The finest blend of the latest IT security news headlines, updated every 4 hours.

IT Security News
Regular Security News
Social Media
Tools 		Exploits
Vulnerabilities
Security Videos & Podcasts
Other Stuff 		Security Blogs
Microsoft Security Advisories
Mailing Lists 		Bookmark + Share

Colour scheme


IT Security News

News ≈ Packet Storm

The Register – Security

Security Bloggers Network

SANS Internet Storm Center, InfoCON: green

The H Security

E Hacking News | Hacker News | IT Security | Cyber Crime [EHN]

CNET News – Security

IT Security Blog | TechRepublic

ASTALAVISTA Security News

Regular Security News

hacking – Google News

computer security – Google News

Threat Level

Social Media
Reddit

/r/netsec – Information Security News & Discussion

Stories

Stories

Delicious/tag/security

Delicious/tag/hacking

Delicious/tag/encryption

Slashdot: Your Rights Online

 Got any bright ideas about what to put here? I’m sure you can think of something with an rss feed

Tools

Security Tool Files ≈ Packet Storm

  • Viper Network Sniffer Script This is a bash script to use in conjunction with Backtrack that simplifies the spawning of various sniffers.
  • Port Tester 0.1 This is a simple little port scanning script written in python.
  • Dradis Information Sharing Tool 2.9.0 dradis is a tool for sharing information during security testing. While plenty of tools exist to help in the different stages of the test, not so many exist to share interesting information captured. When a team of testers is working on the same set of targets, having a common repository of informat. […]
  • WeBaCoo (Web Backdoor Cookie) 0.2.2 WeBaCoo (Web Backdoor Cookie) is a web backdoor script-kit, aiming to provide a stealth terminal-like connection over HTTP between client and web server. It is a post exploitation tool capable to maintain access to a compromised web server. WeBaCoo was designed to operate under the radar of modern u. […]
  • Bluelog Bluetooth Scanner/Logger 1.0.1 Bluelog is a Bluetooth scanner/logger written with speed in mind. It is intended to be used as a site survey tool, concerned more about accurately detecting the number of discoverable Bluetooth devices than individual device specifics. Bluelog also includes the unique “Bluelog Live” mode, which puts. […]
  • GNU Privacy Guard 1.4.12 GnuPG (the GNU Privacy Guard or GPG) is GNU’s tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such. […]
  • PgSql Brute Force This is a small application built to demo the weakness in pgsql and networking. It is capable of running login attempts from multiple threads in parallel and can run up to 1024 concurrent connections.
  • HTTP Brute Force This is a small application built to test the performance of a http authentication system using a lot of concurrent connections. It can also be used to try lots of password against a http server. It is capable of using up to 1024 (or more using multiple processes). However with this amount it is cap. […]
  • Lightidra IRC Router Scanner Lightaidra is an IRC commanded tool that allows for scanning and exploiting routers. It also performs flooding.
  • Zorp Proxy Firewall Suite 3.9.3 Zorp is a proxy firewall suite with its core architecture built around today’s security demands. It uses application level proxies, is modular and component based, uses a script language to describe policy decisions, makes it possible to monitor encrypted traffic, lets you override client actions, a. […]
  • FatCat SQL Injector This is an automatic SQL Injection tool called FatCat. It has features that help you to extract the database information, table information, and column information from a web application.
  • Dark D0rk3r 0.5 Dark D0rk3r is a python script that performs dork searching and searches for local file inclusion and SQL injection errors.
  • p0f 3.03b Windows Port P0f is a tool that utilizes an array of sophisticated, purely passive traffic fingerprinting mechanisms to identify the players behind any incidental TCP/IP communications (often as little as a single normal SYN) without interfering in any way. Version 3 is a complete rewrite of the original codebas. […]
  • Mobius Forensic Toolkit 0.5.11 Mobius Forensic Toolkit is a forensic framework written in Python/GTK that manages cases and case items, providing an abstract interface for developing extensions. Cases and item categories are defined using XML files for easy integration with other tools.
  • Dark D0rk3r 0.4 Dark D0rk3r is a python script that performs dork searching and searches for local file inclusion and SQL injection errors.
  • OpenDNSSEC 1.3.5 OpenDNSSEC is software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.

