
• LiveZilla 5.1.2.0 Insecure password storage
  • From: zoczus
• LiveZilla 5.1.2.0 Multiple Stored XSS in webbased operator client
  • From: zoczus
• [SECURITY] [DSA 2817-1] libtar security update
  • From: Luciano Bello
• Last Call - 2sd World Conference on IST; Submission: December 29
  • From: WorldCIST
• Call for Papers -YSTS 8 - Information Security Conference, Brazil
  • From: Luiz Eduardo
• Advisory 01/2013: PHP openssl_x509_parse() Memory Corruption Vulnerability
  • From: Stefan Esser
• DC4420 - DefCon London: Christmas Social (= no talks), Tuesday 17th December 2013
  • From: Tony Naggs
• Microsoft Online, Office & Cloud - Persistent Encoding Vulnerabilities
  • From: Vulnerability Lab
• [security bulletin] HPSBMU02872 rev.4 - HP Service Manager Web Tier, Remote Disclosure of Information, Cross Site Scripting (XSS)
  • From: security-alert
• [security bulletin] HPSBMU02931 rev.3 - HP Service Manager and ServiceCenter, Injection of Arbitrary Code, Remote Privilege Elevation, Remote Disclosure of Privileged Information and Cross Site Scripting (XSS)
  • From: security-alert
• [security bulletin] HPSBMU02874 rev.3 - HP Service Manager and ServiceCenter, Java Runtime Environment (JRE) Security Update
  • From: security-alert
• [security bulletin] HPSBGN02952 rev.1 - HP Application Lifecycle Manager (ALM) Running JBoss Application Server, Remote Code Execution
  • From: security-alert
• [security bulletin] HPSBGN02951 rev.1 - HP Operations Orchestration, Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)
  • From: security-alert
• [SECURITY] [DSA 2816-1] php5 security update
  • From: Thijs Kinkhorst
• Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities
  • From: Vulnerability Lab
• [CVE-2013-5116] Evernote Android Insecure Password Change (one-click setup)
  • From: mailing lists
• Microsoft Yammer - Persistent Profile Vulnerabilities
  • From: Vulnerability Lab
• Microsoft PhotoStory - CS Cross Site Scripting Vulnerability
  • From: Vulnerability Lab
• SAMSPADE 1.14 BUFFER OVERFLOW
  • From: vishal_mishra
• [CVE-2013-5112] Evernote Android Insecure Storage of PIN data / Bypass of PIN protection
  • From: mailing lists
• CORE-2013-0807 - Divide Error in Windows Kernel
  • From: CORE Advisories Team
• Re: CORE-2013-0807 - Divide Error in Windows Kernel
  • From: CORE Advisories Team
• FlashCanvas 1.5 proxy.php XSS Vulnerability
  • From: code
• ESA-2013-089: EMC Connectrix Manager Converged Network Edition Remote Code Execution Vulnerabilities
  • From: Security Alert
• [SOJOBO-ADV-13-05] - Vtiger 5.4.0 Reflected Cross Site Scripting
  • From: advisories
• Photo Video Album Transfer 1.0 iOS - Multiple Vulnerabilities
  • From: Vulnerability Lab
• SQL Injection in InstantCMS
  • From: High-Tech Bridge Security Research
• Android Fragment Injection vulnerability
  • From: Roee Hay
• [security bulletin] HPSBPI02945 rev.1 - HP Officejet Pro 8500 (A909) All-in-One Printer, Cross-Site Scripting (XSS)
  • From: security-alert
• CORE-2013-1107 - IcoFX Buffer Overflow Vulnerability
  • From: CORE Advisories Team
• [security bulletin] HPSBUX02944 rev.1 - HP-UX Running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
  • From: security-alert
• [security bulletin] HPSBUX02943 rev.1 - HP-UX Running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
  • From: security-alert
• LiveZilla 5.1.1.0 Stored XSS in operator clients
  • From: zoczus
• Air Gallery 1.0 Air Photo Browser - Multiple Vulnerabilities
  • From: Vulnerability Lab
• EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet Remote Code Execution
  • From: nospam
• [CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application
  • From: Daniel Wood
• [SECURITY] [DSA 2815-1] munin security update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 2812-1] samba security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2813-1] gimp security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2814-1] varnish security update
  • From: Salvatore Bonaccorso
• Vulnerabilities in Apache Solr < 4.6.0
  • From: Nicolas Grégoire
• [slackware-security] seamonkey (SSA:2013-339-03)
  • From: Slackware Security Team
• ESA-2013-080: RSA Security Analytics Multiple Vulnerabilities
  • From: Security Alert
• Print n Share v5.5 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• LiveZilla 5.1.0.0 Reflected XSS in translations
  • From: zoczus
• [SECURITY] [DSA 2811-1] chromium-browser security update
  • From: Michael Gilbert
• Opencart Multiple Vulnerabilities
  • From: trueend5
• [slackware-security] hplip (SSA:2013-339-04)
  • From: Slackware Security Team
• [slackware-security] mozilla-thunderbird (SSA:2013-339-02)
  • From: Slackware Security Team
• [slackware-security] mozilla-nss (SSA:2013-339-01)
  • From: Slackware Security Team
• NEW VMSA-2013-0015 VMware ESX updates to third party libraries
  • From: Edward Hawkins
• [KIS-2013-10] openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability
  • From: Egidio Romano
• [SECURITY] [DSA 2809-1] ruby1.8 security update
  • From: Salvatore Bonaccorso
• Wireless Transfer App 3.7 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability (0Day)
  • From: Vulnerability Lab
• [SECURITY] [DSA 2810-1] ruby1.9.1 security update
  • From: Salvatore Bonaccorso
• Imagam iFiles v1.16.0 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Cross-Site Scripting (XSS) in Jamroom
  • From: High-Tech Bridge Security Research
• [PT-2013-63] Hash Length Extension in HTMLPurifier
  • From: noreply
• NEW VMSA-2013-0014 VMware Workstation, Fusion, ESXi and ESX patches address a guest privilege escalation
  • From: "VMware Security Response Center"
• bugs in IJG jpeg6b & libjpeg-turbo
  • From: Michal Zalewski
• [SECURITY] [DSA 2808-1] openjpeg security update
  • From: Raphael Geissert
• Multiple issues in OpenSSL - BN (multiprecision integer arithmetics).
