bugtraq mailing list - 2006/11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2006/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 22	² 16	³ 15	⁴ 14	⁵
⁶ 31	⁷ 15	⁸ 22	⁹ 15	¹⁰ 11	¹¹	¹²
¹³ 36	¹⁴ 44	¹⁵ 15	¹⁶ 30	¹⁷ 55	¹⁸ 23	¹⁹
²⁰ 29	²¹ 45	²² 22	²³ 15	²⁴ 23	²⁵ 14	²⁶
²⁷ 21	²⁸ 23	²⁹ 26	³⁰ 9

Messages by day:

November 1 (22 messages)

iDefense Security Advisory 10.27.06: Novell eDirectory NMAS BerDecodeLoginDataRequeset DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.31.06: Novell iManager Tomcat DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.31.06: Sophos Anti-Virus Petite File Denial of Service Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Multiple XSS Vulnerabilities in Zend Google Data Client Library Preview 0.2.0 (security@...orize.com)
Re: Re: Simple Machines Forum (SMF) XSS issue (oldiesmann@...plemachines.org)
Re[3]: New Flaw in Firefox 2.0: DoS and possible remote code execution (3APA3A <3APA3A@...URITY.NNOV.RU>)
[USN-370-1] screen vulnerability (Kees Cook <kees@...ntu.com>)
[USN-371-1] Ruby vulnerability (Kees Cook <kees@...ntu.com>)
Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech" ("LegendaryZion" <moskito@...le.net.il>)
Re: phpLedAds 2.0(dir) File Include (Stefano Zanero <s.zanero@...urenetwork.it>)
Cisco Security Advisory: Cisco Security Agent Management Center LDAP Administrator Authentication Bypass (Cisco Systems Product Security Incident Response Team …)
[USN-373-1] mutt vulnerabilities (Kees Cook <kees@...ntu.com>)
Asterisk Local and Remote Denial of Service vulnerability (sil@...iltrated.net)
tikiwiki 1.9.5 mysql password disclosure & xss (securfrog@...il.com)
Outpost Insufficient validation of 'SandBox' driver input buffer (Matousec - Transparent security Research <research@...ousec.com>)
rPSA-2006-0202-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
[security bulletin] HPSBUX02172 SSRT061269 rev.1 - HP-UX VirtualVault running Apache Remote Execution of Arbitrary Code, Denial of Service… (security-alert@...com)
Re: PLS-Bannieres 1.21 (bannieres.php) File Include (Stefano Zanero <s.zanero@...urenetwork.it>)
[security bulletin] HPSBUX02164 SSRT061265 rev.1 - HP-UX VirtualVault Running Apache 1.3.X Remote Denial of Service (DoS) and Arbitrary Co… (security-alert@...com)
[security bulletin] HPSBUX02165 SSRT061266 rev.1 - HP-UX VirtualVault Remote Unauthorized Access (security-alert@...com)
[USN-374-1] wvWare vulnerability (Kees Cook <kees@...ntu.com>)
[security bulletin] HPSBUX02091 SSRT061099 rev.2 - HP-UX Local Increased Privilege (security-alert@...com)

November 2 (16 messages)

Internet Explorer 7 - Still Spyware Writers' Heaven (avivra <avivra@...il.com>)
Multiple vulnerabilities in SAP Web Application Server 6.40 and 7.00 (Nicob <nicob@...ob.net>)
how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] (securfrog@...il.com)
Advisory 12/2006: phpMyAdmin - error.php XSS Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Firefox 1.5.0.7 Exploit (koenig@...-k-a-d-e-n-t.de)
iodine client 0.3.2 buffer overflow (poplix@...uasia.org)
[SECURITY] [DSA 1203-1] New libpam-ldap packages fix access control bypass (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBMA02159 SSRT061238 rev.1 - HP System Management Homepage (SMH), Remote Bypassing of Security Features or Cross Sit… (security-alert@...com)
[USN-375-1] PHP vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Educational write-up by Amit Klein: "A Refreshing Look at Redirection" (Amit Klein <aksecurity@...il.com>)
Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] (Taneli Leppä <taneli@...sman.fi>)
Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] (Taneli Leppä <taneli@...sman.fi>)
Re: Firefox 1.5.0.7 Exploit ("Robert McGrew" <wesleymcgrew@...il.com>)
RE: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] ("Richard Stanway" <please-reply-to-list@...linator.com>)
Re: Firefox 1.5.0.7 Exploit ("Bram Dumolin" <bdumolin@...il.com>)
RE: Internet Explorer 7 - Still Spyware Writers' Heaven ("Roger A. Grimes" <roger@...neretcs.com>)

November 3 (15 messages)

Advisory 13/2006: PHP HTML Entity Encoder Heap Overflow Vulnerability (Stefan Esser <sesser@...dened-php.net>)
EUSecWest/London CFP extended to Nov. 7 (Dragos Ruiu <dr@....net>)
Re: phpMyConferences <= 8.0.2 Remote File Inclusion ("Steven M. Christey" <coley@...re.org>)
[ MDKSA-2006:196 ] - Updated php packages to address buffer overflow issue (security@...driva.com)
[ MDKSA-2006:195 ] - Updated wireshark packages fix multiple vulnerabilities (security@...driva.com)
Re: Firefox 1.5.0.7 Exploit (Martin Pitt <martin.pitt@...onical.com>)
Re[2]: New Flaw in Firefox 2.0: DoS and possible remote code execution (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: Digital Armaments Security Advisory 10.07.2006: Flexwath Authorization Bypassing and XSS Vulnerability (sales@...xwatch.com)
Re: Multiple vulnerabilities in SAP Web Application Server 6.40 and7.00 (harrisonholland@...il.com)
[ GLSA 200611-01 ] Screen: UTF-8 character handling vulnerability (Matthias Geerdsen <vorlon@...too.org>)
[SECURITY] [DSA-1205-1] New thttpd packages fix insecure temporary file creation (Steve Kemp <skx@...ian.org>)
SIMPLOG 0.9.3 injection sql & multiple xss (saps.audit@...il.com)
[ MDKSA-2006:197 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)
XSS in script Mobile (m-0-t@...mail.com)
ZDI-06-036: Novell Netmail User Authentication Buffer Overflow Vulnerability (zdi-disclosures@...m.com)

November 4 (14 messages)

[USN-376-1] imlib2 vulnerabilities (Kees Cook <kees@...ntu.com>)
[OpenPKG-SA-2006.030] OpenPKG Security Advisory (ruby) (OpenPKG <openpkg@...npkg.org>)
Re: Internet Explorer 7 - Still Spyware Writers' Heaven ("Eliah Kagan" <degeneracypressure@...il.com>)
MajorSecurity Advisory #31]Xenis.creator CMS - Multiple Cross Site Scripting and SQL Injection Issues (admin@...orsecurity.de)
Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] ("Paul Laudanski" <paul@...tlecops.com>)
[OpenPKG-SA-2006.028] OpenPKG Security Advisory (php) (OpenPKG <openpkg@...npkg.org>)
Web Directory Pro bypass Vulnerabilities (hack2prison@...oo.com)
[OpenPKG-SA-2006.029] OpenPKG Security Advisory (bind) (OpenPKG <openpkg@...npkg.org>)
[USN-378-1] RPM vulnerability (Kees Cook <kees@...ntu.com>)
[MajorSecurity Advisory #30]admin.tool 3 CMS - Multiple Cross Site Scripting Issues (admin@...orsecurity.de)
[USN-377-1] NVIDIA vulnerability (Kees Cook <kees@...ntu.com>)
Re: MajorSecurity Advisory #31]Xenis.creator CMS - Multiple Cross Site Scripting and SQL Injection Issues (saps.audit@...il.com)
IF-CMS multiples XSS vunerabilities (saps.audit@...il.com)
Re: Internet Explorer 7 - Still Spyware Writers' Heaven (Thierry Zoller <Thierry@...ler.lu>)