CNET Download.com Security Software New Releases
empty What security software source do you want to see here?

Exploits

Exploit Files ≈ Packet Storm

Exploit-DB updates

Securityvulns exploits channel

Inj3ct0r.com

Vulnerabilities

Advisory Files ≈ Packet Storm

  • Debian Security Advisory 2384-2 Debian Linux Security Advisory 2384-2 – It was discovered that the last security update for cacti, DSA-2384-1, introduced a regression in lenny.
  • Secunia Security Advisory 47843 Secunia Security Advisory – Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities.
  • Secunia Security Advisory 47856 Secunia Security Advisory – A vulnerability with an unknown impact has been reported in Skype.
  • Secunia Security Advisory 47859 Secunia Security Advisory – A vulnerability has been reported in Xen, which can be exploited by malicious, local users in a guest virtual machine to potentially gain escalated privileges.
  • Secunia Security Advisory 47851 Secunia Security Advisory – A vulnerability has been reported in the Forward module for Drupal, which can be exploited by malicious people to bypass certain security restrictions.
  • Secunia Security Advisory 47806 Secunia Security Advisory – A vulnerability has been reported in PHP, which can be exploited by malicious people to compromise a vulnerable system.
  • Secunia Security Advisory 47846 Secunia Security Advisory – Red Hat has issued an update for ghostscript. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).
  • Secunia Security Advisory 47817 Secunia Security Advisory – Red Hat has issued an update for ghostscript. This fixes a security issue and some vulnerabilities, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), or compromise a user’s system.
  • Secunia Security Advisory 47813 Secunia Security Advisory – Red Hat has issued an update for php53. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system.
  • Secunia Security Advisory 47847 Secunia Security Advisory – A weakness and two vulnerabilities have been reported in Joomla!, which can be exploited by malicious users and malicious people to disclose sensitive information.
  • Secunia Security Advisory 47849 Secunia Security Advisory – Sony has discovered multiple vulnerabilities in Foswiki, which can be exploited by malicious users to conduct script insertion attacks.
  • Secunia Security Advisory 47824 Secunia Security Advisory – Red Hat has issued an update for php. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system.
  • Secunia Security Advisory 47801 Secunia Security Advisory – Debian has issued an update for php5. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system.
  • Secunia Security Advisory 47870 Secunia Security Advisory – A vulnerability has been discovered in the WP-RecentComments plugin for WordPress, which can be exploited by malicious people to conduct SQL injection attacks.
  • Secunia Security Advisory 47788 Secunia Security Advisory – Debian has issued an update for iceweasel. This fixes a weakness and multiple vulnerabilities, which can be exploited by malicious people to disclose certain sensitive information and compromise a user’s system.
  • Secunia Security Advisory 47794 Secunia Security Advisory – Debian has issued an update for tomcat6. This fixes multiple weakness, two security issues, and multiple vulnerabilities, which can be exploited by malicious, local users and malicious people to disclose sensitive information, bypass certain security restrictions, or caus. […]