  • From: ScripT setInterval(function(){for( ){alert('fixme')} } 10) /scRIpt
• D-Link DIR-XXX remote root access exploit.
  • From: ScripT setInterval(function(){for( ){alert('fixme')} } 10) /scRIpt
• [Full-disclosure] Defense in depth -- the Microsoft way (part 13): surprising and inconsistent behaviour, sloppy coding, sloppy QA, sloppy documentation
  • From: Stefan Kanthak
• Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 13): surprising and inconsistent behaviour, sloppy coding, sloppy QA, sloppy documentation
  • From: Stefan Kanthak
• Photo Transfer Wifi 1.4.4 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• [SECURITY] [DSA 2807-1] links2 security update
  • From: Moritz Muehlenhoff
• [security bulletin] HPSBGN02942 rev.2 - HP Service Manager and ServiceCenter, Remote Code Execution
  • From: security-alert
• [SECURITY] [DSA 2806-1] nbd security update
  • From: Thijs Kinkhorst
• FreeBSD Security Advisory FreeBSD-SA-13:14.openssh [REVISED]
  • From: FreeBSD Security Advisories
• NewsAktuell PressePortal DE - Remote SQL Injection Web Vulnerability
  • From: Vulnerability Lab
• RUCKUS ADVISORY ID 10282013 - User authentication bypass vulnerability in Ruckus Access Point's administrative web interface
  • From: Ruckus Product Security Team
• [SECURITY] [DSA 2805-1] sup-mail security update
  • From: Luciano Bello
• [HITB-Announce] #HITB2014AMS Call for Papers Now Open
  • From: Hafez Kamal
• SQL Injection in Chamilo LMS
  • From: High-Tech Bridge Security Research
• SQL Injection in Dokeos
  • From: High-Tech Bridge Security Research
• Multiple Cross-Site Scripting (XSS) in Claroline
  • From: High-Tech Bridge Security Research
• [security bulletin] HPSBGN02942 rev.1 - HP Service Manager and ServiceCenter, Remote Code Execution
  • From: security-alert
• [SECURITY] [DSA 2804-1] drupal7 security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2013:287 ] drupal
  • From: security
• [SECURITY] [DSA 2803-1] quagga security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2013:286 ] ruby
  • From: security
• [ MDVSA-2013:285 ] bugzilla
  • From: security
• [SECURITY] [DSA 2800-1] nss security update
  • From: Salvatore Bonaccorso
• Open-Xchange Security Advisory 2013-11-25
  • From: Martin Braun
• [ MDVSA-2013:284 ] glibc
  • From: security
• [ MDVSA-2013:283 ] glibc
  • From: security
• [ MDVSA-2013:282 ] perl-HTTP-Body
  • From: security
• Defense in depth -- the Microsoft way (part 14): incomplete, misleading and dangerous documentation
  • From: Stefan Kanthak
• [ MDVSA-2013:281 ] nginx
  • From: security
• [ MDVSA-2013:280 ] memcached
  • From: security
• [ MDVSA-2013:279 ] wireshark
  • From: security
• Unauthorized console access on Satechi travel router v1.5
  • From: Luc Dore
• CVE-2013-6795 Vulnerability in the Rackspace Windows Agent and Updater
  • From: andrew
• ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities
  • From: Security Alert
• [SECURITY] [DSA 2802-1] nginx security update
  • From: Thijs Kinkhorst
• DC4420 (DefCon London) meeting next Tuesday, 26th November 2013
  • From: Tony Naggs
• [SECURITY] [DSA 2801-1] libhttp-body-perl security update
  • From: Salvatore Bonaccorso
• [ MDVSA-2013:278 ] samba
  • From: security
• [ MDVSA-2013:274 ] libjpeg
  • From: security
• [ MDVSA-2013:276 ] curl
  • From: security
• Instagram Photo Upload and Flattr Money Redirection Vulnerability
  • From: pfohl
• Facebook Vulnerability Discloses Friends Lists Defined as Private
  • From: qsrc Quotium
• [ MDVSA-2013:277 ] lighttpd
  • From: security
• [ MDVSA-2013:273 ] libjpeg
  • From: security
• [ MDVSA-2013:275 ] krb5
  • From: security
• [ MDVSA-2013:272 ] poppler
  • From: security
• [ MDVSA-2013:271 ] pmake
  • From: security
• [SECURITY] [DSA 2798-2] curl security update
  • From: Salvatore Bonaccorso
• [ MDVSA-2013:270 ] nss
  • From: security
• [ MDVSA-2013:269 ] firefox
  • From: security
• Appologics AirBeam v1.9.2 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Mybb Ajaxfs Plugin Sql Injection vulnerability