November 6 (31 messages)

@cid stats v2.3 File Include ("mahmood ali" <mah_k_2000@...mail.com>)
Article Script v1.*and v1.6.3 Sql injection (liz0@...mail.org)
Stanford university SCARF user editing (navairum@...il.com)
PHP Rapid Kill All Version File Injection (null_hack@...oo.com)
Re: New Flaw in Firefox 2.0: DoS and possible remote code execution (Jan Heisterkamp <janheisterkamp@....de>)
Mail Drives Security Considerations (darkz.gsa@...il.com)
[ECHO_ADV_58_2006]Cyberfolio <=2.0 RC1 $av Remote File Inclusion Vulnerability (erdc@...o.or.id)
Re: @cid stats v2.3 File Include (Heiko Wundram <admin@...con.net>)
[ECHO_ADV_59_2006]Agora 1.4 RC1 "$_SESSION[PATH_COMPOSANT]" Remote File Inclusion Vulnerability (erdc@...o.or.id)
[ECHO_ADV_60_2006] OpenEMR <=2.8.1 Multiple Remote File Inclusion Vulnerability (erdc@...o.or.id)
Re: New Flaw in Firefox 2.0: DoS and possible remote code execution (Jerome Athias <jerome.athias@...e.fr>)
AIOCP <=1.3.007 multiples vulnerabilities [sql , remote file include , xss] (saps.audit@...il.com)
MWChat pro V 7.0 <= (CONFIG[MWCHAT_Libs]) Remote File Include Vulnerability ("-= SHELL =- -= SHELL =-" <she1l@...mail.com>)
Joomla 1.0.11 Remote File Include (root@...b4services.com)
Cross Site Scripting (XSS) Vulnerability in IBM WebSphere Application Server (ProCheckUp Research <research@...checkup.com>)
TSLSA-2006-0061 - multi (Trustix Security Advisor <tsl@...stix.org>)
[ GLSA 200611-02 ] Qt: Integer overflow (Matthias Geerdsen <vorlon@...too.org>)
MajorSecurity Advisory #32]phpComasy CMS - Multiple Cross Site Scripting Issues (admin@...orsecurity.de)
Re: Internet Explorer 7 - Still Spyware Writers' Heaven ("Eliah Kagan" <degeneracypressure@...il.com>)
Ariadne <= 2.4.1 Multiple Remote File Include Vulnerabilities(New) (ajannhwt@...mail.com)
RE: Internet Explorer 7 - Still Spyware Writers' Heaven ("Roger A. Grimes" <roger@...neretcs.com>)
[SECURITY] [DSA 1204-1] New ingo1 packages fix arbitrary shell command execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1206-1] New php4 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
XSS Vulnerability in Zend Framework Preview 0.2.0 (security@...orize.com)
Hotmail and Windows Live Mail XSS Vulnerabilities (applesoup@...il.com)
Advanced Guestbook 2.3.1 (Admin.php) Remote File Include (broken-proxy@...uxmail.org)
[ECHO_ADV_57_2006]Soholaunch Pro <=4.9 r36 Multiple Remote File Inclusion Vulnerability (erdc@...o.or.id)
VulnDisco Pack for Metasploit (Evgeny Legerov <admin@...g.net>)
Re: Firefox 1.5.0.7 Exploit (OOZIE <oozie@...zta.fm>)
ZDI-06-037: America Online ICQ ActiveX Control Code Execution Vulnerability (zdi-disclosures@...m.com)
Re: Firefox 1.5.0.7 Exploit (Lubomir Kundrak <lkundrak@...hat.com>)

November 7 (15 messages)

IE7 website security certificate discrediting exploit (inge_eivind.henriksen@...llo.no)
Re: Multiple vulnerabilities in SAP Web Application Server 6.40 and7.00 (Nicob <nicob@...ob.net>)
Re: Advanced Guestbook 2.3.1 (Admin.php) Remote File Include (simo64@...x.org)
[USN-376-2] imlib2 regression fix (Kees Cook <kees@...ntu.com>)
[ MDKSA-2006:199 ] - Updated libx11 packages fix file descriptor leak vulnerability (security@...driva.com)
GreenBeast CMS <= 1.3 PHP Arbitrary File Upload Vulnerability (skulmatic@...il.com)
[ MDKSA-2006:198 ] - Updated imlib2 packages fix several vulnerabilities (security@...driva.com)
News publication system remote File include (navairum@...il.com)
Re: IE7 website security certificate discrediting exploit (inge_eivind.henriksen@...llo.no)
DigiOz Guestbook version 1.7 Path Disclosure Vulnerability in list.php (jesper.jurcenoks@...vigilance.com)
[ MDKSA-2006:200 ] - Updated rpm packages fix vulnerability (security@...driva.com)
Minimizing error cascades in vulnerability information management ("Steven M. Christey" <coley@...re.org>)
WarFTPd 1.82.00-RC11 Remote Denial Of Service (Joxean Koret <joxeankoret@...oo.es>)
[ GLSA 200611-03 ] NVIDIA binary graphics driver: Privilege escalation vulnerability (Raphael Marichez <falco@...too.org>)
XSS in Kayako SupportSuite v3.00.32 ("hacker hackers" <dr.hail@...mail.com>)

November 8 (22 messages)

DigiOz Guestbook version 1.7 Path Disclosure Vulnerability in list.php ("Jesper Jurcenoks" <jesper.jurcenoks@...vigilance.com>)
WFTPD Pro Server 3.23 Buffer Overflow (Joxean Koret <joxeankoret@...oo.es>)
[ MDKSA-2006:201 ] - Updated pam_ldap packages fix PasswordPolicyReponse coding error (security@...driva.com)
[OpenPKG-SA-2006.032] OpenPKG Security Advisory (openssh) (OpenPKG <openpkg@...npkg.org>)
Call for papers: ARES 2007 submission deadline approaches in 2 weeks: 19-11-2006 ("Manh Tho" <manhthovn@...il.com>)
[ MDKSA-2006:198-1 ] - Updated imlib2 packages fix several vulnerabilities (security@...driva.com)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Desktop (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
PhpMyChat Plus <= 1.9 Multiple Source Code Disclosure Vulnerabilities (ajannhwt@...mail.com)
PhpMyChat <= 0.14.5 Source Code Disclosure Vulnerability (ajannhwt@...mail.com)
Y.A.N.S sql injection (navairum@...il.com)
[ MDKSA-2006:203 ] - Updated texinfo packages fix vulnerability (security@...driva.com)
Lotus Notes pre-login User.ID key leak (Andrew Christensen <anc@...tconsult.net>)
iDefense Security Advisory 11.08.06: IBM Lotus Domino 7 tunekrnl Multiple Vulnerabilities (iDefense Labs Security Advisories <idlabs-advisories@...fense.com>)
Portix-PHP [login bypass & xss (post)] (saps.audit@...il.com)
phpsatk => Remote File Include Vulnerability EXploit (h4ck3riran@...oo.com)
TSRT-06-13: HP OpenView Client Configuration Manager Device Code Execution Vulnerability (TSRT@...m.com)
Re: Hotmail and Windows Live Mail XSS Vulnerabilities ("HASEGAWA Yosuke " <yosuke.hasegawa@...il.com>)
Abarcar Realty Portal [injection sql] (saps.audit@...il.com)
iDefense Security Advisory 11.08.06: Cisco Secure Desktop Privilege Escalation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
knowledgeBuilder v.2.2.php.NuLL-WDYL=> Remote File Include Vulnerability (h4ck3riran@...oo.com)
Speedwiki 2.0 Arbitrary File Upload Vulnerability (saps.audit@...il.com)
[ MDKSA-2006:202 ] - Updated wv packages fix vulnerabilities (security@...driva.com)