Bugtraq

  • [ MDVSA-2012:013 ] mozilla Posted by security on Feb 03 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2012:013 http://www.mandriva.com/security/ _______________________________________________________________________ Package : mozilla Date : February 3, 2012 Aff. […]
  • ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability Posted by Security_Alert on Feb 03ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability. EMC Identifier: ESA-2012-010 EMC Identifier: SRCH-7949 CVE Identifier: CVE-2012-0396 Severity Rating: CVSS v2 Base Score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) Affected products: EMC SW: EMC Docume. […]
  • RFC 6528 on Defending against Sequence Number Attacks Posted by Fernando Gont on Feb 03Folks, FYI. (the RFC is available at: ) A new Request for Comments is now available in online RFC libraries. RFC 6528 Title: Defending against Sequence Number Attacks Author: F. Gont, S. Bellovin Status: Standards Track Stre. […]
  • [SECURITY] [DSA 2403-1] php5 security update Posted by Thijs Kinkhorst on Feb 03————————————————————————- Debian Security Advisory DSA-2403-1 security () debian org http://www.debian.org/security/ Thijs Kinkhorst February 02, 2012 http://www.debian.org/security/faq ——————————-. […]
  • [SECURITY] [DSA 2402-1] iceape security update Posted by Moritz Muehlenhoff on Feb 03————————————————————————- Debian Security Advisory DSA-2402-1 security () debian org http://www.debian.org/security/ Moritz Muehlenhoff February 02, 2012 http://www.debian.org/security/faq ————————-. […]
  • [SECURITY] [DSA 2400-1] iceweasel security update Posted by Moritz Muehlenhoff on Feb 03————————————————————————- Debian Security Advisory DSA-2400-1 security () debian org http://www.debian.org/security/ Moritz Muehlenhoff February 02, 2012 http://www.debian.org/security/faq ————————-. […]
  • [SECURITY] [DSA 2401-1] tomcat6 security update Posted by Moritz Muehlenhoff on Feb 03————————————————————————- Debian Security Advisory DSA-2401-1 security () debian org http://www.debian.org/security/ Moritz Muehlenhoff February 02, 2012 http://www.debian.org/security/faq ————————-. […]
  • [security bulletin] HPSBGN02740 SSRT100741 rev.1 – HP Operations Manager, Operations Agent, Performance Agent, Service Health Reporter, Service Health Optimizer, Performance Manager, Remote Execution of Arbitrary Code Posted by security-alert on Feb 03SUPPORT COMMUNICATION – SECURITY BULLETIN Document ID: c03179825 Version: 1 HPSBGN02740 SSRT100741 rev.1 – HP Operations Manager, Operations Agent, Performance Agent, Service Health Reporter, Service Health Optimizer, Performance Manager, Remote Execution of Arbitra. […]
  • GLSA (Gentoo Linux Security Advisory) publication changes Posted by Alex Legler on Feb 02Like other Linux distribution vendors, Gentoo is currently CC'ing advisories to the full-disclosure and bugtraq mailing lists. Starting today, we will be *no longer* publishing our advisories to full- disclosure or bugtraq. We are following our colleagues at Ubunt. […]
  • [security bulletin] HPSBMU02739 SSRT100280 rev.1 – HP Data Protector Media Operations, Remote Execution of Arbitrary Code Posted by security-alert on Feb 02SUPPORT COMMUNICATION – SECURITY BULLETIN Document ID: c03179046 Version: 1 HPSBMU02739 SSRT100280 rev.1 – HP Data Protector Media Operations, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon as soon as possib. […]
  • [CAL-2012-0004] opera array integer overflow Posted by Code Audit Labs on Feb 02CAL-2012-0004 opera array integer overflow 1 Affected Products ================= 11.60 and prior 2 Vulnerability Details ===================== Code Audit Labs http://www.vulnhunt.com has discovered a integer overflow vulnerability in array functions like Int32Array. […]
  • Fwd: RA-Guard: Advice on the implementation (feedback requested) Posted by Fernando Gont on Feb 02Folks, We have talked about this one quite a few times (including ). — still, most implementations remain broken. If you care to get this fixed, please provide feedback about this I-D on t. […]
  • Call For Paper Posted by asemailing on Feb 02CALL FOR PAPER 2012 ASE/IEEE International Conference on Privacy, Security, Risk, and Trust Amsterdam, The Netherlands, September 3-6, 2012 WebSite: http://www.asesite.org/conferences/PASSAT/2012/ Workshop Proposal Submission Deadline: March 1, 2012 Paper Submission Dea. […]
  • APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001 Posted by Apple Product Security on Feb 02APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001 OS X Lion v10.7.3 and Security Update 2012-001 is now available and addresses the following: Address Book Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact. […]
  • [ MDVSA-2012:012 ] apache Posted by security on Feb 02 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2012:012 http://www.mandriva.com/security/ _______________________________________________________________________ Package : apache Date : February 2, 2012 Affe. […]

