bugtraq mailing list - 2007/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2007/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 26	² 23	³ 35	⁴ 49	⁵ 29	⁶ 13	⁷
⁸ 40	⁹ 53	¹⁰ 22	¹¹ 36	¹² 32	¹³ 6	¹⁴
¹⁵ 18	¹⁶ 30	¹⁷ 15	¹⁸ 22	¹⁹ 14	²⁰ 6	²¹
²² 24	²³ 34	²⁴ 27	²⁵ 48	²⁶ 21	²⁷ 14	²⁸
²⁹ 27	³⁰ 18	³¹ 20

Messages by day:

January 1 (26 messages)

Spooky Login Multiple HTML Injection Vulnerability (DoZ@...kersCenter.com)
WinZip10.0 FileView ActiveX Controls CreateNewFolderFromName Method Buffer overflow (76693223@....com)
Re: PocketPC MMS - Remote Code Injection/Execution Vulnerability and Denial-of-Service ("Collin R. Mulliner" <collin@...aversion.net>)
Rediff Bol Downloader Allows Downloading and Spawning Arbitary Files ("gregory_panakkal" <gregory_panakkal@...tmail.fm>)
WinZip FileView ActiveX controls CreateNewFolderFromName Method Buffer Overflow Vulnerability (76693223@....com)
PHPIrc_bot <= Remote File Include (zooz_998@...mail.com)
vBulletin vCard PRO XSS (exexp@...mail.com)
Re: PlatinumFTP 1.0.18 remote DoS (info@...tinumftp.com)
[NGSEC] ngGame #3 - BrainStorming ("labs@...EC" <labs@...ec.com>)
BattleBlog Database Download Vulnerability (Advisory@...a-Security.net)
Kerio Fake 'iphlpapi' DLL injection Vulnerability (Matousec - Transparent security Research <research@...ousec.com>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Bill Nash <billn@...ln.net>)
golden book XSS (sn0oPy.team@...il.com)
rblog Database Download Vulnerability (Advisory@...a-Security.net)
ATMEL Linux PCI PCMCIA USB Drivers arbitrary code execution (sapheal@...k.pl)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Kevin Waterson <kevin@...ania.net>)
AShop Shopping Cart Multiple XSS Vulnerabilities (DoZ@...kersCenter.com)
[OpenPKG-SA-2007.001] OpenPKG Security Advisory (cacti) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
Mozilla Firefox 2.0 denial of service vulnerability (sapheal@...k.pl)
Re: Mozilla Firefox 2.0 denial of service vulnerability (Jeroen Massar <jeroen@...ix.org>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Tino Wildenhain <tino@...denhain.de>)
Re: Re: Mozilla Firefox 2.0 denial of service vulnerability (sapheal@...k.pl)
Re: XSS with Vbulletin (new idea !) (marco.van.herwaarden@...lletin.com)
RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] ("Jim Harrison" <Jim@...tools.org>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Dana Hudes <dhudes@...es.org>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Chad Maron <chad@...ianworks.net>)

January 2 (23 messages)

RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] ("Jim Harrison" <Jim@...tools.org>)
Dailymotion password reset vulnerability (daftrix@...il.com)
Welcome to Pwndertino... ("K F (lists)" <kf_lists@...italmunition.com>)
Re: [Full-disclosure] simplog 0.9.3.2 SQL injection (str0ke <str0ke@...w0rm.com>)
Re: [Full-disclosure] simplog 0.9.3.2 SQL injection (Javor Ninov <drfrancky@...urax.org>)
FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution (sapheal@...k.pl)
lblog Remote Password Disclosure (Advisory@...a-security.net)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Kevin Waterson <kevin@...ania.net>)
Openforum Remote password Disclosure (Advisory@...a-security.net)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Darren Reed <avalon@...igula.anu.edu.au>)
Re: PHP as a secure language? PHP worms? (Duncan Simpson <dps@...pson.demon.co.uk>)
AspBB Remote Password Disclosure (Advisory@...a-security.net)
RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] ("Jim Harrison" <Jim@...tools.org>)
RE: PHP as a secure language? PHP worms? ("Jim Harrison" <Jim@...tools.org>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Dana Hudes <dhudes@...es.org>)
Windows Vista 64bits and unexported kernel symbols ("Matthieu Suiche" <msuiche@...il.com>)
[ MDKSA-2007:001 ] - Update libmodplug packages fix buffer overflow vulnerabilities (security@...driva.com)
Nuked Klan <= 1.7 Remote Cookie Disclosure Exploit (kadaj-diabolik@...mail.fr)
rPSA-2006-0234-2 firefox thunderbird (rPath Update Announcements <announce-noreply@...th.com>)
Windows NT Message Compiler 1.00.5239 arbitrary code execution (sapheal@...k.pl)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Darren Reed <avalon@...igula.anu.edu.au>)
[ MDKSA-2007:002 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)
Re: SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit (wihl@...tartisans.com)

January 3 (35 messages)

Whos Johny Pwnerseed? (K F <kf@...italmunition.com>)
Re: [USN-398-1] Firefox vulnerabilities (Scott <geekboy@...rykeyboarder.com>)
Re: Windows Vista 64bits and unexported kernel symbols (Rik van Riel <riel@...riel.com>)
GuestBook v0.3a Remote Password Disclosure (Advisory@...a-security.net)
Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
openmedia local read file (exe_crack@...mail.com)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (sven.vetsch@...enchant.ch)
Re: Windows NT Message Compiler 1.00.5239 arbitrary code execution (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
[USN-399-1] w3m vulnerabilities (Kees Cook <kees@...ntu.com>)
Hacking AJAX DWR Applications (shulman@...erva.com)
Adobe Acrobat Reader Plugin - Multiple Vulnerabilities (Stefano Di Paola <stefano.dipaola@...ec.it>)
Re: Universal XSS with PDF files: highly dangerous (ascii <ascii@...amail.com>)
WineGlass "data.mdb" Remote Password Disclosure (Advisory@...a-security.net)
OpenPinboard <= Remote File Include (zooz_998@...mail.com)
Black Hat New Years Updates (Free Stuff, too!) (Jeff Moss <jmoss@...ckhat.com>)
WineGlass "data.mdb" Remote Password Disclosure (Advisory@...a-security.net)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Clean Access (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[USN-398-1] Firefox vulnerabilities (Kees Cook <kees@...ntu.com>)
Re: FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
Re: Windows NT Message Compiler 1.00.5239 arbitrary code execution ("chinese soup" <noodle.mastah@...il.com>)
Simple Web Content Management System SQL Injection Exploit (gmdarkfig@...il.com)
[USN-398-2] Firefox vulnerabilities (Kees Cook <kees@...ntu.com>)
Re: OpenPinboard <= Remote File Include (Stefano Zanero <s.zanero@...urenetwork.it>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (RSnake <rsnake@...cking.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Dave Ferguson" <gmdavef@...il.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Jean-Jacques Halans" <halans@...il.com>)
jgbbs (dr.t3rr0r1st@...oo.com)
a cheesy Apache / IIS DoS vuln (+a question) (Michal Zalewski <lcamtuf@...ne.ids.pl>)

January 4 (49 messages)

RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Larry Seltzer <Larry@...ryseltzer.com>)
Re: a cheesy Apache / IIS DoS vuln (+a question) ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
Re: a cheesy Apache / IIS DoS vuln (+a question) (Michal Zalewski <lcamtuf@...ne.ids.pl>)
CFP for RAID 2007 (Jeffrey Horton <jeffh@....edu.au>)
Re: [Full-disclosure] Universal XSS with PDF files: highly dangerous (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: a cheesy Apache / IIS DoS vuln (+a question) (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: a cheesy Apache / IIS DoS vuln (+a question) ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
Re: OpenSER OSP Module remote code execution (bogdan@...ce-system.ro)
Re: SMS handling OpenSER remote code executing (bogdan@...ce-system.ro)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (bugtraq@...security.net)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Jim Manico <jim@...ico.net>)
23C3 - Bluetooth hacking revisted [Summary and Code] (Thierry Zoller <Thierry@...ler.lu>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (RSnake <rsnake@...cking.com>)
LS-20061102 - Business Objects Crystal Reports XI Professional Stack Overflow Vulnerability (advisories@...ec.com)
MkPortal "All Guests are Admin" Exploit (info@...nhead.it)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
[vuln.sg] PowerArchiver PAISO.DLL Buffer Overflow Vulnerability (vulnpost-remove@...n.sg)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("HASEGAWA Yosuke " <yosuke.hasegawa@...il.com>)
Re: a cheesy Apache / IIS DoS vuln (+a question) (Siim Põder <windo@...rad-teel.net>)
Re: a cheesy Apache / IIS DoS vuln (+a question) (Pieter de Boer <pieter@...darkside.nl>)
Universal PDF XSS After Party ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
RE: [Full-disclosure] Universal XSS with PDF files: highly dangerous (Larry Seltzer <Larry@...ryseltzer.com>)
Re: Universal XSS with PDF files: highly dangerous (Thierry Zoller <Thierry@...ler.lu>)
Re: RE: [Full-disclosure] Universal XSS with PDF files: highly dangerous (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Lawrence Paul MacIntyre <macintyrelp@...l.gov>)
Re: [Full-disclosure] Universal PDF XSS After Party(posible solution) ("Darren Bounds" <dbounds@...il.com>)
RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] ("Jim Harrison" <Jim@...tools.org>)
SAP Security Contact ("Mark Litchfield" <mark@...bery.com>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Bill Nash <billn@...ln.net>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Ronald Chmara <ron@...s1.COM>)
[ GLSA 200701-01 ] DenyHosts: Denial of Service (Raphael Marichez <falco@...too.org>)
Re: [WEB SECURITY] RE: Universal PDF XSS After Party(posible solution) (RSnake <rsnake@...cking.com>)
Wordpress <= 2.x dictionnary & Bruteforce attack (kadaj-diabolik@...mail.fr)
Re: [WEB SECURITY] RE: [Full-disclosure] Universal XSS with PDF files: highly dangerous (RSnake <rsnake@...cking.com>)
Re: a cheesy Apache / IIS DoS vuln (+a question) (Rob Sherwood <capveg@...umd.edu>)
[ GLSA 200701-02 ] Mozilla Firefox: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
Correction (High Risk Vulnerability in the OpenOffice and StarOffice Suites) ("NGSSoftware Insight Security Research" <nisr@...software.com>)
[ GLSA 200701-03 ] Mozilla Thunderbird: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
Re: [VulnWatch] High Risk Vulnerability in the OpenOffice and StarOffice Suites (Florian Weimer <fw@...eb.enyo.de>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Rude Yak <rudeyak@...oo.com>)
Re: [VulnWatch] High Risk Vulnerability in the OpenOffice and StarOffice Suites ("David Litchfield" <davidl@...software.com>)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (RSnake <rsnake@...cking.com>)
High Risk Vulnerability in the OpenOffice and StarOffice Suites ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Concurrency strikes MSIE (potentially exploitable msxml3 flaws) (Michal Zalewski <lcamtuf@...ne.ids.pl>)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Martin O'Neal" <martin.oneal@...saire.com>)
DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability' ("K F (lists)" <kf_lists@...italmunition.com>)
Re: a cheesy Apache / IIS DoS vuln (+a question) (Michal Zalewski <lcamtuf@...ne.ids.pl>)
RE: Universal PDF XSS After Party(posible solution) ("Noe Espinoza M." <nespinoza@...powissen.com>)
RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws) (Larry Seltzer <Larry@...ryseltzer.com>)

January 5 (29 messages)

