bugtraq mailing list - 2005/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2005/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 16	² 3
³ 11	⁴ 27	⁵ 17	⁶ 25	⁷ 17	⁸ 22	⁹ 2
¹⁰ 8	¹¹ 11	¹² 38	¹³ 13	¹⁴ 14	¹⁵ 6	¹⁶ 2
¹⁷ 14	¹⁸ 12	¹⁹ 13	²⁰ 17	²¹ 16	²² 3	²³
²⁴ 18	²⁵ 22	²⁶ 19	²⁷ 27	²⁸ 15	²⁹ 3	³⁰ 17
³¹ 18

Messages by day:

October 1 (16 messages)

Re: IIS 5.1 allows for remote viewing of source code on FAT/FAT32 volumes using WebDAV (inge.henriksen@...leansoft.com)
BID #14752 update (Josh Zlatin-Amishav <josh@...s.co.il>)
[SECURITY] [DSA 829-1] New mysql packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 809-2] New squid packages fix denial of service (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 828-1] New squid packages fix denial of service (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 827-1] New backupninja packages fix insecure temporary file (Michael Stone <mstone@...cker.debian.org>)
RE: Re: Bypassing Personal Firewall (Zone Alarm Pro)Using DDE-IPC ("Debasis Mohanty" <mail@...kingspirits.com>)
[SECURITY] [DSA 836-1] New cfengine2 packages fix arbitrary file overwriting (joey@...odrom.org (Martin Schulze))
MyBloggie 2.1.3beta null char + SQL Injection -> Login Bypass (retrogod@...ceposta.it)
[SECURITY] [DSA 835-1] New cfengine packages fix arbitrary file overwriting (joey@...odrom.org (Martin Schulze))
[Information Disclosure] NetForce v4.02 Sends NIS Password Maps with passwords hashes over sendmail (bambenek@...il.com)
[SECURITY] [DSA 833-1] New mysql-dfsg-4.1 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 834-1] New prozilla packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Security Advisory for Bugzilla 2.18.3, 2.20rc2, and 2.21 (mkanat@...zilla.org)
Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides (Jason Coombs <jasonc@...ence.org>)
Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue ("Debasis Mohanty" <mail@...kingspirits.com>)

October 2 (3 messages)

Re: Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides (Steve Kudlak <chromazine@...global.net>)
Re: Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue (Paul Laudanski <zx@...tlecops.com>)
RE: Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue ("Debasis Mohanty" <mail@...kingspirits.com>)

October 3 (11 messages)

RE: Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue (Paul Laudanski <zx@...tlecops.com>)
[ GLSA 200510-01 ] gtkdiskfree: Insecure temporary file creation (Thierry Carrez <koon@...too.org>)
[ GLSA 200510-02 ] Berkeley MPEG Tools: Multiple insecure temporary files (Thierry Carrez <koon@...too.org>)
RE: Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides ("Lachniet, Mark" <mlachniet@...uoianet.com>)
[SECURITY] [DSA 837-1] New Mozilla Firefox packages fix denial of service (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 838-1] New mozilla-firefox packages fox multiple vulnerabilities (Michael Stone <mstone@...cker.debian.org>)
RE: Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue ("Debasis Mohanty" <mail@...kingspirits.com>)
Bypassing Personal Firewall, is it that* hard? (Bipin Gautam <gautam.bipin@...il.com>)
RE: Bypassing Personal Firewall, is it that* hard? ("Debasis Mohanty" <mail@...kingspirits.com>)
RE: Bypassing Personal Firewall, is it that* hard? ("Debasis Mohanty" <mail@...kingspirits.com>)
Re: Bypassing Personal Firewall, is it that* hard? (Oliver Leitner <Shadow333@....at>)

October 4 (27 messages)

Re: Online Dating Software by AEwebworks - aeDating Script <= 4.0 Version Vulnerability (security@...ebworks.com)
Trillian remote crashable (philipp@...mann.at)
Kaspersky Antivirus Remote Heap Overflow (list@...0te.com)
RE: Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides ("L. Adrian Griffis" <agriffis@...systems.com>)
MDKSA-2005:171 - Updated kernel packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
RE: Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue (Paul Laudanski <zx@...tlecops.com>)
RE: Different Claims by ZoneLabs on the "BypassingPersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue ("Todd Towles" <toddtowles@...okshires.com>)
RE: Bypassing Personal Firewall, is it that* hard? ("Aditya Deshmukh" <aditya.deshmukh@...ine.gateway.strangled.net>)
RE: Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides ("dave kleiman" <dave@...cureu.com>)
Re: Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides (Stefano Zanero <s.zanero@...urenetwork.it>)
[USN-193-1] dia vulnerability (Martin Pitt <martin.pitt@...onical.com>)
RE: Different Claims by ZoneLabs on the "BypassingPersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue ("Bart Lansing" <bart.lansing@...hmail.com>)
[USN-155-3] Fixed mozilla locale packages (Martin Pitt <martin.pitt@...onical.com>)
RE: Different Claims by ZoneLabs on the "BypassingPersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue ("Todd Towles" <toddtowles@...okshires.com>)
[SECURITY] [DSA 840-1] New drupal packages fix remote command execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 842-1] New egroupware packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Call for Papers - DIMVA 2006 (thomas@...e.de (Thomas Biege))
[SECURITY] [DSA 839-1] New apachetop packages fix insecure temporary file (joey@...odrom.org (Martin Schulze))
Advisory: WZCS vulnerabilities (donctl <donctl@...il.com>)
RE: Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides ("dave kleiman" <dave@...cureu.com>)
RE: Careless Law Enforcement Computer Forensics Lacking InfoSec Expertise Causes Suicides (Neil Dickey <neil@...l.niu.edu>)
[ GLSA 200510-03 ] Uim: Privilege escalation vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: Careless LEO Forensics and Suicides ("J. Oquendo" <sil@...iltrated.net>)
Re: Bypassing Personal Firewall, is it that* hard? (Bipin Gautam <gautam.bipin@...il.com>)
[security bulletin] SSRT051041 rev.0 - HP-UX Mozilla Remote Unauthorized Execution of Privileged Code or Denial of Service (DoS) (security-alert@...com)
[SECURITY] [DSA 833-2] New mysql-dfsg-4.1 package fixes arbitrary code execution (joey@...odrom.org (Martin Schulze))
iDEFENSE Security Advisory 10.04.05: UW-IMAP Netmailbox Name Parsing Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)