SecurityFocus Vulnerabilities

Unofficial Secunia Security Advisories

  • [2/5] 2X ApplicationServer TuxSystem ActiveX Control "ExportSettings()" Insecure Method Andrea Micalizzi has discovered a vulnerability in 2X ApplicationServer TuxSystem ActiveX Control, which can be exploited by malicious people to manipulate certain data. http://secunia.com/advisories/47657/
  • [3/5] DotNetNuke Multiple Vulnerabilities A weakness and two vulnerabilities have been reported in DotNetNuke, which can be exploited by malicious users to enumerate files on an affected system and bypass certain security restrictions and by malicious people to conduct cross-site scripting attacks. http://secunia.com/advisories/47872/
  • [2/5] Foswiki Multiple Script Insertion Vulnerabilities Sony has discovered multiple vulnerabilities in Foswiki, which can be exploited by malicious users to conduct script insertion attacks. http://secunia.com/advisories/47849/
  • [2/5] Joomla! Multiple Information Disclosure Vulnerabilities A weakness and two vulnerabilities have been reported in Joomla!, which can be exploited by malicious users and malicious people to disclose sensitive information. http://secunia.com/advisories/47847/
  • [3/5] TYPO3 RTG Files Extension Two Vulnerabilities Two vulnerabilities have been reported in the RTG Files extension for TYPO3, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks. http://secunia.com/advisories/47842/
  • [3/5] Sphinx Mobile Web Server "comment" Blog Comment Script Insertion Vulnerability Prabhu S Angadi has discovered a vulnerability in Sphinx Mobile Web Server, which can be exploited by malicious people to conduct script insertion attacks. http://secunia.com/advisories/47876/
  • [2/5] Red Hat update for JBoss Enterprise Portal Platform Red Hat has issued an update for JBoss Enterprise Portal Platform. This fixes multiple weaknesses, a security issue, and multiple vulnerabilities, which can be exploited by malicious, local users to bypass certain security restrictions and by malicious people to bypass certain security restrictions,. […]
  • [4/5] Debian update for php5 Debian has issued an update for php5. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system. http://secunia.com/advisories/47801/
  • [3/5] Debian update for tomcat6 Debian has issued an update for tomcat6. This fixes multiple weakness, two security issues, and multiple vulnerabilities, which can be exploited by malicious, local users and malicious people to disclose sensitive information, bypass certain security restrictions, or cause a DoS (Denial of Service).. […]
  • [4/5] Debian update for iceweasel Debian has issued an update for iceweasel. This fixes a weakness and multiple vulnerabilities, which can be exploited by malicious people to disclose certain sensitive information and compromise a user’s system. http://secunia.com/advisories/47788/
  • [4/5] Debian update for iceape Debian has issued an update for iceape. This fixes a weakness and multiple vulnerabilities, which can be exploited by malicious people to disclose certain sensitive information and compromise a user’s system. http://secunia.com/advisories/47770/
  • [4/5] Red Hat update for php53 Red Hat has issued an update for php53. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system. http://secunia.com/advisories/47813/
  • [3/5] Red Hat update for ghostscript Red Hat has issued an update for ghostscript. This fixes a security issue and some vulnerabilities, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), or compromise a user’s system. http://secunia.com/advisories/47817/
  • [3/5] Red Hat update for ghostscript Red Hat has issued an update for ghostscript. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service). http://secunia.com/advisories/47846/
  • [4/5] PHP "php_register_variable_ex()" Code Execution Vulnerability A vulnerability has been reported in PHP, which can be exploited by malicious people to compromise a vulnerable system. http://secunia.com/advisories/47806/
  • [3/5] Skype Unspecified Vulnerability A vulnerability with an unknown impact has been reported in Skype. http://secunia.com/advisories/47856/

Security Videos & Podcasts

SecurityTube.Net

PaulDotCom

Risky Business

Other Stuff

Hack a Day

 Announcement: SCADA Security Conference
Oil & Gas Cyber Security Forum

Includes hacking demonstrations, stuxnet, and more.
Takes place on Monday 21st and Tuesday 22nd November at the Copthorne Tara Hotel in London.

