GreHack 2012 - LAST Call For Papers (Grenoble, France) till 15th August 2012

2012-08-14 Thread Fabien DUCHENE
-- *GreHack 2012* LAST Call For Papers .. till 15th August 2012. -- http://grehack.org GreHack 2012 conference will take place in Grenoble (Alps), France on October 19th-20th 2012 and brings together students,

[Announcement] ClubHack Magazine's Aug 2012 Issue Released

2012-08-14 Thread abhijeet
Hello Readers, ClubHack Magazine's Issue 31 - August 2012 is here. This issue covers following articles:- 0x00 Tech Gyan - Malware Memory Forensics 0x01 Tool Gyan - Tamper Data 0x02 Mom's Guide - Apple iOS vulnerabilities 0x03 Legal Gyan - VARIOUS AUTHORITIES UNDER THE IT ACT 0x04 Matriux

TCExam Edit SQL Injection

2012-08-14 Thread research
/---\ | TCExam Edit SQL Injection | \---/ Summary === TCExam 11.3.007 is prone to a SQL injection flaw located in tce_edit_answer.php and tce_edit_question.php. These files pass a 'subject_module_id' parameter into a SQL statement without

[security bulletin] HPSBMU02801 SSRT100879 rev.1 - HP Fortify Software Security Center, Remote Unauthenticated Disclosure of Information

2012-08-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03447824 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03447824 Version: 1 HPSBMU02801

[security bulletin] HPSBMU02802 SSRT100923 rev.1 - HP Fortify Software Security Center, Remote Disclosure of Privileged Information

2012-08-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03447895 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03447895 Version: 1 HPSBMU02802

[security bulletin] HPSBMU02800 SSRT100921 rev.1 - HP Service Manager and HP Service Center Server, Remote Denial of Service (DoS)

2012-08-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03447828 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03447828 Version: 1 HPSBMU02800

[security bulletin] HPSBMU02803 SSRT100926 rev.1 - HP Service Manager and HP Service Center Web Tier, Remote Cross Site Scripting (XSS)

2012-08-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03450382 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03450382 Version: 1 HPSBMU02803

[security bulletin] HPSBUX02805 SSRT100919 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities

2012-08-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03441075 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03441075 Version: 1 HPSBUX02805

Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities

2012-08-14 Thread Vulnerability Lab
Title: == Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities Date: = 2012-07-13 References: === http://www.vulnerability-lab.com/get_content.php?id=659 VL-ID: = 659 Common Vulnerability Scoring System: 8.3 Introduction:

Re: How well does Microsoft support (and follow) their mantra keep your PC updated?

2012-08-14 Thread Thomas D.
Hi, I am not sure if I got your point. First, winsxs is Microsoft's Windows file repository. Every part of Windows is splitted into components and packages. Every package will be copied into the winsxs folder. But the content of the winsxs folder doesn't represent the currently installed

NeoInvoice Blind SQL Injection (CVE-2012-3477)

2012-08-14 Thread Adam Caudill
NeoInvoice is a multi-tenant open source invoicing system, that currently contains an unauthenticated blind SQL injection condition in signup_check.php. The input for the value field isn't being properly sanitized, and is used in string concatenation to create the SQL query. See here for the

7sepehr CMS 2012 - Multiple SQL Injection Vulnerabilities

2012-08-14 Thread Vulnerability Lab
Title: == 7sepehr CMS 2012 - Multiple SQL Injection Vulnerabilities Date: = 2012-08-12 References: === http://www.vulnerability-lab.com/get_content.php?id=679 VL-ID: = 680 Common Vulnerability Scoring System: 8.3 Abstract:

Total Shop UK eCommerce Generic Cross-Site Scripting

2012-08-14 Thread research
/--\ | Total Shop UK eCommerce Generic Cross-Site Scripting | \--/ Summary === The open source version of Total Shop UK eCommerce based on CodeIgniter version 2.1.2 is subject to a

TCExam Edit Cross-Site Scripting

2012-08-14 Thread research
/--\ | TCExam Edit Cross-Site Scripting | \--/ Summary === TCExam 11.3.007 is subject to a cross-site scripting vulnerability. A 'question_subject_id' parameter is not sufficiently sanitised before being written to the

Group-Office Cleartext Credentials Stored in Cookies

2012-08-14 Thread research
/--\ | Group-Office Cleartext Credentials Stored in Cookies | \--/ Summary === Group-Office 4.0.71 was found to display a behaviour that could potentially expose a user's username and