October 5 (17 messages)

iDEFENSE Security Advisory 10.04.05: Symantec AntiVirus Scan Engine Web Service Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
RE: iDEFENSE Security Advisory 10.04.05: Symantec AntiVirus Scan Engine Web Service Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
A common researcher diagnosis error: misreading error messages ("Steven M. Christey" <coley@...re.org>)
[security bulletin] SSRT051040 rev.0 - HP-UX Mozilla Remote Unauthorized Execution of Privileged Code (security-alert@...com)
[security bulletin] SSRT5940 rev.2 - HP-UX Mozilla remote, unauthorized user may execute privileged code (security-alert@...com)
[security bulletin] SSRT051030 rev.1 - HP OpenView Event Correlation Services (OV ECS) Remote Unauthorized Privileged Access (security-alert@...com)
[security bulletin] SSRT051023 rev.5 - HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Privileged Access (security-alert@...com)
RE: Re: Careless LEO Forensics and Suicides ("Aditya Deshmukh" <aditya.deshmukh@...ine.gateway.strangled.net>)
[ GLSA 200510-04 ] Texinfo: Insecure temporary file creation (Thierry Carrez <koon@...too.org>)
Secunia Research: ALZip Multiple Archive Handling Buffer Overflow (Secunia Research <vuln@...unia.com>)
PAKCON II: Call for Paper (CfP), Final Call! (Ayaz Ahmed Khan <ayaz@...con.org>)
Patches available for critical flaws in HP Openview ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Security Contact at Skype ("Mark Litchfield" <mark@...software.com>)
[SECURITY] [DSA 843-1] New arc packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
RE: Advisory: WZCS vulnerabilities ("Brian J. Bartlett" <brian.bartlett@...il.com>)
[SECURITY] [DSA 844-1] New mod-auth-shadow packages fix authentication bypass (joey@...odrom.org (Martin Schulze))
Some new whitepapers ... ("David Litchfield" <davidl@...software.com>)

October 6 (25 messages)

Secunia Research: Webroot Desktop Firewall Two Vulnerabilities (Secunia Research <vuln@...unia.com>)
Secunia Research: PHP-Fusion Two SQL Injection Vulnerabilities (Secunia Research <vuln@...unia.com>)
[USN-194-1] texinfo vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200510-05 ] Ruby: Security bypass vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200510-06 ] Dia: Arbitrary code execution through SVG import (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Secunia Research: HAURI Anti-Virus ALZ Archive Handling Buffer Overflow (Secunia Research <vuln@...unia.com>)
RE: Some new whitepapers ... ("Lila Buchalski" <lbuchalski@...nsinc.com>)
Announcement : Core Banking Application Security List ("Lila Buchalski" <lbuchalski@...nsinc.com>)
[security bulletin] SSRT4743, SSRT4884 rev.1 - HP Tru64 UNIX TCP/IP remote Denial of Service (DoS) (security-alert@...com)
Planet Technology Corp FGSW2402RS switch default password / "backdoor" (lms@...up.pt)
WASC Threat Classification in 4 languages (contact@...appsec.org)
[security bulletin] SSRT051004 rev.1 - HP-UX Java Runtime Environment (JRE) Untrusted Applet Elevates Privilege (security-alert@...com)
Secunia Research: PHP-Fusion Two SQL Injection Vulnerabilities (vuln@...unia.com)
aspReady FAQ - open for SQL-injections (preben@...chcom.no)
Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers ("David Litchfield" <davidl@...software.com>)
High Risk Vulnerability in Sun Directory Server ("NGSSoftware Insight Security Research" <nisr@...software.com>)
[SECURITY] [DSA 845-1] New mason packages fix missing init script (joey@...odrom.org (Martin Schulze))
Re: Some new whitepapers ... (Jerome Athias <jerome.athias@...e.fr>)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (Rainer Duffner <rainer@...ra-secure.de>)
xloadimage buffer overflow. ("Ariel Berkman" <aberkm1@....edu>)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers ("David Litchfield" <davidl@...software.c…)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (Cesar <cesarc56@...oo.com>)
Security contact for ... (EMendoza <erikam@...il.com>)
Re: Security contact for ... (Sullo <sullo@...t.net>)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (Rainer Duffner <rainer@...ra-secure.de>)

October 7 (17 messages)