PenTest Magazine

Files ≈ Packet Storm

  • DNS Service Oriented DoS / DDoS Attacks Whitepaper called DNS Service Oriented Denial of Service / Distributed Denial of Service Attacks. Written in Turkish.
  • Analysis Of A MIDI Remote Code Execution Vulnerability This whitepaper analyzes the MIDI remote code execution vulnerability found in the Windows Multimedia Library. Written in Turkish.
  • PHP 5.4.0RC6 Denial Of Service PHP version 5.4.0RC6 64-bit denial of service proof of concept exploit.
  • Edraw Diagram Component 5 Active-X Buffer Overflow Edraw Diagram Component 5 active-x buffer overflow proof of concept denial of service exploit.
  • Mobile Based MITM Attack This is a brief whitepaper discussing how to set up QT Mobile Hotspot and YAMAS applications to man in the middle connections using your phone.
  • ObjectLabs Forum Systems SQL Injection ObjectLabs Forum System suffers from a remote SQL injection vulnerability.
  • Conduit Wibiya Toolbar Persistent Cross Site Scripting Conduit Wibiya Toolbar suffers from a persistent cross site scripting vulnerability.
  • XWiki Enterprise 3.4 Cross Site Scripting XWiki Enterprise version 3.4 suffers from a cross site scripting vulnerability.
  • InsideChannel Web Design SQL Injection InsideChannel Web Design suffers from a remote SQL injection vulnerability.
  • Viper Network Sniffer Script This is a bash script to use in conjunction with Backtrack that simplifies the spawning of various sniffers.
  • Zanjan Azad University SQL Injection Zanjan Azad University suffers from a remote SQL injection vulnerability.
  • Debian Security Advisory 2384-2 Debian Linux Security Advisory 2384-2 – It was discovered that the last security update for cacti, DSA-2384-1, introduced a regression in lenny.
  • Mandriva Linux Security Advisory 2012-013 Mandriva Linux Security Advisory 2012-013 – Security issues were identified and fixed in mozilla firefox and thunderbird. Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote atta. […]
  • Ubuntu Security Notice USN-1355-1 Ubuntu Security Notice 1355-1 – It was discovered that if a user chose to export their Firefox Sync key the “Firefox Recovery Key.html” file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processi. […]
  • Ubuntu Security Notice USN-1355-2 Ubuntu Security Notice 1355-2 – USN-1355-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko package for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the “Firefox Recovery Key.html” file is saved with incorrect permiss. […]
  • Ubuntu Security Notice USN-1355-3 Ubuntu Security Notice 1355-3 – USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated ubufox and webfav packages for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the “Firefox Recovery Key.html” file is saved with incorrect p. […]

Files ≈ Packet Storm

  • DNS Service Oriented DoS / DDoS Attacks Whitepaper called DNS Service Oriented Denial of Service / Distributed Denial of Service Attacks. Written in Turkish.
  • Analysis Of A MIDI Remote Code Execution Vulnerability This whitepaper analyzes the MIDI remote code execution vulnerability found in the Windows Multimedia Library. Written in Turkish.
  • PHP 5.4.0RC6 Denial Of Service PHP version 5.4.0RC6 64-bit denial of service proof of concept exploit.
  • Edraw Diagram Component 5 Active-X Buffer Overflow Edraw Diagram Component 5 active-x buffer overflow proof of concept denial of service exploit.
  • Mobile Based MITM Attack This is a brief whitepaper discussing how to set up QT Mobile Hotspot and YAMAS applications to man in the middle connections using your phone.
  • ObjectLabs Forum Systems SQL Injection ObjectLabs Forum System suffers from a remote SQL injection vulnerability.
  • Conduit Wibiya Toolbar Persistent Cross Site Scripting Conduit Wibiya Toolbar suffers from a persistent cross site scripting vulnerability.
  • XWiki Enterprise 3.4 Cross Site Scripting XWiki Enterprise version 3.4 suffers from a cross site scripting vulnerability.
  • InsideChannel Web Design SQL Injection InsideChannel Web Design suffers from a remote SQL injection vulnerability.
  • Viper Network Sniffer Script This is a bash script to use in conjunction with Backtrack that simplifies the spawning of various sniffers.
  • Zanjan Azad University SQL Injection Zanjan Azad University suffers from a remote SQL injection vulnerability.
  • Debian Security Advisory 2384-2 Debian Linux Security Advisory 2384-2 – It was discovered that the last security update for cacti, DSA-2384-1, introduced a regression in lenny.
  • Mandriva Linux Security Advisory 2012-013 Mandriva Linux Security Advisory 2012-013 – Security issues were identified and fixed in mozilla firefox and thunderbird. Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote atta. […]
  • Ubuntu Security Notice USN-1355-1 Ubuntu Security Notice 1355-1 – It was discovered that if a user chose to export their Firefox Sync key the “Firefox Recovery Key.html” file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processi. […]
  • Ubuntu Security Notice USN-1355-2 Ubuntu Security Notice 1355-2 – USN-1355-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko package for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the “Firefox Recovery Key.html” file is saved with incorrect permiss. […]
  • Ubuntu Security Notice USN-1355-3 Ubuntu Security Notice 1355-3 – USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated ubufox and webfav packages for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the “Firefox Recovery Key.html” file is saved with incorrect p. […]