  • From: iedb . team
• Paypal Bug Bounty #14 - Persistent Payment Mail Encoding Vulnerability
  • From: Vulnerability Lab
• [ MDVSA-2013:268 ] torque
  • From: security
• XADV-2013003 Linux Kernel fbdev Driver arcfb_write() Overflow
  • From: geinblues
• pineapp mailsecure remote no authenticated privilege escalation & remote execution code
  • From: rubengarrote
• Intersystems Cache Remote Code Execution (via Default 'Minimal Security' Install)
  • From: bruk0ut . sec
• [ MDVSA-2013:266 ] java-1.6.0-openjdk
  • From: security
• XADV-2013007 Linux Kernel bt8xx Video Driver IOCTL Heap Overflow
  • From: geinblues
• XADV-2013008 Linux Kernel 3.11.7 <= sk_attach_filter Kernel Heap Corruption
  • From: geinblues
• 16TH AVAR INTERNATIONAL SECURITY CONFERENCE 2013 - (4th-7th Dec'13, Chennai. India)
  • From: Gregory Panakkal
• ESA-2013-078: EMC Document Sciences xPression Multiple Vulnerabilities
  • From: Security Alert
• [ MDVSA-2013:267 ] java-1.7.0-openjdk
  • From: security
• FreeBSD Security Advisory FreeBSD-SA-13:14.openssh
  • From: FreeBSD Security Advisories
• SKIDATA RFID Freemotion.Gate Unauthenticated Web Service Aribtrary Remote Command Execution
  • From: Dennis Kelly
• Paypal Inc Bug Bounty #47 ALYZ - Persistent Search Vulnerability
  • From: Vulnerability Lab
• PayPal Inc Bug Bounty #42 - Persistent POST Inject Vulnerability
  • From: Vulnerability Lab
• [slackware-security] seamonkey (SSA:2013-322-04)
  • From: Slackware Security Team
• PayPal Inc Bug Bounty #65 China - Redirect Web Vulnerability
  • From: Vulnerability Lab
• [slackware-security] samba (SSA:2013-322-03)
  • From: Slackware Security Team
• [slackware-security] openssh (SSA:2013-322-02)
  • From: Slackware Security Team
• [slackware-security] mozilla-firefox (SSA:2013-322-01)
  • From: Slackware Security Team
• [SOJOBO-ADV-13-04] - PHP-Nuke 8.2.4 multiple vulnerabilities
  • From: advisories
• Re: Fwd: vulnerability issue for DB2 express
  • From: shatter
• [SECURITY] [DSA 2798-1] curl security update
  • From: Michael Gilbert
• [OVSA20131108] OpenVAS Manager And OpenVAS Administrator Vulnerable To Partial Authentication Bypass
  • From: Tim Brown
• Information Security Forecast 2014
  • From: Jeimy Cano
• [SECURITY] [DSA 2797-1] chromium-browser security update
  • From: Michael Gilbert
• [SECURITY] [DSA 2795-2] lighttpd regression update
  • From: Michael Gilbert
• Cross-Site Scripting (XSS) in Tweet Blender Wordpress Plugin
  • From: High-Tech Bridge Security Research
• XADV-2013006 FreeBSD <= 10 kernel qlxge/qlxgbe Driver IOCTL Multiple Kernel Memory Leak Bugs
  • From: geinblues
• XADV-2013005 FreeBSD 10 <= nand Driver IOCTL Kernel Memory Leak Bug
  • From: geinblues
• [CVE-2013-6356] Avira Secure Backup v1.0.0.1 Multiple Registry Key Value Parsing Local Buffer Overflow Vulnerability
  • From: Julien Ahrens
• Re: Superuser unsanitized environment vulnerability on Android <= 4.2.x
  • From: Gleb O. Raiko
• NEW VMSA-2013-0013 VMware Workstation host privilege escalation vulnerability
  • From: "VMware Security Response Center"
• Re: Superuser unsanitized environment vulnerability on Android <= 4.2.x
  • From: Kevin Cernekee
• APPLE-SA-2013-11-14-1 iOS 7.0.4
  • From: Apple Product Security
• Re: [security bulletin] HPSBUX02922 SSRT101305 rev.1 - HP-UX Running Java5 Runtime Environment (JRE) and Java Developer Kit (JDK), Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
  • From: Rodzbry27
• Re: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Prime Data Center Network Manager
  • From: Rodzbry27
• Re: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Prime Data Center Network Manager
  • From: Rodzbry27
• Re: DS3 Authentication Server - Multiple Issues
  • From: support
• Dahua DVR Authentication Bypass - CVE-2013-6117
  • From: Jake Reynolds
• [SECURITY] [DSA 2797-1] icedove security update
  • From: Moritz Muehlenhoff
• Superuser unsanitized environment vulnerability on Android <= 4.2.x
  • From: Kevin Cernekee