MailEnable W3C Logging Remote Buffer Overflow Proof of Concept (advisory@...ecom.org)
Re: MailEnable W3C Logging Remote Buffer Overflow Proof of Concept (user1 <user1@...ro>)
[SECURITY] [DSA 846-1] New cpio packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[security bulletin] SSRT051043 rev.0 - Apache Remote Unauthorized access (security-alert@...com)
[security bulletin] SSRT051003 rev.1 - HP-UX Java Web Start remote unauthorized privileged access (security-alert@...com)
Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB (ak@...-database-security.com)
Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB (ak@...-database-security.com)
Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus (ak@...-database-security.com)
[ GLSA 200510-07 ] RealPlayer, Helix Player: Format string vulnerability (Thierry Carrez <koon@...too.org>)
Cross-Site-Scripting Vulnerability in Oracle XMLDB (ak@...-database-security.com)
Shutdown TNS Listener via Oracle iSQL*Plus (ak@...-database-security.com)
Shutdown TNS Listener via Oracle Forms Servlet (ak@...-database-security.com)
MDKSA-2005:172 - Updated openssh packages fix GSSAPI credentials vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:173 - Updated mozilla-firefox packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:174 - Updated mozilla-thunderbird packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:175 - Updated texinfo packages fix temporary file vulnerability (Mandriva Security Team <security@...driva.com>)
gnome-pty-helper writes arbitrary utmp records (Paul Szabo <psz@...hs.usyd.edu.au>)

October 8 (22 messages)

Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (Gadi Evron <ge@...uxbox.org>)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers ("David Litchfield" <davidl@...software.c…)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (Gadi Evron <ge@...uxbox.org>)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers ("David Litchfield" <davidl@...software.c…)
Re: Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (ak@...-database-security.com)
Aenovo Multiple Vulnerabilities (advisory@...da.ir)
Re: [Dailydave] Security contact for ... (security curmudgeon <jericho@...rition.org>)
Utopia News Pro 1.1.3 SQL Injection / cross site scripting (retrogod@...ceposta.it)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers ("Ivan ." <ivanhec@...il.com>)
Re: Security contact for ... ("Williams, James K" <James.Williams@...com>)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (Radoslav Dejanović <radoslav.dejanovic@…)
[ GLSA 200510-08 ] xine-lib: Format string vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200510-09 ] Weex: Format string vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[SECURITY] [DSA 849-1] New shorewall packages fix firewall bypass (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 848-1] New masqmail packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 847-1] New dia packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Cyphor 0.19 SQL Injection / Board takeover / cross site scripting (retrogod@...ceposta.it)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers (Tony Jambu <tjambu@...yrinth.net.au>)
Re: Opinion: Complete failure of Oracle security response and utter neglect of their responsibility to their customers ("Kurt Seifried" <bt@...fried.org>)
MDKSA-2005:177 - Updated hylafax packages fix temporary file vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:176 - Updated webmin package fixes authentication bypass vulnerability (Mandriva Security Team <security@...driva.com>)
Antivirus detection bypass by special crafted archive. (unsecure@...teme.com)

October 9 (2 messages)

Re: Antivirus detection bypass by special crafted archive. (Thierry Zoller <Thierry@...ff-em.com>)
RE: Re: Antivirus detection bypass by special craftedarchive. (<ad@...ss101.org>)

October 10 (8 messages)

[USN-195-1] Ruby vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-196-1] Xine library vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-197-1] Shorewall vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-198-1] cfengine vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
phpMyAdmin Local file inclusion 2.6.4-pl1 (Maksymilian Arciemowicz <max@...tsuper.pl>)
[USN-199-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
iDEFENSE Security Advisory 10.10.05: SGI IRIX runpriv Design Error Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 10.10.05: Kaspersky Anti-Virus Engine CHM File Parser Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)

October 11 (11 messages)

[USN-200-1] Thunderbird vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200510-10 ] uw-imap: Remote buffer overflow (Thierry Carrez <koon@...too.org>)
Secunia Research: WinRAR Format String and Buffer Overflow Vulnerabilities (Secunia Research <vuln@...unia.com>)
[USN-201-1] SqWebmail vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
iDEFENSE Security Advisory 10.11.05: Microsoft Distributed Transaction Controller TIP DoS Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 10.11.05: Microsoft Distributed Transaction Controller Packet Relay DoS Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
CodeCon 2006 Call For Papers (Len Sassaman <rabbi@...itum.com>)
[EEYEB20050803] - Windows UMPNPMGR wsprintfW Stack Buffer Overflow Vulnerability (<Advisories@...e.com>)
[EEYEB20050915] - MDT2DD.DLL COM Object Uninitialized Heap Memory Vulnerability (<Advisories@...e.com>)
[EEYEB20050708] Microsoft Distributed Transaction Coordinator Memory Modification Vulnerability (<Advisories@...e.com>)
[EEYEB20050510] - Microsoft DirectShow Remote Code Vulnerability (<Advisories@...e.com>)

October 12 (38 messages)