Security Blogs

Security Bloggers Network

Schneier on Security

LinuxSecurity.com – Latest News

TaoSecurity

SecuriTeam Blogs

Offensive Computing – Community Malicious code research and analysis

Darknet – The Darkside

The Dark Visitor

WhiteHat Security Blog

cr0 blog

HITBSecNews – Keeping Knowledge Free for Over a Decade

GNUCITIZEN

The Ethical Hacker Network RSS News Feed

Carnal0wnage & Attack Research Blog

Daily Dave

ha.ckers.org web application security lab

Security4all – Dedicated to digital security, enterprise 2.0 and presentation skills

Rapid7 Community : Blog List – Metasploit

DVLabs: Blogs

The RISKS Digest

Post Politics: Breaking Politics News, Political Analysis & More – The Washington Post

Microsoft Security Advisories

MSRC

  • January 2012 Security Bulletin Webcast Q&A Hello, Today we published the January Security Bulletin Webcast Questions & Answers page. We fielded nine questions on various topics during the webcast, including bulletins released, deployment tools, and update detection tools. There were two questions during the webcast that we were unable to ans. […]
  • January 2012 Security Bulletins Released Hello. As I previously mentioned in the Advance Notification Service blog post on Thursday, today we are releasing seven security bulletins, one of which is rated Critical in severity, with the remaining six classified as Important. These bulletins will address eight vulnerabilities in Microsoft pro. […]
  • January 2012 ANS is released Hello. Today we’re releasing our advance notification for the January security bulletin release, which is scheduled for Tuesday, January 10. This month’s release includes seven bulletins addressing eight vulnerabilities in Microsoft Windows and Microsoft Developer Tools And Software. As always,. […]
  • December 2011 Out-Of-Band Bulletin Release: Q&A and Webcast Hello, Today we published the December 2011 Out-of-Band Security Bulletin Webcast Questions & Answers page. We fielded 41 questions on the subject of MS11-100 . There were four questions during the webcast that we were unable to answer and we have included those questions and answers on the Q&A page. […]
  • December 2011 Out-Of-Band Security Bulletin Webcast Q&A Hosts:              Jonathan Ness, Security Development Manager, MSRC                           Pete Voss, Sr. Response Communications Manager, Trustworthy Computing Website:         TechNet/Security Chat Topic:     December 2011 Out-Of-Band Security. […]
  • Microsoft releases MS11-100 for Security Advisory 2659883 Hello, Today we released Security Update MS11-100 to address the issue described in Security Advisory 2659883. The security update has a severity rating of Critical and resolves a publicly disclosed remote unauthenticated Denial of Service issue in ASP.NET versions 1.1 and above on all supported ver. […]
  • Advanced Notification for out-of-band release to address Security Advisory 2659883 Hello, Today we’re providing advance notification for an out-of-band security update to address the publicly disclosed issue described in Security Advisory 2659883. The release is scheduled for tomorrow, December 29, at approximately 10 a.m. PST. The bulletin has a severity rating of Critical and. […]
  • Microsoft releases Security Advisory 2659883, offers workaround for industry-wide issue Hello, Today we published Security Advisory 2659883 to provide a workaround to help protect ASP.NET customers from a publicly disclosed vulnerability that affects various Web platforms industry-wide. We are not aware of any attacks using this vulnerability, which affects all supported versions of .N. […]
  • December 2011 Bulletin Release Q&A and Slide Deck Hello, Today we published the December Security Bulletin Webcast Questions & Answers page. We fielded six questions on various topics during the webcast, including bulletins released, deployment tools, and update detection tools. For more details on this month’s bulletins, click here to view the s. […]
  • December 2011 Security Bulletin Webcast Q&A Hosts:             Jonathan Ness, Security Development Manager, MSRC                        Jerry Bryant, Group Manager, Trustworthy Computing Communications Website:         TechNet/Security Chat Topic:     December 2011 Security Bulletin Release Date:. […]
  • A look back at 2011’s security landscape Hi everyone – Mike Reavey here. Today, we’re releasing our December set of security updates. As we do every month, we’re providing a heads-up on what’s coming in this month’s release as well as offering links to more information so you can plan your deployment. However, since this is the las. […]
  • The December bulletins are released Hello. As I previously mentioned in the Advance Notification Service blog post on Thursday, today we are releasing 13 security bulletins, three of which are rated Critical in severity, and 10 Important. These bulletins will increase protection by addressing 19 unique vulnerabilities in Microsoft pro. […]
  • News from MAPP, and Advance Notification Service for the December 2011 Bulletin Release Hello all. Before we look at next week’s bulletin release, we’d like to point out an update to our Microsoft Active Protections Program (MAPP) that should provide customers with greater transparency as to how MAPP partners use the information we share with them when we release security advisorie. […]
  • Microsoft releases Security Advisory 2641690, updates Untrusted Certificate Store Hi everyone, As a follow-up to Friday’s blog post, today we released Security Advisory 2641690 to notify customers that we revoked the trust of DigiCert Sdn.Bhd in an update that moves two Intermediate Certificate Authorities (CA) certificates to the Microsoft Untrusted Certificate Store. We made. […]
  • Microsoft hosts BlueHatv11, releases four bulletins Hello, On this November Update Tuesday, we’re recapping the BlueHat conference, which Microsoft hosted in Redmond last week. We are also releasing four security updates, so please read on for details. Microsoft hosted its 11th installment of the BlueHat conference Nov. 2-4. The event featured pres. […]
  • Microsoft releases Security Advisory 2639658 Hi everyone, Today we released Security Advisory 2639568 to provide customer guidance for the Windows kernel issue related to the Duqu malware. I would like to provide you information on how to protect your system(s), how we are addressing the issue, and insight into our threat landscape monitoring. […]

