The tool allows SSL cipher scanning and enumeration without requiring OpenSSL or SSLeay.

Details here.

This vulnerability could permit remote arbitrary file access and command execution under “less-likely” circumstances.

Full advisory here:
http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf

If it all goes ahead with plan, I’ll be speaking on PHP Code Analysis, so if your around and have a night free please feel free to join in.

XUpload is prone to a buffer overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

An exploit is in the wild. See the SecurityFocus advisory for more details.

Full advisory available here.

I left it with them for 2 weeks before disclosing the advisory. It was fixed within 24hrs of release.

I have bounced a few E-Mails off the CEO, and he has kept in touch, however, nothing yet. So that means I have now left 20K of websites at risk for 20 days and counting…

The bigger players (Microsoft, Cisco etc) with more experience have procedures in place to deal with security issues like this, so "responsible" disclosure makes sense, but by the time this advisory is released, I would have spent the same amount of time (if not more) disclosing the vulnerability then actually researching the vulnerability.

These things are never as black and white as they first appear.

I have often felt that full-disclosure (FD) is the way forward. In other words, we release first and ask questions later. This approach appears to have ‘inspired’ vendors to patch more efficiently in the past, but at the same time it alerts the bad guys to write more exploits!

The argument by FD is that attackers may already be exploiting the vulnerability in the wild and that by releasing FD the security researcher is merely putting out a warning – as one would if a dam wall was about to collapse.

If we can measure and detect attacks on a global scale this argument may be addressed and debated in a better light. I do think FD can be terribly destructive if used by attention seekers who may choose not to release the advisory to the vendor at all.

I have added content to both the Articles and News/Interview Sections.

Content Added
In Articles:
* Paper: Ad-Jacking – XSSing for Fun and Profit
* Presentation: Automated Web FOO or FUD?
In News & Interviews:
* Survey: Finds Most WordPress Blogs Vulnerable
* Vul: Adobe Acrabat JavaScript Vulnerabilities