[USN-398-3] Firefox theme regression (Kees Cook <kees@...ntu.com>)
Perforce client: security hole by design (Ben Bucksch <news@...ksch.org>)
SAP Security ("Mark Litchfield" <mark@...bery.com>)
Re: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (rudeyak@...oo.com)
CMS Made Simple non-permanent XSS (nanoymaster@...il.com)
RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws) (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: [VulnWatch] High Risk Vulnerability in the OpenOffice and StarOffice Suites (Pete Connolly <pete.connolly@...nternet.com>)
[USN-401-1] D-Bus vulnerability (Kees Cook <kees@...ntu.com>)
[USN-400-1] Thunderbird vulnerabilities (Kees Cook <kees@...ntu.com>)
MkPortal Admin XSS (info@...nhead.it)
IG Shop remote code execution (asdfj38@...oo.com)
IG Calendar SQL Injection (asdfj38@...oo.com)
Uber Uploader 4.2 Arbitrary File Upload Vulnerability (null_hack@...oo.com)
Intranet Open Source Remote Password Disclosure "intranet.mdb" (Advisory@...a-security.net)
Advisory 02/2007: WordPress Trackback Charset Decoding SQL Injection Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit (gmdarkfig@...il.com)
iDefense Security Advisory 01.05.07: Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting V… (iDefense Labs <labs-no-reply@...fense.c…)
[DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixes XSS issue (Uwe Hermann <uwe@...mann-uwe.de>)
[DRUPAL-SA-2007-002] Drupal 4.6.11 / 4.7.5 fixes DoS issue (Uwe Hermann <uwe@...mann-uwe.de>)
RI Blog 1.3 XSS Vuln. (ShaFuq31@...MaiL.CoM)
Re: SAP Security Contact (Fritz.Bauspiess@....com)
Advisory 01/2007: WordPress CSRF Protection XSS Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Multiple bugs in EditTag (nj@...kerz.ir)
[USN-402-1] Avahi vulnerability (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 01.05.07: Opera Software Opera Web Browser JPG Image DHT Marker Heap Corruption Vulnerabilit… (iDefense Labs <labs-no-reply@...fense.c…)
Flog 1.1.2 Remote Admin Password Disclosure (corrado.liotta@...ce.it)
Kolayindir Download (Yenionline) (tr) SqL Injection Vuln. (ShaFuq31@...MaiL.CoM)
[OpenPKG-SA-2007.002] OpenPKG Security Advisory (bzip2) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
ZDI-07-001: QUALCOMM Eudora WorldMail Remote Management Heap Overflow Vulnerability (zdi-disclosures@...m.Com)

January 6 (13 messages)

Re: SAP Security Contact ("Thor (Hammer of God)" <thor@...merofgod.com>)
fetchmail security announcement 2006-03 (CVE-2006-5974) (Matthias Andree <matthias.andree@....de>)
fetchmail security announcement 2006-02 (CVE-2006-5867) (Matthias Andree <matthias.andree@....de>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Access Control Server (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
ohhASP Remote Password Disclosure (Advisory@...a-security.net)
iDefense Security Advisory 01.05.07: Kaspersky Antivirus Scan Engine PE File Denial of Service Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Yet Another Link Directory v1.0 (lunY@...fucktard.com)
[OpenPKG-SA-2007.003] OpenPKG Security Advisory (drupal) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
[OpenPKG-SA-2007.004] OpenPKG Security Advisory (fetchmail) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
Fix & Chips CMS v1.0 (luny@...fucktard.com)
shopstorenow (orange.asp) sql injection (emel_gw_ini@...oo.com)
FON Router allows anonymous web access (l.friedrichs@....nitag.de)
[OpenPKG-SA-2007.005] OpenPKG Security Advisory (wordpress) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)

January 8 (40 messages)