Microsoft Sec Notification

  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Feb 01******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: February 1, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Jan 27******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: January 27, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Jan 24******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: January 24, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Jan 18******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: January 18, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Jan 17******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: January 17, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Jan 16******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: January 16, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Re-Releases Posted by Microsoft on Jan 11******************************************************************** Title: Microsoft Security Bulletin Re-Releases Issued: January 11, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a majo. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Jan 11******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: January 11, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Summary for January 2012 Posted by Microsoft on Jan 10******************************************************************** Microsoft Security Bulletin Summary for January 2012 Issued: January 10, 2012 ******************************************************************** This bulletin summary lists security bulletins released. […]
  • Microsoft Security Advisory Notification Posted by Microsoft on Jan 10******************************************************************** Title: Microsoft Security Advisory Notification Issued: January 10, 2012 ******************************************************************** Security Advisories Updated or Released Today ==============. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Jan 10******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: January 10, 2012 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Bulletin Advance Notification for January 2012 Posted by Microsoft on Jan 08******************************************************************** Microsoft Security Bulletin Advance Notification for January 2012 Issued: January 5, 2012 ******************************************************************** This is an advance notification of security. […]
  • Microsoft Security Bulletin Minor Revisions Posted by Microsoft on Dec 30******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: December 30, 2011 ******************************************************************** Summary ======= The following bulletins have undergone a. […]
  • Microsoft Security Advisory Notification Posted by Microsoft on Dec 29******************************************************************** Title: Microsoft Security Advisory Notification Issued: December 29, 2011 ******************************************************************** Security Advisories Updated or Released Today =============. […]
  • Microsoft Security Bulletin Summary for December 2011 Posted by Microsoft on Dec 29******************************************************************** Microsoft Security Bulletin Summary for December 2011 Issued: December 29, 2011 ******************************************************************** This bulletin summary lists an out-of-band security b. […]