The Malloc Maleficarum ("Phantasmal Phantasmagoria" <phantasmal@...h.ai>)
[KDE Security Advisory] KOffice/KWord RTF import buffer overflow (Dirk Mueller <mueller@....org>)
XSS vulnerability in Zeroblog (alireza hassani <trueend5@...oo.com>)
FreeBSD Security Advisory FreeBSD-SA-05:21.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 862-1] New Ruby 1.6 packages fix safety bypass (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 861-1] New uw-imap packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 860-1] New Ruby packages fix safety bypass (joey@...odrom.org (Martin Schulze))
versatileBulletinBoard V1.0.0 RC2 (possibly prior versions) multiple SQL injection vulnerabilities / login bypass / board takeover (rgod@...ceposta.it)
[SECURITY] [DSA 859-1] New xli packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 858-1] New xloadimage packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITYREASON.COM] phpMyAdmin Local file inclusion 2.6.4-pl1 (max@...tsuper.pl)
PullThePlug Contest: Call For Papers (announcements@...ltheplug.org)
Re: Opinion: Complete failure of Oracle security response and utter neglect of t ("Silent / Saracoth" <saracoth@...mail.com>)
[SECURITY] [DSA 857-1] New graphviz packages fix insecure temporary file (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 856-1] New py2play packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 855-1] New weex packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Announcement: The Web Application Firewall Evaluation Criteria v1 (contact@...appsec.org)
[SECURITY] [DSA 854-1] New tcpdump packages fix denial of service (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 853-1] New ethereal packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 852-1] New up-imapproxy packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 851-1] New openvpn packages fix denial of service (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 850-1] New tcpdump packages fix denial of service (joey@...odrom.org (Martin Schulze))
Cenzic NASL plugins ("sec stuff" <sec-stuff@...mail.com>)
[USN-202-1] KOffice vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[SEC-1 Advisory] GFI MailSecurity 8.1 Web Module Buffer Overflow ("Gary Oleary-Steele" <garyo@...-1.com>)
[ GLSA 200510-11 ] OpenSSL: SSL 2.0 protocol rollback (Thierry Carrez <koon@...too.org>)
Linux Orinoco drivers information leakage (Meder Kydyraliev <meder@....nu>)
Secunia Research: Novell NetMail NMAP Agent "USER" Buffer Overflow Vulnerability (Secunia Research <vuln@...unia.com>)
using php local file include vulnerabilities for command execution (Andreas Zeidler <az@...c.de>)
MDKSA-2005:180 - Updated xine-lib packages fixes cddb vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:179 - Updated openssl packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: using php local file include vulnerabilities for command execution (Andreas Zeidler <az@...c.de>)
MDKSA-2005:178 - Updated squirrelmail packages fixes XSS vulberability (Mandriva Security Team <security@...driva.com>)
[SECURITY] [DSA 863-1] New xine-lib packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
MDKSA-2005:181 - Updated squid packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: [SECURITYREASON.COM] phpMyAdmin Local file inclusion 2.6.4-pl1 (Andreas Zeidler <az@...c.de>)
Research for network security news article (lgreenem@....com)
[SEC-1 Advisory] Collaboration Data Objects Buffer Overflow Vulnerability ("Gary Oleary-Steele" <garyo@...-1.com>)

October 13 (13 messages)

VERITAS NetBackup: Java User-Interface, format string vulnerability (secure@...antec.com)
Re: VoIP-Phones: Weakness in proccessing SIP-Notify-Messages (Tobias Glemser <tglemser@...e-consulting.com>)
ZDI-05-001: VERITAS NetBackup Remote Code Execution (zdi-disclosures@...m.com)
honeypot and honeynet as IDS ("Krish Mehak" <cs_karishma@...mail.com>)
Re: Cenzic NASL plugins (Michael Boman <michael.boman@...il.com>)
Kerio Personal Firewall and Kerio Server Firewall FWDRV driver Local Denial of Service (Piotr Bania <bania.piotr@...il.com>)
[USN-203-1] Abiword vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 865-1] New hylafax packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 864-1] New Ruby 1.8 packages fix safety bypass (joey@...odrom.org (Martin Schulze))
Yapig: XSS / Code Injection Vulnerability (enji@...osys.tuwien.ac.at)
iDEFENSE Security Advisory 10.13.05: Multiple Vendor XMail 'sendmail' Recipient Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 10.13.05: Multiple Vendor wget/curl NTLM Username Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Secunia Research: AhnLab V3 Antivirus ALZ/UUE/XXE Archive Handling Buffer Overflow (Secunia Research <vuln@...unia.com>)

October 14 (14 messages)

[security bulletin] SSRT051041 rev.1 - HP-UX Mozilla Remote Unauthorized Execution of Privileged Code or Denial of Service (DoS) (security-alert@...com)
[security bulletin] SSRT5975 HP-UX Running on Itanium Platforms Local Denial of Service (DoS) (Security Alert <secure@...hs.cup.hp.com>)
[ GLSA 200510-12 ] KOffice, KWord: RTF import buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[USN-204-1] SSL library vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-205-1] Curl and wget vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Re: Antivirus detection bypass by special crafted archive. ("Williams, James K" <James.Williams@...com>)
RTasarim WebAdmin modul SQL injection (khc@...mail.org, and@...urityfocus.com, www.clankurd.tk@...urityfocus.com)
Google Talk cleartext proxy credentials vulnerability (m123303@...hmond.ac.uk)
MDKSA-2005:182 - Updated curl packages fix NTLM authentication vulnerability (Mandriva Security Team <security@...driva.com>)
Airscanner Mobile Security Advisory #05101001: iTunes Shared Music Denial of Service/Spoofing/Flooding/Abuse (Seth Fogie <seth@...scanner.com>)
MDKSA-2005:183 - Updated wget packages fix NTLM authentication vulnerability (Mandriva Security Team <security@...driva.com>)
Gallery 2.x Remote File Access Vulnerability (Bharat Mediratta <bharat@...alto.com>)
CAID 33485 - Computer Associates iGateway debug mode HTTP GET request buffer overflow vulnerability ("Williams, James K" <James.Williams@...com>)
Trusted Digital, Trusted Mobility Suite Authorization Bypass Vulnerability (none@...urityfocus.com)

