The Glider

A vulnerability has been reported in Citrix XenServer, which can be exploited by malicious, local users to bypass certain security restrictions.

http://secunia.com/Advisories/32774/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/

Janek Vind has reported some vulnerabilities in vBulletin, which can be exploited by malicious users to conduct SQL injection attacks.

http://secunia.com/Advisories/32735/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/

[security bulletin] HPSBST02386 SSRT080164 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-067 to MS08-069

This morning we've received a couple emails and a post in our IRC channel (#dshield on irc.freenode.net) concerning a Plaintext Recovery Attack against OpenSSH. Specifically version 4.7p1, which is quite old. From the article: If exploited, this attack can potentially allow an attacker to recover up to 32 bits of plaintext from an arbitrary block of ciphertext from a connection secured using the SSH protocol in the standard configuration. If OpenSSH is used in the standard configuration, then the attacker's success probability for recovering 32 bits of plaintext is 2^{-18}. A variant of the attack against OpenSSH in the standard configuration recovers 14 bits of plaintext with probability 2^{-14}. The success probability of the attack for other implementations of SSH is not known. Here's a link to the article itself: here. So that you may read at your leisure. Here's a link to OpenSSH's Security Page: here. The current version of OpenSSH is 5.1, and it's been out since July. So make sure you are patched by running ssh -V on the command line. I just did it on my OSX Machine and I am running 5.1p1. UPDATE: Received an email from a reader, (thanks Jack!), Ubuntu 8.04, updated as of this morning is still running OpenSSH 4.7p1. UPDATE 2: A workaround apparently, from information I have just read (at least for SSH Tectia Products) is to stop using CBC mode block cyphers. At least in the SSH Tectia products, you can use the CryptiCore or Arcfour encryption algorithm. UPDATE 3: The likelyhood of successful attack is LOW according to the link I posted to the article above, the vulnerability requires retransmission of plaintext on reconnect to be successful. I'm not saying that 5.1 is not vulnerable. I am saying that 5.1 is the current version, just so there is no misconception. CPNI says: We expect any RFC-compliant SSH implementation to be vulnerable to some form of the attack. We're not telling you to stop using SSH, by no means. We expect updates to be posted that switch encryption algorithms. We won't be raising the Infocon anytime soon unless we start seeing patterns of attack, or an exploit comes out that makes it very simple to exploit this vulnerability. As you know, our Infocon doesn't get raised on every little thing. We discuss it internally heavily before we move it in any direction. -- Joel Esler http://www.joelesler.net

Janek Vind has reported some vulnerabilities in vBulletin, which can be exploited by malicious users to conduct SQL injection attacks.

http://secunia.com/Advisories/32775/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/

A security issue has been reported in Dovecot ManageSieve, which can be exploited by malicious users to bypass certain security restrictions.

http://secunia.com/Advisories/32768/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/

ZoRLu has reported a vulnerability in Jadu Galaxies, which can be exploited by malicious people to conduct SQL injection attacks.

http://secunia.com/Advisories/32733/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/

sr. has reported a vulnerability in Netgear WGR614v9, which can be exploited by malicious people to cause a DoS (Denial of Service).

http://secunia.com/Advisories/32716/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/

cOndemned has discovered a security issue in ScriptsEz FREEze Greetings, which can be exploited by malicious people to disclose sensitive information.

http://secunia.com/Advisories/32744/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/

Digital Security Research Group have reported a vulnerability in Pluck, which can be exploited by malicious people to disclose sensitive information.

http://secunia.com/Advisories/32736/

NOTE: This RSS feed does not include information about updated Secunia advisories. You should note that Secunia on average issues more than 20 updated advisories per day, containing information about exploit and patch availability, new and in depth research, and all other details that are relevant. Learn more about receiving complete and customised Secunia advisory information:
http://secunia.com/advisories/business_solutions/