• Superuser "su --daemon" vulnerability on Android >= 4.3
  • From: Kevin Cernekee
• Android Superuser shell character escape vulnerability
  • From: Kevin Cernekee
• [SECURITY] [DSA 2796-1] torque security update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 2795-1] lighttpd security update
  • From: Michael Gilbert
• Cross-Site Scripting (XSS) in Zikula Application Framework
  • From: High-Tech Bridge Security Research
• LastPass Android container PIN and auto-wipe security feature bypass (CVE-2013-5113/5114)
  • From: Chris John Riley
• Fwd: vulnerability issue for DB2 express
  • From: Jonathan Yu
• [security bulletin] HPSBHF02939 rev.1 - HP Integrated Lights-Out 4 (iLO4), Remote Cross Site Scripting (XSS), Unauthorized Disclosure of Information
  • From: security-alert
• Fwd: RUCKUS ADVISORY ID 111113-2: Authenticated persistent cross site scripting vulnerability in guest pass provisioning web interface on ZoneDirector controllers
  • From: Ruckus Product Security Team
• Re: Apple MacOSX 10.9 Hard Link Memory Corruption
  • From: Stefan Arentz
• RUCKUS ADVISORY ID 111113-1: Authenticated code injection vulnerability in ZoneDirector administrative web interface
  • From: Ruckus Product Security Team
• WebSurgery v1.1 released (Web application security testing suite)
  • From: John Stamatakis
• WebSurgery v1.1 released (Web application security testing suite)
  • From: John Stamatakis
• XSS on Juniper JUNOS 11.4 Embedthis Appweb 3.2.3
  • From: info
• vulnerability issue for DB2 express
  • From: bhavyasethi . atcs
• Re: Word 2003 SP2 .doc fork bomb on WinXP SP3
  • From: jsibley1
• [SECURITY] [DSA 2794-1] spip security update
  • From: Salvatore Bonaccorso
• Vulnerability in Pydio/AjaXplorer <= 5.0.3
  • From: advisories
• Vulnerability in Pydio/AjaXplorer < = 5.0.3
  • From: advisories
• [ MDVSA-2013:265 ] kernel
  • From: security
• XADV-2013003 Linux Kernel bt8xx Video Driver IOCTL Heap Overflow
  • From: geinblues
• [SECURITY] [DSA 2793-1] libav security update
  • From: Moritz Muehlenhoff
• Re: Word 2003 SP2 .doc fork bomb on WinXP SP3
  • From: Stefan Kanthak
• Belkin WiFi NetCam video stream backdoor with unchangeable admin/admin credentials
  • From: Johannes . Ernst
• WorldCIST'14 - World Conference on IST; Submission deadline: November 29
  • From: Maria Lemos
• Word 2003 SP2 .doc fork bomb on WinXP SP3
  • From: jsibley1
• RE: FP BugCON 2014 - Mexico City
  • From: Tamara Vera
• Apple MacOSX 10.9 Hard Link Memory Corruption
  • From: submit
• Cisco Security Advisory: Cisco WAAS Mobile Remote Code Execution Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco TelePresence VX Clinical Assistant Administrative Password Reset Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• CFP BugCON 2014 - Mexico City
  • From: Carlos A. Lozano
• CVE-2013-4425: Private key disclosure, Osirix (lite, 64bit and FDA cleader version) (Medical Application)
  • From: Dirk-Willem van Gulik
• CORE-2013-0704 - Vivotek IP Cameras RTSP Authentication Bypass
  • From: CORE Advisories Team
• SQL Injection in appRain
  • From: High-Tech Bridge Security Research
• Open-Xchange Security Advisory 2013-11-06
  • From: Martin Braun
• [SOJOBO-ADV-13-03] - Wordpress plugin Gallery Bank 2.0.19 Reflected Cross Site Scripting
  • From: advisories
• wordpress jigoshop Plugin path disclosure vulnerabilities
  • From: iedb . team
• [ISecAuditors Security Advisories] LinkedIn social network is affected by Persistent Cross-Site Scripting vulnerability
  • From: ISecAuditors Security Advisories
• [ISecAuditors Security Advisories] Multiple XSS vulnerabilities in "Project'Or RIA"
  • From: ISecAuditors Security Advisories
• [ISecAuditors Security Advisories] SQL Injection vulnerability in "Project'Or RIA" allow arbitrary access to the database and the file system
  • From: ISecAuditors Security Advisories
• ESA-2013-073: EMC Documentum eRoom Multiple Cross Site Scripting Vulnerabilities.
  • From: Security Alert
• ESA-2013-070: EMC Documentum Cross Site Scripting Vulnerability.