October 15 (6 messages)

MDKSA-2005:184 - Updated cfengine packages fix temporary file vulnerabilities (Mandriva Security Team <security@...driva.com>)
[ GLSA 200510-13 ] SPE: Insecure file permissions (Thierry Carrez <koon@...too.org>)
[KAPDA::#6] Punbb SQL Injection Vulnerability (advisory@...da.ir)
Security Contacr for Mycall (Fixer <fixer@....net>)
MDKSA-2005:185 - Updated koffice packages fix KWord RTF import overflow vulnerability (Mandriva Security Team <security@...driva.com>)
Re: Google Talk cleartext proxy credentials vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)

October 16 (2 messages)

Exploiting Windows Device Drivers Whitepaper (Piotr Bania <bania.piotr@...il.com>)
Ciscos VPN-Client-Passwords can be decrypted (Thierry Zoller <Thierry@...ff-em.com>)

October 17 (14 messages)

Lynx Remote Buffer Overflow (Ulf Harnhammar <metaur@...ia.com>)
[ GLSA 200510-14 ] Perl, Qt-UnixODBC, CMake: RUNPATH issues (Thierry Carrez <koon@...too.org>)
flexbackup default config insecure temporary file creation (ZATAZ Audits <exploits@...az.net>)
[USN-206-1] Lynx vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-207-1] PHP vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-208-1] graphviz vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200510-15 ] Lynx: Buffer overflow in NNTP processing (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200510-16 ] phpMyAdmin: Local file inclusion vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[USN-208-1] SSH server vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Yahoo RSS XSS Vulnerability (Correction) (alljer@...il.com)
SUSE Security Announcement: OpenWBEM (SUSE-SA:2005:060) (krahmer@...e.de (Sebastian Krahmer))
ie7 will have more mechanisms (liudieyu@...rella.name)
[OpenPKG-SA-2005.022] OpenPKG Security Advisory (openssl) (OpenPKG <openpkg@...npkg.org>)
Yahoo RSS XSS Vulnerability (alljer@...il.com)

October 18 (12 messages)

PHP local safedir restriction bypass (slythers@...il.com)
Re: Aenovo Multiple Vulnerabilities (Patch) (ali202@...termail.com)
winrar 3.50 Exploit (edward11@...tmaster.co.uk)
Re: Kerio Personal Firewall and Kerio Server Firewall FWDRV driver Local Denial of Service (Paul Laudanski <zx@...tlecops.com>)
Re: [USN-208-1] SSH server vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-210-1] netpbm vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Secunia Research: MySource Cross-Site Scripting and File Inclusion Vulnerabilities (Secunia Research <vuln@...unia.com>)
Re: Ciscos VPN-Client-Passwords can be decrypted (Clayton Kossmeyer <ckossmey@...co.com>)
SECURECon 2006 Call for papers! (Will Belcher <wbelcher@...sics.unimelb.edu.au>)
MDKSA-2005:186 - Updated lynx packages fix remote buffer overflow (Mandriva Security Team <security@...driva.com>)
NetFlow Analyzer 4 XSS Vulnerability (why@...ocus.com)
e107 remote commands execution (retrogod@...ceposta.it)

October 19 (13 messages)

Windows host based firewall tester (Tim <pand0ra.usa@...il.com>)
Linksys WRT54G/S Directory Traversal (Shell <shell6@...il.com>)
Re: [KAPDA::#6] Punbb SQL Injection Vulnerability (arpen@...e.se)
Re: Require many large corporate emails for contact regarding vulnerability. (dcrab@...kerscenter.com)
Multiple Critical and High Vulnerabilities in Oracle Database Server ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
paros proxy v3.2.5 and below blank "sa" password (Andrew Christensen <anc@...tconsult.net>)
Revision: Multiple Critical and High Vulnerabilities in Oracle Database Server ("David Litchfield" <davidl@...software.com>)
Metasploit Framework v2.5 (H D Moore <sflist@...italoffense.net>)
SUSE Security Announcement: openSSL protocol downgrade attack (SUSE-SA:2005:061) (Marcus Meissner <meissner@...e.de>)
Re: [KAPDA::#6] Punbb SQL Injection Vulnerability (alireza hassani <trueend5@...oo.com>)
SecurityAlert SA025 : PHPNuke Remote Directory Traversal (sp3x@...urityreason.com)
Re: Windows host based firewall tester (Morten Torstensen <morten@...tent.org>)
cacam_logsecurity_win32 exploit published on 20051018 by Metasploit ("Williams, James K" <James.Williams@...com>)

October 20 (17 messages)