November 9 (15 messages)

Immediacy .NET CMS possibly vulnerable to Cross Site Scripting through a malformed cookie (ProCheckUp Research <research@...checkup.com>)
FreeWebshop <=2.2.2 [local file include & xss] (saps.audit@...il.com)
FreeBSD Security Advisory FreeBSD-SA-06:24.libarchive (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Antwort: Joomla 1.0.11 Remote File Include (srunschke@...t.de)
omnistar article manager [multiples injection sql] (saps.audit@...il.com)
[ MDKSA-2006:204 ] - Updated openssh packages fix vulnerability (security@...driva.com)
bitweaver <=1.3.1 [injection sql (post) & xss (post)] (saps.audit@...il.com)
GNU gv Stack Overflow Vulnerability (Renaud Lifchitz <r.lifchitz@...dream.com>)
[SECURITY] [DSA 1207-1] New phpmyadmin packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
LandShop Real Estate [multiple injection sql & xss] (saps.audit@...il.com)
[USN-379-1] texinfo vulnerability (Kees Cook <kees@...ntu.com>)
Re: Multiple vulnerabilities in SAP Web Application Server 6.40 and7.00 (Nicob <nicob@...ob.net>)
Wheatblog [multiple xss (post) & full path disclosure] (saps.audit@...il.com)
[security bulletin] HPSBMA02167 SSRT061262 rev.2 - HP OpenView Client Configuration Manager (CCM), Remote Unauthorized Arbitrary Code Exec… (security-alert@...com)
[ GLSA 200611-04 ] Bugzilla: Multiple Vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)

November 10 (11 messages)

rPSA-2006-0204-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2006-0205-1 php php-mysql php-pgsql (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2006-0206-1 firefox thunderbird (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2006-0207-1 openssh openssh-client openssh-server (rPath Update Announcements <announce-noreply@...th.com>)
[ MDKSA-2006:205 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
[ MDKSA-2006:206 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
[OpenPKG-SA-2006.033] OpenPKG Security Advisory (openldap) (OpenPKG <openpkg@...npkg.org>)
[ GLSA 200611-05 ] Netkit FTP Server: Privilege escalation (Raphael Marichez <falco@...too.org>)
[x0n3-h4ck]Essentia Web Server v.2.15 Buffer Overflow (corrado.liotta@...ce.it)
[x0n3-h4ck]Drake CMS v 0.2 XSS exploit (corrado.liotta@...ce.it)
ZDI-06-039: Marshal MailMarshal ARJ Extraction Directory Traversal Vulnerability (zdi-disclosures@...m.com)

November 13 (36 messages)

encapscms 0.3.6 - Remote File Include by Firewall (firewall1954@...mail.com)
PHPKit 1.6.1 RC2 (faq/faq.php) Remote SQL Injection Exploit (philipp.niedziela@....de)
Mega Mall [ multiples injection sql & full path disclosure ] (saps.audit@...il.com)
Exophpdesk V1.2 - Remote File Include (firewall1954@...mail.com)
[SECURITY] [DSA 1209-1] New trac packages fix cross-site request forgery (Moritz Muehlenhoff <jmm@...ian.org>)
Wordpress File Inclusion (vannovax@...il.com)
TOPSTORY BASIC Version 1.0 => Remote File Include Vulnerability (stormhacker@...mail.com)
[MajorSecurity Advisory #33]ShopSystems - SQL Injection Issue (admin@...orsecurity.de)
MyStats <=1.0.8 [injection sql, multiples xss, array & full path disclosure] (benjilenoob@...mail.com)
phpManta - Mdoc <= 1.0.2 (view-sourcecode.php) Local File Include Exploit (ajannhwt@...mail.com)
AspPired2 Poll <= 1.0 (MoreInfo.asp) Remote SQL Injection Exploit (ajannhwt@...mail.com)
UStore 1.0 (detail.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
NuCommunity 1.0 (cl_CatListing.asp) Remote SQL Injection Exploit (ajannhwt@...mail.com)
Re: [ GLSA 200611-03 ] NVIDIA binary graphics driver: Privilege escalation vulnerability ("Nick Boyce" <nick.boyce@...il.com>)
NuRems 1.0 Remote XSS/SQL Injection Exploit (ajannhwt@...mail.com)
NuStore 1.0 (Products.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Re: feedsplitter considered harmful (wmodes@...c.edu)
Re: Wordpress File Inclusion (emc3@...talcollective.com)
NuSchool 1.0 (CampusNewsDetails.asp) Remote SQL Injection Exploit (ajannhwt@...mail.com)
[SECURITY] [DSA 1208-1] New bugzilla packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
XSS in Email Signature Script (miladkaleh@...il.com)
infinicart [ multiples injection sql & xss (post) ] (saps.audit@...il.com)
shambo2 Component For Mambo 4.5 Remote File Inclusion Exploit (crackers_child@...ersavascilar.com)
Re: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech" (rvirtue@...tech.org)
VBulletin DoS Exploit [ all Versions ] (root@...0r.ir)
Web Interface remote file inclusion (navairum@...il.com)
Digipass Go3 Token Dumper (at least for 2006) (fcollyer@...il.com)
Phpjobscheduler 3.0 - Multiple Remote File Include (Firewall1954@...mail.com)
Phpdebug 1.1.0 - Remote File Include by Firewall (Firewall1954@...mail.com)
ELOG Web Logbook Remote Denial of Service Vulnerability ("OS2A BTO" <os2a.bto@...il.com>)
UltraSite 1.0 (update.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Asp Scripter Products (cpLogin.asp) Remote SQL ByPass Injection Vulnerability (ajannhwt@...mail.com)
CPanel Multiple Cross Site Scription (Advisory@...a-security.net)
ZDI-06-038: Citrix MetaFrame IMA Management Module Remote Heap Overflow (zdi-disclosures@...m.com)
Old SAP exploits (Nicob <nicob@...ob.net>)
Property Pro v1.0 (vir_Login.asp) Remote Login ByPass SQL Injection Vulnerability (ajannhwt@...mail.com)

November 14 (44 messages)

