Re: [Full-disclosure] Reliable reports on attacks on medical software and IT-systems available?

2010-08-12 Thread Caspian
halfdog wrote: Paul Schmehl wrote: --On Tuesday, August 10, 2010 21:03:35 + halfdog m...@halfdog.net wrote: * There are reports, but I do not know about them (so I'm asking around) Most likely answer. I know about some, but I'm not telling you. Or anyone else for that matter. :-)

[Full-disclosure] Facebook name + photo extraction using 'Forgot Password' page

2010-08-12 Thread Rishabh Singla
Hi everyone, This is with reference to the post by Mr. Atul Agarwal dated 11-Aug-10, and posted here (http://seclists.org/fulldisclosure/2010/Aug/130), in which Mr. Atul describes how a spammer might enter email addresses and extract the names (and photos) from Facebook accounts registered

Re: [Full-disclosure] Facebook name extraction based on email/wrong password + POC

2010-08-12 Thread werew01f
Don't seems to work on my system. No user name or picture was displayed. On Wed, Aug 11, 2010 at 5:01 PM, Atul Agarwal a...@secfence.com wrote: Hello all, Sometime back, I noticed a strange problem with Facebook, I had accidentally entered wrong password in Facebook, and it showed my first

Re: [Full-disclosure] Facebook name + photo extraction using 'Forgot Password' page

2010-08-12 Thread Javier Bassi
Did you reported this? Apparently reset.php has been fixed. http://img440.imageshack.us/img440/3637/screenshotjm.png On Thu, Aug 12, 2010 at 5:06 AM, Rishabh Singla rishabhsin...@rishabhsingla.com wrote: Hi everyone, This is with reference to the post by Mr. Atul Agarwal dated 11-Aug-10, and

Re: [Full-disclosure] SQL Injection vulnerability in CMS WebManager-Pro

2010-08-12 Thread Henri Salo
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 11 Aug 2010 21:04:51 +0300 MustLive mustl...@websecurity.com.ua wrote: Hello Full-Disclosure! I want to warn you about SQL Injection vulnerability in CMS WebManager-Pro. SQL Injection:

Re: [Full-disclosure] Facebook name extraction based on email/wrong password + POC

2010-08-12 Thread Zerial.
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This bug appears in a spanish security news site: http://blog.segu-info.com.ar/2010/08/error-en-facebook-permite-extraer.html probably it was reported by someone cheers On 08/11/10 23:13, werew01f wrote: Don't seems to work on my system. No

[Full-disclosure] [ MDVSA-2010:148 ] pidgin

2010-08-12 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2010:148 http://www.mandriva.com/security/

[Full-disclosure] TGP 1.2.4 beta

2010-08-12 Thread Thor (Hammer of God)
TGP beta updated as follows: http://www.hammerofgod.com/tgp.aspx 08/07/10 v1.2.4 - Beta (RC) now including x64 bit versions. - Added single-file AES256 encryption functions for binary encryption of files outside of the TGP KeyFob/MSL framework, using user-supplied passwords instead of RSA

[Full-disclosure] Minded Security Advisory Bulletin Update July/August 2010

2010-08-12 Thread Early Warning
For your information, the following new security advisories were published by Minded Security Team during the last month: # Advisory #MSA260209: New Atlanta Servlet Exec Multiple Security Issues. http://www.mindedsecurity.com/MSA260209.html # Advisory #MSA100410: CA Oneview Monitor DoSave.jsp

Re: [Full-disclosure] Reliable reports on attacks on medical software and IT-systems available?

2010-08-12 Thread Paul Schmehl
--On Wednesday, August 11, 2010 22:48:11 -0400 casp...@random-interrupt.org wrote: Some hospitals have a well guarded network. Some Medical IT systems are secure. Some are not. The Threat Environment for medical institutions is similar to any other large company, except there's the added risk

[Full-disclosure] [ MDVSA-2010:149 ] freetype2

2010-08-12 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2010:149 http://www.mandriva.com/security/

Re: [Full-disclosure] Facebook name extraction based on email/wrong password + POC

2010-08-12 Thread ghost
The great thing about these threads is you can killfile anybody in them and know you'll never miss anything useful. Please keep it going. On Thu, Aug 12, 2010 at 7:00 AM, Zerial. ferna...@zerial.org wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This bug appears in a spanish security

[Full-disclosure] Cisco Security Advisory: Cisco IOS Software TCP Denial of Service Vulnerability

2010-08-12 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software TCP Denial of Service Vulnerability Advisory ID: cisco-sa-20100812-tcp http://www.cisco.com/warp/public/707/cisco-sa-20100812-tcp.shtml Revision 1.0 For Public Release 2010 August 12 2130 UTC (GMT