VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free

2011-03-14 Thread VUPEN Security Research
VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free http://www.vupen.com/english/research.php I. BACKGROUND - Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser, with

VUPEN Security Research - Apple Safari WebKit Scroll Event Handling Remote Use-after-free

2011-03-14 Thread VUPEN Security Research
VUPEN Security Research - Apple Safari WebKit Scroll Event Handling Remote Use-after-free http://www.vupen.com/english/research.php I. BACKGROUND - Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser, with

Privacy, Security, Trust (PST 2011) - 2nd Call for Papers (Deadline: March 20)

2011-03-14 Thread Serguei A. Mokhov on behalf of PST-11
[ Apologies if you receive multiple copies of this announcement. Please pass it on to your colleagues and students who might be interested in contributing. ] Ninth Annual Conference on Privacy, Security and Trust -- July 19-21, 2011

Checkpoint VPN - Priviledge Escalation

2011-03-14 Thread Thierry Zoller
It appears this bug has gone unoticed to vulnerability databases maintainers, very likely due to the lack of disclosure/publication. This usually means it's also not in compliance/patching systems and exposes customers to unecessary risk. To counteract I'd like to drop this note.

bbPress 1.0.2 = Cross Site Scripting Vulnerability

2011-03-14 Thread YGN Ethical Hacker Group
= bbPress 1.0.2 = Cross Site Scripting Vulnerability = 1. OVERVIEW bbPress 1.0.2 and lower versions were vulnerable to Cross Site Scripting. 2. APPLICATION DESCRIPTION bbPress is plain and simple forum software,

Joomla! 1.6.0 | SQL Injection Vulnerability

2011-03-14 Thread YGN Ethical Hacker Group
= Joomla! 1.6.0 | SQL Injection Vulnerability = 1. OVERVIEW Joomla! 1.6.0 was vulnerable to SQL Injection. 2. BACKGROUND Joomla is a free and open source content management system (CMS) for publishing content on the World Wide

Joomla! 1.6.0 | Cross Site Scripting (XSS) Vulnerability

2011-03-14 Thread YGN Ethical Hacker Group
== Joomla! 1.6.0 | Cross Site Scripting (XSS) Vulnerability == 1. OVERVIEW Joomla! 1.6.0 was vulnerable to Cross Site Scripting. 2. PRODUCT DESCRIPTION Joomla is a free and open source content management system

BoutikOne Multiples SQL Injection Vulnerability

2011-03-14 Thread cdx . security
- BoutikOne - Multiples SQL Injection Vulnerability RELEASE DATE : 13.03.2011 by Alz cdx[dot]security[at]gmail[dot]com [-] Google Dork: Powered by BoutikOne [- categorie.php] Var path : http://[target]/categories.php?path=[sqli] [- list.php] Var path : http://[target]/list.php?path=[sqli] [-

ClubHACK Magazine: Call for Articles

2011-03-14 Thread abhijeet
ClubHACK Magazine is seeking for submissions for next two issues - April and May 2011. IF you have something interesting and would like to share, please send in your articles to abhij...@clubhack.com Topics/Themes for next two issues are :- 1) April issue : Browser security 2) May issue :

[DSECRG-11-009] SAP NetWaver XI SOAP Adapter - XSS

2011-03-14 Thread Alexandr Polyakov
[DSECRG-11-009] SAP NetWaver XI SOAP Adapter - XSS SAP NetWeaver 7.0 application XI SOAP Adapter has linked XSS vulnerability Digital Security Research Group [DSecRG] Advisory DSecRG-11-009 (Internal DSecRG-00120) Application: SAP NetWeaver Versions Affected: SAP NetWeaver XI SOAP

[USN-1087-1] libvpx vulnerability

2011-03-14 Thread Micah Gersten
=== Ubuntu Security Notice USN-1087-1March 11, 2011 libvpx vulnerability CVE-2010-4489 === A security issue affects the following Ubuntu releases: Ubuntu 10.10 This

[SECURITY] [DSA 2191-1] proftpd security update

2011-03-14 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2191-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff March 14, 2011

[security bulletin] HPSBMA02644 SSRT100284 rev.1 - HP Client Automation Enterprise (HPCA) Running on Windows, Remote Execution of Arbitrary Code

2011-03-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02750690 Version: 1 HPSBMA02644 SSRT100284 rev.1 - HP Client Automation Enterprise (HPCA) Running on Windows, Remote Execution of Arbitrary Code NOTICE: The information in this Security

[DCA-2011-0004] - Trend WebReputation API Bypass

2011-03-14 Thread Crash
[DCA-2011-0004] [Discussion] - DcLabs Security Research Group advises about following vulnerability(ies): [Software] - Trend WebReputation API [Vendor Product Description] - Secure any endpoint – physical or virtual – with the industry’s strongest, most reliable protection, while reducing the

[DSECRG-11-010] SAP NetWeaver logon.html - XSS

2011-03-14 Thread Alexandr Polyakov
[DSECRG-11-010] SAP NetWeaver logon.html - XSS SAP NetWeaver BSP logon page has linked XSS vulnerability. Digital Security Research Group [DSecRG] Advisory DSecRG-11-010 (Internal DSecRG-00127) Application: SAP NetWeaver Versions Affected: SAP NetWeaver SAP_BASIS 620-730