Re: [Full-disclosure] Vulnerabilities in phpCOIN

2010-04-15 Thread Benji
b) > and about CaptchaSecurityImages.php and webapps which are using it, show > that particularly in open source vulnerable (web) applications can > widespread very much. > > > various "hitch hiker" applications... toolbars, trial software, etc. > > Jeff, I'm

Re: [Full-disclosure] Vulnerabilities in phpCOIN

2010-04-15 Thread MustLive
d" ones, can have their own holes (so with every additional "bonus" program the overall security of the system is decreasing). So everyone must take care of "additional apps", both web and desktop (such as toolbars), and install only what they really want. Best wishes & re

Re: [Full-disclosure] Vulnerabilities in phpCOIN

2010-04-09 Thread Jeff Kell
Amen to that. Everything seems to be delivered for installation and even increasingly with *each* update, carrying various "hitch hiker" applications... toolbars, trial software, etc. Sun Java updates installing toolbars, Adobe doing toolbars, even FoxIT installed some toolbars (even after I s

Re: [Full-disclosure] Vulnerabilities in phpCOIN

2010-04-09 Thread Christian Sciberras
I think Universities should rethink their Software Development courses... Valdis has got a very strong point. Here's my own. I got Safari to test websites I develop. Apple seems to think that during a recommended/critical Safari update, I should be installing iTunes. Oh, and surprise, with iTunes

Re: [Full-disclosure] Vulnerabilities in phpCOIN

2010-04-09 Thread Jan G.B.
2010/4/9 : > On Fri, 09 Apr 2010 15:49:58 +0200, "Jan G.B." said: > >> And where's the point in reporting several projects that use a -say- >> library which has a reported problem? (I mean, you've send quite the >> same mail with a different software to bugtraq, today.) > > A few years ago, a rath

Re: [Full-disclosure] Vulnerabilities in phpCOIN

2010-04-09 Thread Valdis . Kletnieks
On Fri, 09 Apr 2010 15:49:58 +0200, "Jan G.B." said: > And where's the point in reporting several projects that use a -say- > library which has a reported problem? (I mean, you've send quite the > same mail with a different software to bugtraq, today.) A few years ago, a rather nasty vulnerabilit

Re: [Full-disclosure] Vulnerabilities in phpCOIN

2010-04-09 Thread Jan G.B.
2010/4/9 MustLive : > Hello Full-Disclosure! > Quoting the list charter: "Gratuitous advertisement, product placement, or self-promotion is forbidden." And where's the point in reporting several projects that use a -say- library which has a reported problem? (I mean, you've send quite the same ma

[Full-disclosure] Vulnerabilities in phpCOIN

2010-04-09 Thread MustLive
Hello Full-Disclosure! I want to warn you about security vulnerabilities in system phpCOIN. - Advisory: Vulnerabilities in phpCOIN - URL: http://websecurity.com.ua/4090/ - Affected products: phpCOIN 1.6.5 and prev