Re: [x0n3-h4ck]Essentia Web Server v.2.15 Buffer Overflow (Noam Rathaus <noamr@...ondsecurity.com>)
ASPPortal <= 4.0.0 (default1.asp) Remote SQL Injection Exploit (ajannhwt@...mail.com)
UPublisher 1.0 (viewarticle.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
[FLSA-2006:211760] Updated gzip package fixes security issues (David Eisenstein <secnotice@...oralegacy.org>)
Estate Agent Manager <= v1.3 (default.asp) Remote Login ByPass SQL Injection Vulnerability (ajannhwt@...mail.com)
[SECURITY] [DSA 1209-2] New trac packages fix cross-site request forgery (Moritz Muehlenhoff <jmm@...ian.org>)
Challenges faced by automated web application security assessment tools (bugtraq@...security.net)
DirectAdmin Multiple Cross Site Scription (Advisory@...a-security.net)
VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4 (VMware Security team <security@...are.com>)
[ GLSA 200611-06 ] OpenSSH: Multiple Denial of Service vulnerabilities (Raphael Marichez <falco@...too.org>)
SinFP 2.04 release, works under Windows (GomoR <bt@...or.org>)
Re: [ GLSA 200611-03 ] NVIDIA binary graphics driver: Privilege escalation vulnerability (Raphael Marichez <falco@...too.org>)
iDefense Security Advisory 11.09.06: Citrix Presentation Server 4.0 IMA Service Invalid Name Length DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.co…)
[ GLSA 200611-08 ] RPM: Buffer overflow (Raphael Marichez <falco@...too.org>)
VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 2 (VMware Security team <security@...are.com>)
New Bug MiniBB Forum <= 2 Remote File Include (index.php) ("philip anselmo" <spoonman500@...mail.com>)
VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 1 (VMware Security team <security@...are.com>)
Online Event Registration <= v2.0 (save_profile.asp) Remote User Pass Change Exploit (ajannhwt@...mail.com)
VMSA-2006-0009 - VMware ESX Server 3.0.0 AMD fxsave/restore issue (VMware Security team <security@...are.com>)
VMSA-2006-0008 - VMware ESX Server 2.0.2 Upgrade Patch 2 (VMware Security team <security@...are.com>)
Re: Wordpress File Inclusion (Expanders <expanders@...rbit.com>)
[ GLSA 200611-07 ] GraphicsMagick: PALM and DCM buffer overflows (Raphael Marichez <falco@...too.org>)
Re: GNU gv Stack Overflow Vulnerability (Noam Rathaus <noamr@...ondsecurity.com>)
[SECURITY] [DSA 1210-1] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Real Estate Listing System SQL Injection (Advisory@...a-security.net)
ASPintranet SQL Injection (Advisory@...a-security.net)
SiteXpress SQL Injection (Advisory@...a-security.net)
WWWeb Cocepts SQL Injection (Advisory@...a-security.net)
Ustore SQL Injection (Advisory@...a-security.net)
Advisory 14/2006: Dotdeb PHP Email Header Injection Vulnerability (Stefan Esser <sesser@...dened-php.net>)
eShopping SQL Injection (Advisory@...a-security.net)
ECommerce Store Shop Builder (Advisory@...a-security.net)
Engine Manager SQL Injection (Advisory@...a-security.net)
BPG Content Management System SQL Injection (Advisory@...a-security.net)
Apple Safari "match" Buffer Overflow Vulnerability (jbh_cg@...oo.fr)
Re: [ GLSA 200611-03 ] NVIDIA binary graphics driver: Privilege escalation vulnerability (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Re: [ GLSA 200611-03 ] NVIDIA binary graphics driver: Privilege escalation vulnerability (Glynn Clements <glynn@...ements.plus.com>)
Inventory Manager [injection sql & xss (get)] (saps.audit@...il.com)
Car Site Manager [injection sql & xss (get)] (saps.audit@...il.com)
Evolve Merchant[ injection sql ] (saps.audit@...il.com)
Re: New Bug MiniBB Forum <= 2 Remote File Include (index.php) (navairum@...il.com)
FunkyASP Glossary v1.0 [injection sql] (saps.audit@...il.com)
Blogme v3 [admin login bypass & xss (post)] (saps.audit@...il.com)
Property Site Manager [login bypass ,multiples injection sql & xss (get)] (saps.audit@...il.com)

November 15 (15 messages)

[Fwd: DMA[2006-1031a] - 'Intego VirusBarrier X4 definition bypass exploit'] ("K F (lists)" <kf_lists@...italmunition.com>)
Re: [Full-disclosure] ZDI-06-040: WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability (Micheal Turner <wh1t3h4t3@...oo.co.uk>)
[Fwd: OpenBase SQL multiple vulnerabilities Part Deux] ("K F (lists)" <kf_lists@...italmunition.com>)
EEYE: Workstation Service NetpManageIPCConnect Buffer Overflow ("eEye Advisories" <Advisories@...e.com>)
ZDI-06-040: WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability (zdi-disclosures@...m.com)
ZDI-06-041: Microsoft Internet Explorer CSS Float Property Memory Corruption Vulnerability (zdi-disclosures@...m.com)
A+ Store E-Commerce[ injection sql & xss (post) ] (saps.audit@...il.com)
A-Cart pro[ injection sql (post&get)] (saps.audit@...il.com)
hpecs shopping cart[login bypass & injection sql (post)] (saps.audit@...il.com)
Dragon calendar [ login bypass & injection sql ] (saps.audit@...il.com)
[SECURITY] [DSA 1211-1] New pdns packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
MultiCalendars [ multiples injection sql ] (saps.audit@...il.com)
NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[OpenPKG-SA-2006.034] OpenPKG Security Advisory (texinfo) (OpenPKG <openpkg@...npkg.org>)
DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)

November 16 (30 messages)

TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
TSLSA-2006-0063 - multi (Trustix Security Advisor <tsl@...stix.org>)
[ MDKSA-2006:207 ] - Updated bind packages fixes RSA signature verification vulnerability (security@...driva.com)
[SECURITY] [DSA 1212-1] New openssh packages fix denial of service (Noah Meyerhans <noahm@...ian.org>)
Outpost Multiple insufficient argument validation of hooked SSDT function Vulnerability (Matousec - Transparent security Research <research@...ousec.com>)
E-Calendar Pro 3.0 [ login bypass & injection sql (post)] (saps.audit@...il.com)
Helm Cross-Site Scripting (XSS) (Advisory@...a-security.net)
FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[ MDKSA-2006:208 ] - Updated openldap packages fixes Bind vulnerability (security@...driva.com)
Bloo => 1.00 Cross Site Scripting (the_3dit0r@...oo.com)
E-commerce Kit 1 PayPal Edition [ injection sql ] (saps.audit@...il.com)
MetaCart e-Shop [multiples injection sql (get & post)] (saps.audit@...il.com)
Xtreme ASP Photo Gallery Cross Site Scripting And SQL Injection (Advisory@...a-security.net)
discloser => 0.0.4 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
Hot Links download backup authorized vulnerabilities (hack2prison@...oo.com)
PhpMyAdmin all version [multiples vulnerability] (saps.audit@...il.com)
OdysseusBlog => 1.0.0 Cross Site Scripting (the_3dit0r@...oo.com)
Bloo => 1.00 Remote File Include Vulnerability (the_3dit0r@...oo.com)
[MajorSecurity Advisory #34]Plesk 8 - Multiple Cross Site Scripting Issues (admin@...orsecurity.de)
Team Evil - Incident #2 (beSIRT <beSIRT@...ondsecurity.com>)
Chetcpasswd 2.x: multiple vulnerabilities (riclem@...oo.com)
Secunia Research: MDaemon Insecure Default Directory Permissions (Secunia Research <remove-vuln@...unia.com>)
Re: Apple Safari "match" Buffer Overflow Vulnerability ("J. Oquendo" <sil@...iltrated.net>)
Kerio WebSTAR local privilege escalation ("K F (lists)" <kf_lists@...italmunition.com>)
dev_wms => 1.5 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
discloser => 0.0.4 Remote File Include Vulnerability Exploit (the_3dit0r@...oo.com)
Etomite CMS 0.6.1.2 Multiple Vulnerabilities ( Sql Injection + Local file inclusion ) (revenge <revenge@...afebabe.it>)
Re: Advisory 14/2006: Dotdeb PHP Email Header Injection Vulnerability (Marcello Barnaba <bofh@...tmedia.info>)
eShopping Cart [injection sql] (saps.audit@...il.com)
Whitepaper: Implementing and Detecting a PCI Rootkit (John Heasman <john@...software.com>)