Cisco Security Advisory:Cisco 11500 Content Services Switch SSL Malformed Client Certificate Vulnerability (Cisco Systems Product Security Incident Response Tea…)
[ GLSA 200510-17 ] AbiWord: New RTF import buffer overflows (Thierry Carrez <koon@...too.org>)
[ GLSA 200510-18 ] Netpbm: Buffer overflow in pnmtopng (Thierry Carrez <koon@...too.org>)
[USN-211-1] Enigmail vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[security bulletin] SSRT051052 rev.0 - HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE) Remote Privileged A… (security-alert@...com)
[SECURITY] [DSA 868-1] New Mozilla Thunderbird packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
RE: CAID 33485 - Computer Associates iGateway debug mode HTTP GET request buffer overflow vulnerability ("Williams, James K" <James.Williams@...com>)
XSS & Path Disclosure in Chipmunk's products (alireza hassani <trueend5@...oo.com>)
Oracle 10g - emagent.exe Stack-Based Overflow ("SPI Labs" <Spi.Labs@...dynamics.com>)
[SECURITY] [DSA 866-1] New Mozilla packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Oracle Workflow CSS Vulnerability wf_monitor (ak@...-database-security.com)
[SECURITY] [DSA 867-1] New module-assistant package fixes insecure temporary file (joey@...odrom.org (Martin Schulze))
Oracle Workflow CSS Vulnerability wf_route (ak@...-database-security.com)
Vulnerabilities in Oracle E-Business Suite 11i - Critical Patch Update October 2005 ("Integrigy Security" <alerts@...egrigy.com>)
iDEFENSE Security Advisory 10.20.05: Multiple Vendor Ethereal srvloc Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 10.20.05: Symantec Norton AntiVirus LiveUpdate Local Privilege Escalation ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 10.20.05: Symantec Norton AntiVirus DiskMountNotify Local Privilege Escalation ("iDEFENSE Labs" <labs-no-reply@...fense.com>)

October 21 (16 messages)

UnixWare 7.1.4 UnixWare 7.1.3 : ppp buffer overflow (please_reply_to_security@....com)
OpenServer 5.0.7 : authsh and backupsh buffer overflow (please_reply_to_security@....com)
SEC-CONSULT-SA-20051021-0: Yahoo/MSIE XSS (Bernhard Mueller <research@...-consult.com>)
Secunia Research: ZipGenius Multiple Archive Handling Buffer Overflow (Secunia Research <vuln@...unia.com>)
[Argeniss] Story of a dumb patch (Paper advisoryabout CSRSS and Windows Explorer vulnerabilities) (Cesar <cesarc56@...oo.com>)
[SECURITY] [DSA 869-1] New eric packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Nuked klan 1.7: XSS vulnerability (papipsycho@...mail.com)
MDKSA-2005:187 - Updated dia packages fix python SVG import vulnerability. (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:188 - Updated graphviz packages fix temporary file vulnerability. (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:189 - Updated imap packages fix buffer overflow vulnerabilities. (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:190 - Updated nss_ldap/pam_ldap packages fix privilege vulnerabilities. (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:191 - Updated ruby packages fix safe level and taint flag protections vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:192 - Updated xli packages fix buffer overflow vulnerabilities. (Mandriva Security Team <security@...driva.com>)
[SNS Advisory No.84] Oracle Application Server HTTP Response Splitting Vulnerability (snsadv@....co.jp (snsadv))
[security bulletin] SSRT051052 rev.1 - HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE) Remote Privileged A… (security-alert@...com)
Windows UMPNPMGR wsprintfW Stack Buffer Overflow Vulnerability PoC (ppwd25@...mail.com)

October 22 (3 messages)

[ GLSA 200510-19 ] cURL: NTLM username stack overflow (Thierry Carrez <koon@...too.org>)
Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability (Stefan Esser <sesser@...dened-php.net>)
vhost enumeration (unknown unknown <unknown.pentester@...il.com>)

October 24 (18 messages)

php < 4.4.1 htaccess apache dos ("Eric Romang / ZATAZ.com" <exploits@...az.net>)
phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (alphakgen@...il.com)
Revised draft on ICMP attacks (Fernando Gont <fernando@...t.com.ar>)
PhpNuke 7.8 with all security fixes/patches "Your_Account", "Downloads", "Web Links" SQL Injection / Remote commans execution (retrogod@...ceposta.it)
DBoardGear SQL Injection (almaster@...mail.com)
SUSE Security Announcement: permissions (SUSE-SA:2005:062) (Ludwig Nussel <ludwig.nussel@...e.de>)
DCP - portal XSS & SQL attacks (alex@...ksanet.com)
Remote File Inclusion in forum PunBB ("rod hedor" <rodhedor@...mail.com>)
TSLSA-2005-0059 - multi (Trustix Security Advisor <tsl@...stix.org>)
Nuked klan 1.7: Bypassed level admin on forum(corrected) (papipsycho@...mail.com)
[security bulletin] SSRT051055 rev.0 - HP Oracle for OpenView (OfO) Critical Patch Update October 2005 (security-alert@...com)
Insecure Temporary Files in BMC/Control-M Agent (Scott Cromar <scottcromar@...oo.com>)
Possible Bug in PHP-Fusion 6.0.204 (peanut@...ck-rat.no-ip.com)
aRCHILLES Newsworld < 1.5.0-rc1 Multiple Vulnerabilities (chburchert@....de)
[KAPDA::#8] Domain Manager Pro Vulnerability (advisory@...urityfocus.com, kapda.ir@...urityfocus.com)
SQL saphp Lesson (almaster@...mail.com)
File Including In FLAT NUKE (abducter_minds@...oo.com)
Zomplog Script Injection Vulnerability =>3.4 (all versions vulnerable) (sikikmail@...il.com)

October 25 (22 messages)