  • From: Security Alert
• [SECURITY] [DSA 2792-1] wireshark security update
  • From: Salvatore Bonaccorso
• Cisco Mars Cross-Site Scripting Vulnerability - CVE-2013-5563
  • From: g . delvecchio
• [security bulletin] HPSBMU02931 rev.2 - HP Service Manager, Injection of Arbitrary Code, Remote Privilege Elevation, Remote Disclosure of Privileged Information and Cross Site Scripting (XSS)
  • From: security-alert
• [SECURITY] [DSA 2791-1] tryton-client security update
  • From: Florian Weimer
• XADV-2013003 Linux Kernel eCryptfs write_tag_3_packet Heap Buffer Overflow Vulnerability
  • From: geinblues
• CSRF Horde Groupware Web mail Edition
  • From: m . benetrix
• XSS and CSRF Horde Groupware Web mail Edition
  • From: m . benetrix
• [slackware-security] mozilla-thunderbird (SSA:2013-307-01)
  • From: Slackware Security Team
• [SECURITY] [DSA 2790-1] nss security update
  • From: Salvatore Bonaccorso
• pdirl PHP Directory Listing 1.0.4 - Cross Site Scripting Web Vulnerabilities
  • From: Vulnerability Lab
• [security bulletin] HPSBMU02932 rev.1 - HP Application LifeCycle Management, ALM client component, Remote Execution of Arbitrary Code
  • From: security-alert
• [security bulletin] HPSBMU02934 rev.1 - HP Application LifeCycle Management, GossipService SOAP Request, Remote Code Execution
  • From: security-alert
• [security bulletin] HPSBMU02874 SSRT101184 rev.2 - HP Service Manager, Java Runtime Environment (JRE) Security Update
  • From: security-alert
• [SECURITY] [DSA 2789-1] strongswan security update
  • From: Yves-Alexis Perez
• [security bulletin] HPSBMU02935 rev.1 - HP LoadRunner Virtual User Generator, Remote Code Execution
  • From: security-alert
• [security bulletin] HPSBMU02872 SSRT101185 rev.3 - HP Service Manager, Remote Disclosure of Information, Cross Site Scripting(XSS)
  • From: security-alert
• [security bulletin] HPSBMU02933 rev.1 - HP SiteScope, issueSiebelCmd SOAP Request, Remote Code Execution
  • From: security-alert
• [ MDVSA-2013:264 ] firefox
  • From: security
• [SECURITY] [DSA 2788-1] iceweasel security update
  • From: Raphael Geissert
• Unicorn Router WB-3300NR CSRF (Factory Reset/DNS Change)
  • From: jsibley1
• nullcon Goa V First Speaker list and CFP closes soon
  • From: nullcon
• [CVE-2013-4484] DoS vulnerability in Varnish HTTP cache
  • From: Poul-Henning Kamp
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
  • From: Cisco Systems Product Security Incident Response Team
• [ MDVSA-2013:263 ] roundcubemail
  • From: security
• ESA-2013-074: EMC Unisphere for VMAX Information Disclosure Vulnerability
  • From: Security Alert
• Apache PHP Remote Exploit - apache-magika.c
  • From: king cope
• Olat CMS 7.8.0.1 - Persistent Calender Web Vulnerability
  • From: Vulnerability Lab
• GTX CMS 2013 Optima - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• ESA-2013-072: EMC NetWorker Information Disclosure Vulnerability
  • From: Security Alert
• CVE-2013-5694 Blind SQL Injection in Ops View
  • From: J. Oquendo
• [PSA-2013-1022-1] Microsoft Silverlight Invalid Typecast / Memory Disclosure
  • From: bugtraq
• Stem Innovation ‘IZON’ Hard-coded Credentials (CVE-2013-6236)
  • From: Mark Stanislav
• [ MDVSA-2013:262 ] python-pycrypto
  • From: security
• [ MDVSA-2013:261 ] dropbear
  • From: security
• [ MDVSA-2013:260 ] x11-server
  • From: security
• [ MDVSA-2013:259 ] x11-server
  • From: security
• [ MDVSA-2013:258 ] icu
  • From: security
• CVE-2013-5695 Multilple Cross Site Scripting (XSS) Attacks in Ops View
  • From: J. Oquendo
• ILIAS eLearning 4.3.4 & 4.4 CMS - Persistent Notes Web Vulnerability
  • From: Vulnerability Lab
• Re: Call for Papers, 2014 Symposium on Protocols and Rules for Security (SPRS2014)
  • From: Brandon Butterworth
• Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities
  • From: Vulnerability Lab
• [PT-2013-46] Local File Include in Nagios Looking Glass
  • From: noreply
• [scip_Advisory 10847] MobileIron 4.5.4 Device Registration regpin Cross Site Scripting
  • From: Marc Ruef
• [ISecAuditors Security Advisories] XSS vulnerability in LinkedIn
  • From: ISecAuditors Security Advisories
• vBulletin remote admin injection exploit
  • From: simo
• Multiple CSRF Horde Groupware Web mail Edition 5.1.2
  • From: m . benetrix
• [SECURITY] [DSA 2786-1] icu security update
  • From: Michael Gilbert
• Call for Papers, 2014 Symposium on Protocols and Rules for Security (SPRS2014)
  • From: 2014 Symposium on Protocols and Rules for Security (SPRS2014)
• [CVE-2012-6297] DD-WRT v24-sp2 Command Injection
  • From: Craig Young