Mailing Lists

Full Disclosure

  • Re: Vulnerability-lab.com XSS Posted by Ferenc Kovacs on Feb 05Judging from the screenshot, it seems to be a reflected XSS through the User-Agent field. I would be curious how could this be exploited from the client side as you can't manipulate other visitors User-Agent header. Of course if the User-Agent is logged and the. […]
  • Re: Vulnerability-lab.com XSS Posted by RandallM on Feb 05Hell, his English teacher is…
  • Re: can you answer this? Posted by Valdis . Kletnieks on Feb 05On Fri, 03 Feb 2012 02:58:52 CST, Fatherlaptop said: Simple – it probably came in from elsewhere, and it's asking an IP from an address that it thought *was* in *its* trust scheme.
  • Re: Multiple vendor antivirus .kz archive formatevasion/bypass vulnerability. Posted by ZeroDay.JP on Feb 05antiviruses Does this “.kz” archiver have an SFX extractor? Because a new SFX type of an archive file will raise support priority instead. Yes, but AFTER being extracted beforehand (or maybe you can prove the otherwise) You can't be serious to expect every unknown. […]
  • Advantech/Broadwin HMI/SCADA WebAccess universalnetwork RPC exploit Posted by Arthur Conan Doyle on Feb 05New exploit for Broadwin/Advantexh HMI/SCADA was published by Zomb1E & amistox07. Exploit is used undocumented features of SCADA. See: http://fuzzyd00r.blogspot.com/2012/02/advantechbroadwin-hmiscada-webaccess6xx.html
  • Re: can you answer this? Posted by Fatherlaptop on Feb 05Excellent idea. And yes I'm top posting hate snipping on iPhone! From: Randy It's an iPhone Thang! Was learning cursive necessary?
  • Re: can you answer this? Posted by Granville Moore on Feb 05Sorry – my “From” address was screwed up in my previous reply. Granville Moore Nemesys Computer Consultants www.nemesys.com
  • Re: [SECURITY] [DSA 2403-1] php5 security update Posted by The:Paradox on Feb 05Do you have Esser's site link reference about this? Il giorno 03/feb/2012 09:16, “Thijs Kinkhorst” ha scritto:
  • Vulnerability-lab.com XSS Posted by lulzlab on Feb 05vulnerability-lab XSS hahahahahaha ROTFL vulnerability lab kiddos!!!
  • Re: can you answer this? Posted by Fatherlaptop on Feb 05… Why? How is this IP asking for DHCP to another not in my trust IP scheme? From: Randy It's an iPhone Thang! Was learning cursive necessary?
  • Re: Multiple vendor antivirus .kz archive format evasion/bypass vulnerability. Posted by Julius Kivimäki on Feb 05You do know that anyone can create a new archive format that antiviruses will not detect… Right? 2012/2/2 Michel
  • [SECURITY] [DSA 2404-1] xen-qemu-dm-4.0 securityupdate Posted by Florian Weimer on Feb 05————————————————————————- Debian Security Advisory DSA-2404-1 security () debian org http://www.debian.org/security/ Florian Weimer February 05, 2012 http://www.debian.org/security/faq ———————————. […]
  • Re: Tricky Shellcode Posted by bashrc on Feb 05Hello Joshua, your shellcode is basically decrypting some string using 8-bit XOR with the key 0×41. You can use ndisasm for analysing it. The code is easy to understand if you know assembler. Regards, bashrc $ ndisasm -b 32 SC 00000000 31C0 xor eax,eax 00000002 50 push eax. […]
  • Re: Vulnerability-lab.com XSS Posted by Valdis . Kletnieks on Feb 04On Sat, 04 Feb 2012 08:06:47 +1100, doomxd said: Dale Carnegie is rolling over in his grave…
  • Re: when did piracy/theft become expression of freedom Posted by Georgi Guninski on Feb 04Just a quote: In Germany they first came for the Communists, and I didn't speak up because I wasn't a Communist. Then they came for the Jews, and I didn't speak up because I wasn't a Jew. Then they came for the trade unionists, and I did. […]

Top WordPress blogs Top WordPress Blogs online!

IT Security News
Regular Security News
Social Media
Tools
Exploits
Vulnerabilities
Security Videos & Podcasts
Other Stuff
Security Blogs
Microsoft Security Advisories
Mailing Lists
 Colour scheme