November 17 (55 messages)

Vulnerabilities in Client Service for NetWare (Avert@...rtlabs.com)
CandyPress Store[ multiples injection sql ] (saps.audit@...il.com)
BaalAsp forum [login bypass ,injections sql(post), xss(post)] (saps.audit@...il.com)
ZDI-06-042: Verity Ultraseek Request Proxying Vulnerability (zdi-disclosures@...m.com)
Helm Cross Site Scripting (Advisory@...a-security.net)
Myphotos => Remote File Include Vulnerability Exploit (the_3dit0r@...oo.com)
i-Gallery 3.4 Cross Site Scripting (Advisory@...a-security.net)
Sphpblog => 0.8 Cross Site Scripting (the_3dit0r@...oo.com)
BlogTorrent-preview => 0.92 Cross Site Scripting (the_3dit0r@...oo.com)
Comdev One Admin Pro.v4.1 ( path[skin] ) Remote File include ("AG- Spider" <ag-spider@....com>)
ASP Cart [multiples injection sql (post & get)] (saps.audit@...il.com)
worksystem => Remote File Include Vulnerability Exploit (the_3dit0r@...oo.com)
Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure (Lucas Holt <luke@...lishgames.com>)
Hot Links download backup authorized vulnerabilities (re-post with some edit) (hack2prison@...oo.com)
eggblog=> 3.1.0 Cross Site Scripting (the_3dit0r@...oo.com)
Secunia Research: Panda ActiveScan Multiple Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
RE: VBulletin DoS Exploit [ all Versions ] ("Bart Seresia" <bart@....be>)
UK Security Convention - Continuity 2006 ("Manchester 2600" <man2600@...il.com>)
Links smbclient command execution (Teemu Salmela <teemu.salmela@....fi>)
rPSA-2006-0211-1 libpng (rPath Update Announcements <announce-noreply@...th.com>)
Image gallery with Access Database SQL Injection (Advisory@...a-security.net)
ASPintranet SQL Injection (Advisory@...a-security.net)
blogcms => 4.0.0 Remote File Include (the_3dit0r@...oo.com)
RED Blog => Remote File Include Vulnerability Exploit (the_3dit0r@...oo.com)
Storystream => 4.0 Remote File Include Vulnerability Exploit (the_3dit0r@...oo.com)
Pilot Cart V.7.2 [ injection sql (post) ] (saps.audit@...il.com)
[ MDKSA-2006:209 ] - Updated libpng packages fix vulnerabilities (security@...driva.com)
[ MDKSA-2006:211 ] - Updated pxelinux packages to fix embedded libpng vulnerabilities (security@...driva.com)
[ MDKSA-2006:210 ] - Updated syslinux packages to fix embedded libpng vulnerabilities (security@...driva.com)
[OpenPKG-SA-2006.035] OpenPKG Security Advisory (proftpd) (OpenPKG <openpkg@...npkg.org>)
Active News Manager [ injection sql (post&get)] (saps.audit@...il.com)
[ MDKSA-2006:212 ] - Updated doxygen packages to fix embedded libpng vulnerabilities (security@...driva.com)
My-BIC => 0.6.5 Remote File Include Vulnerability Exploit (the_3dit0r@...oo.com)
[ MDKSA-2006:213 ] - Updated chromium packages to fix embedded libpng vulnerabilities (security@...driva.com)
[OpenPKG-SA-2006.036] OpenPKG Security Advisory (png) (OpenPKG <openpkg@...npkg.org>)
[USN-383-1] libpng vulnerability (Kees Cook <kees@...ntu.com>)
[security bulletin] HPSBMA02088 SSRT051026 rev. 2 - HP-UX running WBEM Services Denial of Service (DoS) (security-alert@...com)
[ GLSA 200611-09 ] libpng: Denial of Service (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
TSLSA-2006-0065 - libpng (Trustix Security Advisor <tsl@...stix.org>)
[ GLSA 200611-10 ] WordPress: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: Etomite CMS 0.6.1.2 Multiple Vulnerabilities ( Sql Injection + Local file inclusion ) (dean@...mite.org)
[Aria-Security] CPanel Network Tools Cross Site Scripting [Advisory] (Advisory@...a-security.net)
20/20 auto gallery [ multiples injection sql ] (saps.audit@...il.com)
20/20 real estate [ multiples injection sql ] (saps.audit@...il.com)
TFTPD32 v3.01 TFTP Server Long File Name Buffer Overflow Vulnerability (liuqx@...c.org.cn)
[Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities. (Reversemode <advisories@...ersemode.com>)
Sphpblog => 0.8 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
Aspmforum [ multiples injection sql (get&post)] (saps.audit@...il.com)
igital Armaments November-Decemberr Hacking Challenge: KERNEL Remote (info@...italarmaments.com)
20/20 datashed [ multiples injection sql ] (saps.audit@...il.com)
XSS vBulletin 3.6.X Admin Control Painel (insanity@...kers.com.br)
Dating Site [ login bypass & xss] (saps.audit@...il.com)
MosReporter Joomla Component Remote File Inclusion Exploi (crackers_child@...ersavascilar.com)
Re: blogcms => 4.0.0 Remote File Include (Stefano Zanero <s.zanero@...urenetwork.it>)
Re: Airmagnet management interfaces multiple vulnerabilities (ckuan@...magnet.com)

November 18 (23 messages)

Infinitytechs Restaurants CM (saps.audit@...il.com)
[ MDKSA-2006:214 ] - Updated gv packages fix buffer overflow vulnerability (security@...driva.com)
Re: dev_wms => 1.5 Remote File Include Vulnerabilities (Stefano Zanero <s.zanero@...urenetwork.it>)
A-Cart PRO SQL Injection (Advisory@...a-security.net)
[MajorSecurity Advisory #36]dev4u CMS - Multiple SQL Injection and Cross Site Scripting Issues (admin@...orsecurity.de)
Sage cross-context scripting -> LOCAL-CONTEXT SCRIPTING (pagvac <unknown.pentester@...il.com>)
Drone Armies C&C Report - 17 Nov 2006 (c2report@...tf.org)
Vikingboard (0.1.2) [ multiples vulnerability ] (saps.audit@...il.com)
[ MDKSA-2006:164-1 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities (security@...driva.com)
BLOG:CMS <= 4.1.3 XSS (katatafish@...h.com)
PhpBB Module Dimension Remote File Include (bluespy.ok@...il.com)
Oxygen <= 1.1.3 (O2PHP Bulletin Board) SQL Injection (gmdarkfig@...il.com)
[Aria-Security's Research Team] ActiveNews Manager SQL Injection Vulnerabilite (Advisory@...a-security.net)
[MajorSecurity Advisory #35]Travelsized CMS - Multiple Cross Site Scripting Issues (admin@...orsecurity.de)
[Aria-Security's Research Team] Texas Rank'em SQL Injection Vulnerabilite (Advisory@...a-security.net)
linksys wrt54g v5 authentication bypass fixed ("Ginsu Rabbit" <ginsurabbit@...mail.com>)
A-Cart 2.0 SQL Injection (Advisory@...a-security.net)
Re: [Aria-Security's Research Team] ActiveNews Manager SQL Injection Vulnerabilite (gmdarkfig@...il.com)
Re: A-Cart PRO SQL Injection (gmdarkfig@...il.com)
Re: Phpjobscheduler 3.0 - Multiple Remote File Include (Stefano Zanero <s.zanero@...urenetwork.it>)
GPhotos 1.5 Multiple vulnerabilities (tux025@...il.com)
Re: Phpjobscheduler 3.0 - Multiple Remote File Include (str0ke <str0ke@...w0rm.com>)
Re: EEYE: Workstation Service NetpManageIPCConnect Buffer Overflow (security-list@...ktrack.com)