Nuked klan 1.7: Remote Exploit (papipsycho@...mail.com)
Nuked klan 1.7: SQL vulnerability (papipsycho@...mail.com)
iDEFENSE Security Advisory 10.24.05: SCO Openserver backupsh 'Home' Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 10.24.05: SCO Openserver authsh 'Home' Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 10.24.05: SCO Unixware Setuid ppp prompt Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Flat Nuke Cross Site Scripting (alex@...ksanet.com)
Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte ("Andrey Bayora" <andrey@...urityelf.org>)
[ GLSA 200510-20 ] Zope: File inclusion through RestructuredText (Thierry Carrez <koon@...too.org>)
[ GLSA 200510-21 ] phpMyAdmin: Local file inclusion and XSS vulnerabilities (Thierry Carrez <koon@...too.org>)
PHP iCalendar CSS (ascii <ascii@...amail.com>)
Skype security advisory (. EADS CCR DCR/STI/C <dcrstic.ccr@...s.net>)
DboardGear - uncorrect import themes (SQL-inject) (poizon@...urityinfo.ru)
Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through ("Andrey Bayora" <andrey@...urityelf.org>)
[SECURITY] [DSA 871-1] New libgda2 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
SEC-Consult SA 20051025-0 :: Snoopy Remote Code Execution Vulnerability (Bernhard Mueller <research@...-consult.com>)
SEC-Consult SA 20051025-1 :: RSA ACE Web Agent XSS (Bernhard Mueller <research@...-consult.com>)
[SNS Advisory No.85] XOOPS Multiple Cross-site Scripting Vulnerabilities (snsadv@....co.jp (snsadv))
phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Paul Laudanski <zx@...tlecops.com>)
Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Tatercrispies <tatercrispies@...il.com>)
Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Paul Laudanski <zx@...tlecops.com>)
[SECURITY] [DSA 870-1] New sudo packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
RE: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte ("Debasis Mohanty" <mail@...kingspirits.com>)

October 26 (19 messages)

Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Tatercrispies <tatercrispies@...il.com>)
RE: Possible Bug in PHP-Fusion 6.0.204 ("Paul" <pvnick@...il.com>)
Mozilla Thunderbird SMTP down-negotiation weakness (Thomas Henlich <thomas@...lich.de>)
Network Appliance iSCSI Authentication Bypass (advisories@...asano.com)
Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte ("Andrey Bayora" <andrey@...urityelf.org>)
[SECURITY] [DSA 871-2] New libgda2 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
SparkleBlog Journal.php HTML Injection Vulnerability =>v2.1 (all versions vulnerable) (sikikmail@...il.com)
Looking for security contacts at Sony and Lenovo (FKA IBM) ("Richard M. Smith" <rms@...puterbytesman.com>)
[SECURITY] [DSA 548-2] New imlib packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
MDKSA-2005:193 - Updated ethereal packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
Looking for a security contact at Macrovision/InstallShield ("Richard M. Smith" <rms@...puterbytesman.com>)
Re: Mozilla Thunderbird SMTP down-negotiation weakness (Jason Haar <Jason.Haar@...mble.co.nz>)
Woltlab Burning Board info_db.php multiple SQL injection (admin@...znet.com)
Secunia Research: Mantis "t_core_path" File Inclusion Vulnerability (Secunia Research <vuln@...unia.com>)
SQL-Injection in MyBulletinBoard allows attacker to become a board admin. (Animal <cOre@...er.ru>)
Update for the magic byte bug ("Andrey Bayora" <andrey@...urityelf.org>)
[SECURITY] [DSA 873-1] New net-snmp packages fix denial of service (joey@...odrom.org (Martin Schulze))
[KAPDA::#9] Techno Dreams Scripts Vulnerabilities (advisory@...da.ir)
Re: Mozilla Thunderbird SMTP down-negotiation weakness (Tony Finch <dot@...at.at>)

October 27 (27 messages)

MDKSA-2005:197 - Updated unzip packages fix suid, permissions vulnerabilities. (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:193-1 - Updated ethereal packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through ("Andrey Bayora" <andrey@...urityelf.org>)
MDKSA-2005:198 - Updated uim packages fix suid linking vulnerabilities. (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:195 - Updated squid packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:186-1 - Updated lynx packages fix remote buffer overflow (Mandriva Security Team <security@...driva.com>)
Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through (Andreas Marx <gega-it@....de>)
MDKSA-2005:194 - Updated php-imap packages fix buffer overflow vulnerabilities. (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:196 - Updated perl-Compress-Zlib packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
[SECURITY] [DSA 872-1] New koffice packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
PHP-Nuke Cross-Site Scripting Vulnerability (bhfh01@...il.com)
RE: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte ("Debasis Mohanty" <mail@...kingspirits.com>)
MDKSA-2005:199 - Updated netpbm packages fix pnmtopng vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte ("Andrey Bayora" <andrey@...urityelf.org>)
Re: SEC-Consult SA 20051025-0 :: Snoopy Remote Code Execution Vulnerability (Florian Weimer <fw@...eb.enyo.de>)
Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte ("Eygene A. Ryabinkin" <rea@....mbslab.kiae.ru>)
fetchmail security announcement 2005-02 (CVE-2005-3088) (ma+nomail@...e-technik.uni-dortmund.de)
Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Nicob <nicob@...ob.net>)
Re: Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Tatercrispies <tatercrispies@...il.com>)
Re: SEC-Consult SA 20051025-0 :: Snoopy Remote Code Execution Vulnerability ("SEC Consult Research" <research@...-consult.com>)
[CIRT.DK] - Novell ZENworks Patch Management Server 6.0.0.52 - SQL injection ("CIRT.DK Advisory" <advisory@...t.dk>)
Re: Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Nicob <nicob@...ob.net>)
[SECURITY] [DSA 874-1] New lynx packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
fetchmail security announcement 2005-02 (CVE-2005-3088) (ma+nomail@...e-technik.uni-dortmund.de)
[SECURITY] [DSA 875-1] New OpenSSL packages fix cryptographic weakness (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 876-1] New lynx-ssl packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Secunia Research: ATutor Multiple Vulnerabilities (Secunia Research <vuln@...unia.com>)