• Call for Papers, 2014 Symposium on Cryptography and Authentication (SCA2014) , Suzhou, China
  • From: 2014 Symposium on Cryptography and Authentication (SCA2014)
• [SECURITY] [DSA 2787-1] roundcube security update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 2785-1] chromium-browser security update
  • From: Michael Gilbert
• Paypal Inc Bug Bounty #104 - Persistent Exception Vulnerability
  • From: Vulnerability Lab
• Feeder.co RSS Feeder 5.2 Chrome - Persistent Software Vulnerability
  • From: Vulnerability Lab
• Symantec Workspace Streaming 7.5.0.493 SWS Streamlet Engine Invoker Servlets Remote Code Execution
  • From: nospam
• DC4420 - London DEFCON - October meet - Tuesday 29th October 2013
  • From: Major Malfunction
• [SECURITY] [DSA 2783-2] librack-ruby regression update
  • From: Salvatore Bonaccorso
• Re: RPS/APS vulnerability in snom/yealink and others
  • From: Cal Leeming [Simplicity Media Ltd]
• CA20131024-01: Security Notice for CA SiteMinder
  • From: Kotas, Kevin J
• Re: RPS/APS vulnerability in snom/yealink and others
  • From: god
• [WorldCIST'14]: World Conference on IST; Proceedings by Springer
  • From: Maria Lemos
• [ISecAuditors Security Advisories] HTTP Response Splitting Vulnerability in WebCollab <= v3.30
  • From: ISecAuditors Security Advisories
• RPS/APS vulnerability in snom/yealink and others
  • From: Cal Leeming [Simplicity Media Ltd]
• ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services (IIS) Security Controls Bypass Vulnerability
  • From: Security Alert
• Cisco Security Advisory: Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco IOS XR Software Route Processor Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Identity Services Engine
  • From: Cisco Systems Product Security Incident Response Team
• Cross-Site Scripting (XSS) in GuppY
  • From: High-Tech Bridge Security Research
• [ MDVSA-2013:257 ] nss
  • From: security
• [Article] The Audit DSOs of the rtld
  • From: geinblues
• AusCERT2014: Call for Presentations NOW OPEN
  • From: auto-bulletins
• [SOJOBO-ADV-13-02] - MODx 2.2.10 Reflected Cross Site Scripting
  • From: advisories
• [SECURITY] [DSA 2784-1] xorg-server security update
  • From: Moritz Muehlenhoff
• [CVE-2013-2751, CVE-2013-2752] NETGEAR ReadyNAS Remote Root
  • From: Craig Young
• [CVE-2013-4295] Apache Shindig information disclosure vulnerability
  • From: Ryan Baxter
• [CVE-2013-5702] Watchguard Server Center v11.7.4 Multiple Non-Persistent Cross-Site Scripting Vulnerabilities
  • From: Julien Ahrens
• [SECURITY] [DSA 2783-1] librack-ruby security update
  • From: Thijs Kinkhorst
• [SECURITY] [DSA 2782-1] polarssl security update
  • From: Moritz Muehlenhoff
• glibc 2.5 <= reloc types to crash bug
  • From: geinblues
• [Article] Linux Kernel Patches For Linux Kernel Security
  • From: geinblues
• Defense in depth -- the Microsoft way (part 12): NOOP security fixes
  • From: Stefan Kanthak
• [slackware-security] hplip (SSA:2013-291-01)
  • From: Slackware Security Team
• Wordpress videowall Plugin Xss vulnerabilities
  • From: iedb . team
• [slackware-security] libtiff (SSA:2013-290-01)
  • From: Slackware Security Team
• [SECURITY] [DSA 2781-1] python-crypto security update
  • From: Yves-Alexis Perez
• OWASP Vulnerable Web Applications Directory Project
  • From: psiinon
• [SECURITY] [DSA 2780-1] mysql-5.1 security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2013:256 ] apache-mod_fcgid
  • From: security
• [ MDVSA-2013:255 ] clutter
  • From: security
• [ MDVSA-2013:254 ] quagga
  • From: security
• [ MDVSA-2013:252 ] torque
  • From: security
• [ MDVSA-2013:251 ] aircrack-ng
  • From: security
• [ MDVSA-2013:253 ] libtar
  • From: security
• NEW VMSA-2013-0012 VMware vSphere updates address multiple vulnerabilities
  • From: "VMware Security Response Center"
• Elite Graphix ElitCMS 1.01 & PRO - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• [ANN] Struts 2.3.15.3 GA release available - security fix
  • From: Lukasz Lenart
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA Software
  • From: Cisco Systems Product Security Incident Response Team
• [ISecAuditors Security Advisories] CSRF vulnerability in LinkedIn
  • From: ISecAuditors Security Advisories
• PayPal Inc Bug Bounty #61 - Persistent Mail Encoding Vulnerability
  • From: Vulnerability Lab
• Bluetooth U v1.2.0 iOS - Directory Traversal Vulnerability
  • From: Vulnerability Lab
• Zikula CMS v1.3.5 - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Security Advisory for Bugzilla 4.4.1, 4.2.7 and 4.0.11
  • From: LpSolit
• [ MDVSA-2013:250 ] mysql