November 20 (29 messages)

Dovecot IMAP/POP3 server: Off-by-one buffer overflow (Timo Sirainen <tss@....fi>)
Ixprim CMS 1.2 Remote File Include Vulnerability (vitux.manis@...il.com)
Telaen <= 1.1.0 Remote File Include Exploit (the_3dit0r@...oo.com)
Digital Armaments November-Decemberr Hacking Challenge: KERNEL (info@...italarmaments.com)
Rapid Classified v3.1 [multiple xss (get) & injection sql] (saps.audit@...il.com)
[SECURITY] [DSA 1213-1] New imagemagick packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
PhpBB Module Dimension Remote File Include (bluespy.ok@...il.com)
ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
ehomes [multiples injections sql] (saps.audit@...il.com)
PHPOLL => 0.96 Cross Site Scripting (the_3dit0r@...oo.com)
Serious crypto problem fixed by envelope HMAC method insteadof currently used prefix ("Omirjan Batyrbaev" <batyr@...ecuritycorp.com>)
eClassifieds [injection sql] (saps.audit@...il.com)
Rialto 1.6[admin login bypass & multiples injections sql] (saps.audit@...il.com)
PhpQuickGallery <= 1.9 Remote File Inclusion Exploit (the_3dit0r@...oo.com)
gNews Publisher SQL Injection Vulnerabilites (Advisory@...a-security.net)
RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure ("Rogier Mulhuijzen" <rogier.mulhuijzen@...ice.casema.nl>)
Shopping_Catalog Remote File Include exploit (the_3dit0r@...oo.com)
dicshunary 0.1 alpha Remote File Inclusion Exploit (the_3dit0r@...oo.com)
DodosMail <= 2.0.1(dodosmail.php) Remote File Inclusion Exploit (the_3dit0r@...oo.com)
klf-realty [injection sql] (saps.audit@...il.com)
enomphp => 4.0 Remote Traversal Directory (the_3dit0r@...oo.com)
iPrimal Forums (index.php) Remote File Include Exploit (the_3dit0r@...oo.com)
mg.applanix <= 1.3.1 Remote File Include Exploit (the_3dit0r@...oo.com)
mxBB calsnails module 1.06 Remote File Inclusion Exploit (the_3dit0r@...oo.com)
Telaen => 1.1.0 Remote File Include Vulnerability (the_3dit0r@...oo.com)
[SECURITY] [DSA 1214-1] New gv packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDKSA-2006:217 ] - Updated proftpd packages fix vulnerabilities (security@...driva.com)
LoudMouth => 2.4 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
[ GLSA 200611-13 ] Avahi: "netlink" message vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

November 21 (45 messages)

[SECURITY] [DSA 1217-1] New linux-ftpd packages fix access control bypass (Moritz Muehlenhoff <jmm@...ian.org>)
The Week of Oracle Database Bugs (Cesar <cesarc56@...oo.com>)
[ GLSA 200611-12 ] Ruby: Denial of Service vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: Serious crypto problem fixed by envelope HMAC method insteadof currently used prefix ("Omirjan Batyrbaev" <batyr@...patico.ca>)
MyAlbum <= 3.02 (langs_dir) Remote File Inclusion Exploit (the_3dit0r@...oo.com)
[ GLSA 200611-14 ] TORQUE: Insecure temproary file creation (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[SECURITY] [DSA 1216-1] New flexbackup packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
BirdBlog => v1.4.0 Cross Site Scripting (the_3dit0r@...oo.com)
[ MDKSA-2006:215 ] - Updated avahi packages fix netlink vulnerability (security@...driva.com)
Wabbit PHP Gallery => 0.9 Remote Traversal Directory (the_3dit0r@...oo.com)
[SECURITY] [DSA 1215-1] New xine-lib packages fix execution of arbitrary code (Moritz Muehlenhoff <jmm@...ian.org>)
mAlbum v0.3 Multiple vulnerabilitizzz (tux025@...il.com)
my little weblog => Cross Site Scripting (the_3dit0r@...oo.com)
[ GLSA 200611-11 ] TikiWiki: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Classified System [injection sql] (saps.audit@...il.com)
Re: GPhotos 1.5 Multiple vulnerabilities (packet@...ketstormsecurity.org)
Correction: Re: Serious crypto problem fixed by envelope HMAC method insteadof currently used prefix ("Omirjan Batyrbaev" <batyr@...patico.ca>)
ltwCalendar => 4.2.1 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
[SECURITY] [DSA 1207-2] New phpmyadmin packages fix regression (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDKSA-2006:216 ] - Updated links packages fix smb vulnerability (security@...driva.com)
The Classified Ad System [multiple xss & injection sql] (saps.audit@...il.com)
[USN-384-1] OpenLDAP vulnerability (Kees Cook <kees@...ntu.com>)
Which is more secure? Oracle vs. Microsoft ("David Litchfield" <davidl@...software.com>)
Re: Correction: Re: Serious crypto problem fixed by envelope HMAC method insteadof currently used prefix (Steve Friedl <steve@...xwiz.net>)
LS-20061113 - CA BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability (advisories@...ec.com)
[KAPDA]::Security analysis of cutenews 1.4.5 (alireza hassani <trueend5@...oo.com>)
[Full-disclosure] [ GLSA 200611-11 ] TikiWiki: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
New Correction: Re: Serious crypto problem fixed by envelope HMAC method instead of currently used prefix ("Omirjan Batyrbaev" <batyr@...patico.ca>)
[ GLSA 200611-15 ] qmailAdmin: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: [ MDKSA-2006:217 ] - Updated proftpd packages fix vulnerabilities (research@...g.net)
[ GLSA 200611-16 ] Texinfo: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: [ GLSA 200611-11 ] TikiWiki: Multiple vulnerabilities (saps.audit@...il.com)
Secunia Research: My Firewall Plus Privilege Escalation Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1218-1] New proftpd packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
aBitWhizzy [local file include] (saps.audit@...il.com)
ContentNow CMS 1.39 Sql Injection + Path Disclosure Vulnerabilities (revenge <revenge@...afebabe.it>)
Re: Re: Phpjobscheduler 3.0 - Multiple Remote File Include (admin@...lker.co.uk)
[USN-382-1] Thunderbird vulnerabilities (Kees Cook <kees@...ntu.com>)
Link Exchange Lite [injection sql] (saps.audit@...il.com)
creadirectory [injection sql & xss] (saps.audit@...il.com)
JiRos Links Manager[injection sql & xss permanent] (saps.audit@...il.com)
Advisory: LDU <= 8.x Remote SQL Injection Vulnerability. (Mustafa Can Bjorn IPEKCI <nukedx@...edx.com>)
Clarifying integer overflows vs. signedness errors ("Steven M. Christey" <coley@...re.org>)
VMSA-2006-0010 - SSL sessions not authenticated by VC Clients (VMware Security team <security@...are.com>)
Vulnerability in PostNuke (sni-labs@...-labs.com)

November 22 (22 messages)