October 28 (15 messages)

Multiple vulnerabilities within RockLiffe MailSite Express WebMail ("Paul Craig" <paul.craig@...urity-assessment.com>)
[ GLSA 200510-22 ] SELinux PAM: Local password guessing attack (Thierry Carrez <koon@...too.org>)
[ GLSA 200510-23 ] TikiWiki: XSS vulnerability (Thierry Carrez <koon@...too.org>)
[ GLSA 200510-24 ] Mantis: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte (Bipin Gautam <gautam.bipin@...il.com>)
[SECURITY] [DSA 878-1] New netpbm-free packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
MDKSA-2005:201 - Updated sudo packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
[SECURITY] [DSA 877-1] New gnump3d packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
MDKSA-2005:200 - Updated apache-mod_auth_shadow packages fix security restriction bypass issues. (Mandriva Security Team <security@...driva.com>)
[USN-212-1] libgda2 vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-213-1] sudo vulnerability (Martin Pitt <martin.pitt@...onical.com>)
iDefense Security Advisory 10.28.05: Multiple Vendor chmlib CHM File Handling Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Re: [ GLSA 200510-23 ] TikiWiki: XSS vulnerability (Thierry Carrez <koon@...too.org>)
Re: [ GLSA 200510-23 ] TikiWiki: XSS vulnerability (dave canuck <dave_canuck2001@...oo.com>)
File Including In PBLang (abducter_minds@...oo.com)

October 29 (3 messages)

[USN-151-3] zlib vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-206-2] Fixed lynx packages for USN-206-1 (Martin Pitt <martin.pitt@...onical.com>)
Trend Micro's Response to the Magic Byte Bug ("Auri Rahimzadeh" <auri@...i.net>)

October 30 (17 messages)

Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. (Paul Laudanski <zx@...tlecops.com>)
Remote File Inclusion in vCard :) (X@...urityfocus.com, "[AT]"@securityfocus.com, Hotmail@...urityfocus.com, "[D0T].CoM"@securityfocus.com)
Re: Mozilla Thunderbird SMTP down-negotiation weakness (Bob Beck <beck@...h.cns.ualberta.ca>)
Re: Mozilla Thunderbird SMTP down-negotiation weakness (Jason Haar <Jason.Haar@...mble.co.nz>)
Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through (Dave English <dave.english@...s.net>)
Remote MySQL User on Cpanel Default installation with blank password (sup3r_linux@...mail.com)
Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte ("Williams, James K" <James.Williams@...com>)
Re: Network Appliance iSCSI Authentication Bypass (Steve Shockley <steve.shockley@...ckley.net>)
Re: Network Appliance iSCSI Authentication Bypass (steve.shockley@...ckley.net)
Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through (mgotts@...ads.com)
Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through ("Andrey Bayora" <andrey@...urityelf.org>)
Vulnerability in MG2 php based Image Gallery - bypass security, view password protected images (preben@...chcom.no)
Re: Remote File Inclusion in forum PunBB (arpen@...urityfocus.com, home@...urityfocus.com, se@...urityfocus.com)
Mirabilis ICQ 2003a Buffer Overflow Download Shellcoded Exploit (atmaca@...mail.com)
uplod phpshell in PHP Advanced Transfer Manager (sQl@...mail.com)
[ GLSA 200510-25 ] Ethereal: Multiple vulnerabilities in protocol dissectors (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200510-26 ] XLI, Xloadimage: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

October 31 (18 messages)

Advisory 17/2005: phpBB Multiple Vulnerabilities (Stefan Esser <sesser@...dened-php.net>)
Security, Hacking & Social Engineering Presentation. (Emmanuel Goldstein <goldstein101@...il.com>)
Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() (Stefan Esser <sesser@...dened-php.net>)
Advisory 19/2005: PHP register_globals Activation Vulnerability in parse_str() (Stefan Esser <sesser@...dened-php.net>)
Advisory 20/2005: PHP File-Upload $GLOBALS Overwrite Vulnerability (Stefan Esser <sesser@...dened-php.net>)
New List (David Ahmad <da@...urityfocus.com>)
Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() (Matthew Murphy <mattmurphy@...rr.com>)
phpbb 2.0.18 release (Paul Laudanski <zx@...tlecops.com>)
Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() (Matthew Murphy <mattmurphy@...rr.com>)
Re: Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() (Florian Weimer <fw@...eb.enyo.de>)
Re: Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() (Stefan Esser <sesser@...dened-php.net>)
Re: Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() (Florian Weimer <fw@...eb.enyo.de>)
Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() (Matthew Murphy <mattmurphy@...rr.com>)
OpenVPN[v2.0.x]: foreign_option() formart string vulnerability. (v9 <v9@...ehalo.us>)
SQL In Invision Gallery 2.0.3 (almaster@...mail.com)
mwcollect v3.0.0 Release (Georg Wicherski <georg-wicherski@...el-house.net>)
SQL IN FORUM.PHP (ABDUCTER_MINDS@...OO.COM)
Re: uplod phpshell in PHP Advanced Transfer Manager (D_BuG <d_bug@...ru>)

446 messages

Powered by blists - more mailing lists