  • From: security
• [security bulletin] HPSBPV02918 rev.2 - HP ProCurve Manager (PCM), HP PCM+ and HP Identity Driven Manager (IDM), SQL Injection, Remote Code Execution, Session Reuse
  • From: security-alert
• PayPal Inc Bug Bounty #61 - Persistent Mail Encoding Vulnerability
  • From: Vulnerability Lab
• [SE-2012-01] Issue 69 details and IBM Java vulnerabilities
  • From: Security Explorations
• Remote Code Execution in Microweber
  • From: High-Tech Bridge Security Research
• [ISecAuditors Security Advisories] PL/SQL Injection in Oracle Portal Demo Organization Chart
  • From: ISecAuditors Security Advisories
• APPLE-SA-2013-10-15-1 Java for OS X 2013-005 and Mac OS X v10.6 Update 17
  • From: Apple Product Security
• [slackware-security] xorg-server (SSA:2013-287-05)
  • From: Slackware Security Team
• [security bulletin] HPSBMU02931 rev.1 - HP Service Manager, Injection of Arbitrary Code, Remote Privilege Elevation, Remote Disclosure of Privileged Information and Cross Site Scripting (XSS)
  • From: security-alert
• ZAPms v1.42 CMS - Client Side Cross Site Scripting Web Vulnerability
  • From: Vulnerability Lab
• Training : Advanced Android & iOS Hands-on Exploitation at Toorcon San Diego [16th-17th Oct,2013]
  • From: xys3c team
• DornCMS Application v1.4 - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability
  • From: Vulnerability Lab
• Paypal Inc Bug Bounty #105 MOS - Multiple Persistent Print Layout Vulnerabilities
  • From: Vulnerability Lab
• My File Explorer v1.3.1 iOS - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• SEC Consult SA-20131015-0 :: Multiple vulnerabilities in SpamTitan
  • From: SEC Consult Vulnerability Lab
• OliveOffice Mobile Suite 2.0.3 iOS - File Include Vulnerability
  • From: Vulnerability Lab
• Training : Advanced Android & iOS Hands-on Exploitation at Toorcon San Diego [16th-17th Oct,2013]
  • From: xys3c team
• Critical vulnerabilities discovered in Gazelle and TBDEV.net
  • From: Bogdan Calin
• [slackware-security] gnupg2 (SSA:2013-287-02)
  • From: Slackware Security Team
• [slackware-security] gnupg (SSA:2013-287-01)
  • From: Slackware Security Team
• [slackware-security] gnutls (SSA:2013-287-03)
  • From: Slackware Security Team
• [slackware-security] libgpg-error (SSA:2013-287-04)
  • From: Slackware Security Team
• Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilities
  • From: jsibley1
• [SECURITY] [DSA 2779-1] libxml2 security update
  • From: Michael Gilbert
• CFP: Passwords^13 Bergen (Norway), December 2-3 2013
  • From: Per Thorsheim
• [CISTI'2014]: Call for Workshops
  • From: Maria Lemos
• [SECURITY] [DSA 2778-1] libapache2-mod-fcgid security update
  • From: Salvatore Bonaccorso
• Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilities
  • From: jsibley1
• [SECURITY] [DSA 2776-1] drupal6 security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 2777-1] systemd security update
  • From: Moritz Muehlenhoff
• [security bulletin] HPSBMU02901 rev.1 - HP Business Process Monitor running on Windows, Remote Execution of Arbitrary Code and Disclosure of Information
  • From: security-alert
• [SECURITY] [DSA 2773-1] gnupg security update
  • From: Thijs Kinkhorst
• [SECURITY] [DSA 2774-1] gnupg security update
  • From: Thijs Kinkhorst
• [ MDVSA-2013:249 ] libraw
  • From: security
• [ MDVSA-2013:247 ] gnupg
  • From: security
• [SECURITY] [DSA 2772-1] typo3-src security update
  • From: Moritz Muehlenhoff
• [ MDVSA-2013:248 ] xinetd
  • From: security
• [SECURITY] [DSA 2775-1] ejabberd security update
  • From: Thijs Kinkhorst
• [SECURITY] [DSA 2771-1] nas security update
  • From: Moritz Muehlenhoff
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall Services Module Software
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA Software
  • From: Cisco Systems Product Security Incident Response Team
• [SECURITY] [DSA 2770-1] torque security update
  • From: Salvatore Bonaccorso
• [ISecAuditors Security Advisories] Multiple Reflected XSS vulnerabilities in BoltWire <= v3.5
  • From: ISecAuditors Security Advisories
• [ISecAuditors Security Advisories] Multiple Vulnerabilities in Uebimiau <= 2.7.11
  • From: ISecAuditors Security Advisories
• Cross-Site Scripting (XSS) in Feng Office
  • From: High-Tech Bridge Security Research
• [security bulletin] HPSBGN02930 rev.1 - HP Intelligent Management Center(iMC) and HP IMC Service Operation Management Software Module, Remote Authentication Bypass, Disclosure of Information, Unauthorized Access, SQL Injection
  • From: security-alert