Advisory: Seditio <= 1.10 Remote SQL Injection Vulnerability. (Mustafa Can Bjorn IPEKCI <nukedx@...edx.com>)
RE: [Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities. ("Williams, James K" <James.Williams@...com>)
[USN-381-1] Firefox vulnerabilities (Kees Cook <kees@...ntu.com>)
Re: [ GLSA 200611-11 ] TikiWiki: Multiple vulnerabilities (Chris Gianelloni <wolf31o2@...too.org>)
RE: LS-20061113 - CA BrightStor ARCserve Backup Remote Buffer Overflow Vulnerability ("Williams, James K" <James.Williams@...com>)
*BSD banner INT overflow vulnerability (Gruzicki Wlodek <dead.code.crew@...l.ru>)
Secunia Research: PassGo SSO Plus Insecure Default Directory Permissions (Secunia Research <remove-vuln@...unia.com>)
Re: *BSD banner INT overflow vulnerability (Steve Shockley <steve.shockley@...ckley.net>)
Re: Clarifying integer overflows vs. signedness errors ("Thiago Zaninotti" <thiago@...inotti.net>)
Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("David Litchfield" <davidl@...software.com>)
"Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("Matthew Conover" <matthew_conover@...antec.com>)
Re: [ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Vulnerability (jim@...cms.co.uk)
Windows Media ASX PlayList File Denial Of Service Vulnerability (sehato@...dex.ru)
[ MDKSA-2006:208-1 ] - Updated openldap packages fixes Bind vulnerability (security@...driva.com)
Lack of environment sanitization in the FreeBSD, OpenBSD, NetBSD dynamic loaders. ("In Cognito" <defend.the.world@...il.com>)
Re: Re: *BSD banner INT overflow vulnerability (evilrabbi@...il.com)
Lack of environment sanitization in the FreeBSD, OpenBSD, NetBSD dynamic loaders. ("In Cognito" <defend.the.world@...il.com>)
Re: *BSD banner INT overflow vulnerability (Bob Beck <beck@...h.cns.ualberta.ca>)
CONFidence 2007 CFP (andrzej.targosz@...idea.org.pl)
Perl proxy checker using samair.ru ("Iko Riyadi" <tampan@...il.com>)
XSS in scriptat support InverseFlow Help Desk v2.31 (gamr-14@...mail.com)
Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords (fash1on@...il.com)

November 23 (15 messages)

Re: Lack of environment sanitization in the FreeBSD, OpenBSD, NetBSD dynamic loaders. (Casper.Dik@....COM)
NVIDIA nView (keystone) local Denial Of service (no-reply@...samx.net)
CFP - VII National Computer and Information Security Conference (Jeimy Cano <jjcano@...oo.com>)
[ECHO_ADV_61_2006] a-ConMan <= v3.2beta Remote File Inclusion (erdc@...o.or.id)
Password Flaw also in Firefox 1.5.08. Was: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords ("Michael Scheidell" <scheidell@...nap.net>)
Re: tikiwiki 1.9.5 mysql password disclosure & xss (FBI@...mail.com)
Re: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: Password Flaw also in Firefox 1.5.08. Was: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: SolpotCrew Advisory #10 - phpBB XS (phpbb_root_path) Remote File Include (webmaster@...bb-es.com)
[ MDKSA-2006:218 ] - Updated apache-mod_auth_kerb packages fixes DoS vulnerability (security@...driva.com)
Re: *BSD banner INT overflow vulnerability (admin <admin@...rsk.com>)
LS-20061102 - Business Objects Crystal Reports Stack Overflow Vulnerability (advisories@...ec.com)
[ GLSA 200611-17 ] fvwm: fvwm-menu-directory fvwm command injection (Matthias Geerdsen <vorlon@...too.org>)
Active PHP Bookmarks (apb.php) Remote file include ("philip anselmo" <spoonman500@...mail.com>)
Cracking String Encryption in Java Obfuscated Bytecode (subere@...on.org)

November 24 (23 messages)

Re: Cracking String Encryption in Java Obfuscated Bytecode (Jim Manico <jim@...ico.net>)
Cross site scripting & fullpath disclosure (saudi@...mail.fr)
mmgallery Multiple vulnerabilities (saudi@...mail.fr)
[ GLSA 200611-18 ] TIN: Multiple buffer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[Aria-Security Team] MidiCart ASP Plus Shopping Cart SQL Injection (Advisory@...a-security.net)
Wolflab Burning Board Lite 1.0.2 two sql injections (retrog@...ce.it)
PHP-Nuke <= 7.9 News module "sid" SQL Injection vulnerabilities (paisterist.nst@...il.com)
Re: Cracking String Encryption in Java Obfuscated Bytecode (John GALLET <john.gallet@...adoo.fr>)
Re: Active PHP Bookmarks (apb.php) Remote file include (Mefisto@...kermail.Com)
[Aria-Security Team] Fixit iDMS Pro Image Gallery SQL Injection (Advisory@...a-security.net)
[Aria-Security Team] ASP ListPics 5.0 SQL Injection (Advisory@...a-security.net)
[Aria-Security Team] MidiCart ASP Shopping Cart SQL Injection (Advisory@...a-security.net)
[Aria-Security Team] iNews News Manager SQL Injection (Advisory@...a-security.net)
Re: Digipass Go3 Token Dumper (at least for 2006) (Hugo van der Kooij <hvdkooij@...derkooij.org>)
[ GLSA 200611-19 ] ImageMagick: PALM and DCM buffer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Cahier de texte V2.0 SQL Code Execution Exploit (gmdarkfig@...il.com)
[Aria-Security Team] Ultimate Survey Pro SQL Injection (Advisory@...a-security.net)
PHP-Nuke Mermaid Module V1.2 (formdisp.php) Remote File Include Exploit (crackers_child@...ersavascilar.com)
CPanel 11 Multiple Cross-Site Scription (Advisory@...a-security.net)
[ GLSA 200611-20 ] GNU gv: Stack overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
WebHost Manager (WHM) Multiple Cross-Site Scripting (Advisory@...a-security.net)
DoS in Microsoft Windows Live Messenger <= 8.0 (dragonjar@...il.com)
New Windows tool - NBTEnum 3.3 ("Reed Arvin" <reedarvin@...il.com>)

November 25 (14 messages)

Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) (stopmakingnoise@...il.com)
Re: tikiwiki 1.9.5 mysql password disclosure & xss (drunken_chin@...oo.com)
Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("Thor (Hammer of God)" <thor@...merofgod.com>)
Siap Cms Sql Injection (login.asp) (nagazakig74@...mail.com)
Wisi Portal [Sql Injection By Jesus Tovar] (nagazakig74@...mail.com)
AttackAPI 2.0 alpha ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: DoS in Microsoft Windows Live Messenger <= 8.0 (astralbabz@...ebottle.com)
Free tool for pattern identification (for researchers) ("Gary Golomb" <gary@...ventsure.com>)
Re: Re: Digipass Go3 Token Dumper (at least for 2006) (fcollyer@...il.com)
Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) (Steve Friedl <steve@...xwiz.net>)
Re: Clarifying integer overflows vs. signedness errors (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("Thor (Hammer of God)" <thor@...merofgod.com>)
mAlbum v0.3 local file inclusion (tux025@...il.com)

November 27 (21 messages)

[Aria-Security Team] Evolve shopping cart SQL Injection Vulnerability (Advisory@...a-security.net)
[Aria-Security Team] General Shopping Cart SQL Injection Vulnerability (Advisory@...a-security.net)
[SECURITY] [DSA 1220-1] New pstotext packages fix arbitrary shell command execution (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) (Tim Newsham <newsham@...a.net>)
Clickblog Sql Injection (Advisory@...a-Security.Net)
TFTP Server AT-TFTP Server v 1.9 Buffer Overflow Vulnerability (Long filename) (liuqx@...c.org.cn)
ClickGallery Sql Injection (Advisory@...a-Security.Net)
VMware 5.5.1 Local Buffer Overflow (HTML Exploit) (NormandiaN_MailID@...oo.com)
[SECURITY] [DSA 1219-1] New texinfo packages fix multiple vulnerabilities (Noah Meyerhans <noahm@...ian.org>)
iDefense Security Advisory 11.26.06: Qbik WinGate Compressed Name Pointer Denial of Service Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
rPSA-2006-0218-1 ImageMagick (rPath Update Announcements <announce-noreply@...th.com>)
TFTP Server 3CTftpSvc Buffer Overflow Vulnerability (Long transporting mode) (liuqx@...c.org.cn)
CuteNews v1.4.5 (search.php) Remote file include vulnerability ("philip anselmo" <spoonman500@...mail.com>)
Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("David Litchfield" <davidl@...software.com>)
Re: VMware 5.5.1 Local Buffer Overflow (HTML Exploit) (str0ke <str0ke@...w0rm.com>)
rPSA-2006-0219-1 info install-info texinfo (rPath Update Announcements <announce-noreply@...th.com>)
PhpGedView 4.0.2 (DOCUMENT_ROOT) File inclusion Vulnerablity (x___._@...mail.com)
Re: CuteNews v1.4.5 (search.php) Remote file include vulnerability (Francesco Laurita <francesco@...ncesco-laurita.info>)
MHL-2006-003 Public Advisory: "mboard" file creation issue (Mayhemic Labs Security <security@...hemiclabs.com>)
iDefense Security Advisory 11.26.06: GNU Radius Format String Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200611-21 ] Kile: Incorrect backup file permission (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

November 28 (23 messages)

Re: New Flaw in Firefox 2.0: DoS and possible remote code execution (sflist@....de)
RE: Cracking String Encryption in Java Obfuscated Bytecode (Jeremy Epstein <jeremy.epstein@...methods.com>)
2nd European Conference on Computer Network Defense (EC2ND) ("Blyth A J C (AT)" <ajcblyth@...m.ac.uk>)
Cursor snarfing - a new class of vulnerability and attack in Oracle ("David Litchfield" <davidl@...software.com>)
AIDE problem handling symlinks (fryxar fryxar <fryxar@...oo.com.ar>)
ClickContact SQL Injection (Advisory@...a-Security.Net)
CVE-2006-5815: remote code execution in ProFTPD (John Morrissey <jwm@...ftpd.org>)
SYMSA-2006-011: JBoss Java Class DeploymentFileRepository Directory Traversal (research@...antec.com)
GnuPG 1.4 and 2.0 buffer overflow (Werner Koch <wk@...pg.org>)
[ GLSA 200611-22 ] Ingo H3: Folder name shell command injection (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
uPhotoGallery (v 1.1) SQL Injection (Advisory@...a-Security.Net)
Re: SYMSA-2006-011: JBoss Java Class DeploymentFileRepository Directory Traversal (Jon Hart <jhart@...ofed.org>)
Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("Steven M. Christey" <coley@...re.org>)
[USN-386-1] ImageMagick vulnerability (Kees Cook <kees@...ntu.com>)
Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("David Litchfield" <davidl@...software.com>)
evince buffer overflow exploit (gv) (kspecial <kspecial@...iroz.net.net>)
TSLSA-2006-0066 - multi (Trustix Security Advisor <tsl@...stix.org>)
ProFTPD mod_tls pre-authentication buffer overflow (research@...g.net)
Re: PhpGedView 4.0.2 (DOCUMENT_ROOT) File inclusion Vulnerablity (Mefisto@...kermail.Com)
b2evolution XSS Vulnerabilities (tarkus@...fp.org)
[USN-387-1] Dovecot vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 200611-23 ] Mono: Insecure temporary file creation (Raphael Marichez <falco@...too.org>)
[ GLSA 200611-25 ] OpenLDAP: Denial of Service vulnerability (Raphael Marichez <falco@...too.org>)

November 29 (26 messages)

[ GLSA 200611-24 ] LHa: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
Re: PhpGedView 4.0.2 (DOCUMENT_ROOT) File inclusion Vulnerablity (yalnifj@...rs.sourceforge.net)
[USN-385-1] tar vulnerability (Kees Cook <kees@...ntu.com>)
New report on Teredo security (Jim Hoagland <jim_hoagland@...antec.com>)
Re: [Full-disclosure] New report on Teredo security (Jeroen Massar <jeroen@...ix.org>)
b2evolution Remote File inclusion Vulnerability (tarkus@...fp.org)
Re: ProFTPD mod_tls pre-authentication buffer overflow (Mark Wadham <mark.wadham@...ti.net>)
Re: [WEB SECURITY] The state of JavaScript Hacking (bugtraq@...security.net)
Re: CuteNews v1.4.5 (search.php) Remote file include vulnerability (raven <locrideweb@...ero.it>)
iDefense Security Advisory 11.29.06: Horde Kronolith Arbitrary Local File Inclusion Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
ZDI-06-043: Novell Netware Client Print Provider Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
PHP Event Calendar 1.5.1 (index.php) Remote File Include Vulnerability ("philip anselmo" <spoonman500@...mail.com>)
Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) ("David Litchfield" <davidl@...software.com>)
[ MDKSA-2006:219 ] - Updated tar packages fix vulnerability (security@...driva.com)
Secunia Research: Borland Products idsql32.dll Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Multiple Vulnerabilities in AlternC version 0.9.5 (Vincent A.Menard <thabob@...il.com>)
SYM06-023, Symantec NetBackup PureDisk: PHP update to Address Reported Security Vulnerability ("Mike Prosser" <mprosser@...antec.com>)
REMLAB Web Mech Designer 2.0.5 Path Disclosure Vulnerability (jesper.jurcenoks@...vigilance.com)
OWASP JBroFuzz 0.3 Fuzzer Released! (subere@...on.org)
RE: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?) (Shawn Fitzgerald <sargon97@...il.com>)
New Windows tool - PWDumpX v1.0 ("Reed Arvin" <reedarvin@...il.com>)
Monkey Boards version 0.3.5 Multiple Path Disclosure Vulnerabilities (jesper.jurcenoks@...vigilance.com)
[Aria-Security Team] FipsSHOP SQL Injection (Advisory@...a-Security.Net)
Potentially OT: AJAX article (clappymonkey@...il.com)
Re: PHP Event Calendar 1.5.1 (index.php) Remote File Include Vulnerability (Stuart Moore <smoore.bugtraq@...urityglobal.net>)
[USN-388-1] KOffice vulnerability (Kees Cook <kees@...ntu.com>)

November 30 (9 messages)

[USN-389-1] GnuPG vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1221-1] New libgsf packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1222-1] New proftpd packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDKSA-2006:217-1 ] - Updated proftpd packages fix vulnerabilities (security@...driva.com)
Secunia Research: MailEnable IMAP Service Two Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[security bulletin] HPSBUX02153 SSRT061181 rev.2 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial … (security-alert@...com)
[USN-390-1] evince vulnerability (Kees Cook <kees@...ntu.com>)
@lex Guestbook 4.0.1 : Full Path Disclosure & XSS (mr_kaliman@....com)
Seditio <= 1.10 (pollid) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)

591 messages

Powered by blists - more mailing lists