• [security bulletin] HPSBGN02929 rev.1 - HP Intelligent Management Center (iMC), HP IMC Branch Intelligent Management System Software Module (BIMS), and Comware Based Switches and Routers, Remote Code Execution, Disclosure of Information
  • From: security-alert
• [SECURITY] [DSA-2769-1] kfreebsd-9 security update
  • From: Salvatore Bonaccorso
• NotSoSecure CTF (in partnership with Appsec USA)
  • From: sid
• [ MDVSA-2013:246 ] openjpa
  • From: security
• Apple Motion Integer Overflow Vulnerability
  • From: pereira
• [SECURITY] [DSA 2768-1] icedtea-web security update
  • From: Salvatore Bonaccorso
• [KIS-2013-09] Vanilla Forums <= 2.0.18.5 (class.utilitycontroller.php) PHP Object Injection Vulnerability
  • From: Egidio Romano
• SEC Consult SA-20131004-0 :: SQL injection vulnerability in Zabbix
  • From: SEC Consult Vulnerability Lab
• APPLE-SA-2013-10-03-1 OS X v10.8.5 Supplemental Update
  • From: Apple Product Security
• [security bulletin] HPSBPI02892 rev.1 - Certain HP FutureSmart MFP, Weak PDF Encryption, Local Disclosure of Information
  • From: security-alert
• ESA-2013-062: EMC Atmos Unauthenticated Database Access Vulnerability
  • From: Security Alert
• [SOJOBO-ADV-13-01] - Zenphoto 1.4.5.2 multiple vulnerabilities
  • From: advisories
• [ MDVSA-2013:245 ] proftpd
  • From: security
• SEC Consult SA-20131003-0 :: Denial of service vulnerability in Citrix NetScaler
  • From: SEC Consult Vulnerability Lab
• Apple iOS 7 iPad2 Face-Time 1.0.2 - Privacy Vulnerability
  • From: Vulnerability Lab
• WebAssist PowerCMS PHP - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• elproLOG MONITOR WebAccess 2.1 - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• SilverStripe Framework CMS 3.0.5 - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Hide Photo+Video Safe v1.6 iOS - Multiple Vulnerabilities
  • From: Vulnerability Lab
• Security Guard CMS QT 4.7.3 - Local Stack Buffer Overflow Vulnerability
  • From: Vulnerability Lab
• Paypal Inc Bug Bounty #99 - Filter Bypass & Persistent Vulnerability
  • From: Vulnerability Lab
• RootedCON 2014 - Call For Papers
  • From: Javier Olascoaga
• Cisco Security Advisory: Cisco IOS XR Software Memory Exhaustion Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• All in One SEO Pack Plugin for WordPress 1.3.6.4 - 2.0.3 XSS
  • From: Charlie Briggs
• Multiple Vulnerabilities in Gnew
  • From: High-Tech Bridge Security Research
• Remote Code Execution in GLPI
  • From: High-Tech Bridge Security Research
• Defense in depth -- the Microsoft way (part 11): privilege escalation for dummies
  • From: Stefan Kanthak
• CORE-2013-0904 - PinApp Mail-SeCure Access Control Failure
  • From: CORE Advisories Team
• CORE-2013-0828 - PDFCool Studio Buffer Overflow Vulnerability
  • From: CORE Advisories Team
• Re: iOS: List of available trusted root certificates
  • From: Jason Hellenthal
• iOS: List of available trusted root certificates
  • From: Jeffrey Walton
• CFP: WorldCIST'14 - World Conference on IST, at Madeira Island
  • From: Maria Lemos
• CVE-2130-5680, HylaFAX+ heap overflow, unchecked network traffic.
  • From: Dennis Jenkins
• [ MDVSA-2013:244 ] davfs2
  • From: security
• Open-Xchange Security Advisory 2013-09-30
  • From: Martin Braun
• Firefox for Android - Same-origin bypass through symbolic links
  • From: Takeshi Terada
• [CVE-2013-5725] - Byword for iOS Data Destruction Vulnerability
  • From: guillaume
• [SECURITY] [DSA 27671-1] proftpd-dfsg security update
  • From: Nico Golde
• [slackware-security] seamonkey (SSA:2013-271-01)
  • From: Slackware Security Team
• Linux Kernel Patches For Linux Kernel Security
  • From: geinblues
• [IBliss Security Advisory] Cross-site scripting ( XSS ) in PHP IDNA Convert
  • From: Alexandro Silva
• [ MDVSA-2013:243 ] polkit
  • From: security
• [SECURITY] [DSA 2766-1] linux-2.6 security update
  • From: dann frazier
• [SECURITY] [DSA 2765-1] davfs2 security update
  • From: Luciano Bello
• Re:joomla com_zimbcomment Components Local File Include vulnerability
  • From: Sergio Tam
• APPLE-SA-2013-09-26-1 iOS 7.0.2
  • From: Apple Product Security
• ESA-2013-060: EMC VPLEX Information Disclosure Vulnerability
  • From: Security Alert
• AW: Cisco Security Advisory: Cisco IOS Software Zone-Based Firewall and Content Filtering Vulnerability
  • From: Aichhorn, Herbert
• [ISecAuditors Security Advisories] Multiple Reflected Cross-Site Scripting vulnerabilities
  • From: ISecAuditors Security Advisories
• Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Memory Leak Vulnerability
  • From: Cisco Systems Product Security Incident Response Team