Re: OpenPinboard <= Remote File Include (jgraef@...rs.sf.net)
0trace - traceroute on established connections (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: [Full-disclosure] 0trace - traceroute on established connections (Michal Zalewski <lcamtuf@...ne.ids.pl>)
@lex Guestbook <= 4.0.2 Remote Command Execution Exploit (gmdarkfig@...il.com)
AJLogin v3.5 Remote Password Disclosure Vulnerability (beks@...mail.org)
EMembersPro 1.0 Remote Password Disclosure Vulnerability (beks@...mail.org)
MitiSoft Remote Password Disclosure Vulnerability (beks@...mail.org)
M-Core Remote Password Disclosure Vulnerability (beks@...mail.org)
HarikaOnline v2.0 Remote Password Disclosure Vulnerability (beks@...mail.org)
Webulas Remote Password Disclosure Vulnerability (beks@...mail.org)
Uguestbook Remote Password Disclosure Vulnerability (beks@...mail.org)
NUNE News Script (custom_admin_path) Remote File Include Vulnerablity (xorontr@...il.com)
[SECURITY] [DSA 1245-1] New proftpd packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
Dayfox Blog Remote File Include Vuln. (ShaFuq31@...MaiL.CoM)
Re: Perforce client: security hole by design (The Fungi <fungi@...goth.org>)
GeoBB Georgian Bulletin Board Remote File Include Vuln. (ShaFuq31@...MaiL.CoM)
Re: SAP Security Contact (Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>)
TK53 Advisory #1: CenterICQ remote DoS buffer overflow in LiveJournal handling ("Lolek of TK53" <lolek1337@...glemail.com>)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Martin O'Neal" <martin.oneal@...saire.com>)
MKPortal Full Path Disclosure (info@...nhead.it)
Re: Re: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (rudeyak@...oo.com)
HP Multiple Products PML Driver Local Privilege Escalation (Sowhat <smaillist@...il.com>)
QASEC Announcement: Writing Software Security Test Cases (bugtraq@...security.net)
magic photo storage website Remote File Inclusion (k1tk4t@...hack.org)
Re: [Full-disclosure] Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Packeteer PacketWise CLI overflow DoS (kian.mohageri@...il.com)
[SECURITY] [DSA 1246-1] New OpenOffice.org packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
rPSA-2007-0001-1 openoffice.org (rPath Update Announcements <announce-noreply@...th.com>)
Re: Universal XSS with PDF files: highly dangerous ("Jeff Williams" <jeff.williams@...ectsecurity.com>)
[SECURITY] [DSA 1247-1] New libapache-mod-auth-kerb packages fix remote denial of service (Noah Meyerhans <noahm@...ian.org>)
cisco nac bypass vulnerability - cisco trust agent (thorben schroeder <thorben@...ab.com>)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Martin O'Neal" <martin.oneal@...saire.com>)
Vendor guidelines regarding security contacts ("Steven M. Christey" <coley@...re.org>)
Re: Sun java System Messenger Express XSS (b2wang@...oo.com)
createauction (cats.asp) Remote SQL Injection Vulnerability (emel_gw_ini@...oo.com)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
Re: cisco nac bypass vulnerability - cisco trust agent (Stefano Zanero <s.zanero@...urenetwork.it>)
GForge Cross Site Scripting vulnerability (jose.palanco@...el.es)

January 9 (53 messages)

Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Jim Manico <jim@...ico.net>)
Re: Vendor guidelines regarding security contacts (security curmudgeon <jericho@...rition.org>)
[ MDKSA-2007:003 ] - Updated avahi packages fix DoS vulnerability (security@...driva.com)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (RSnake <rsnake@...cking.com>)
RFID open source library - RFIDIOt code release - version 0.1k (Adam Laurie <adam.laurie@...bunker.net>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (RSnake <rsnake@...cking.com>)
Cracking Steganography Application in less than ONE minute (thesinoda@...mail.com)
Re: a cheesy Apache / IIS DoS vuln (+a question) (Gadi Evron <ge@...uxbox.org>)
Re: RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws) (socket69@...mail.com)
Re: SAP Security Contact (Nicob <nicob@...ob.net>)
Re: FON Router allows anonymous web access (Thierry Zoller <Thierry@...ler.lu>)
Re: a cheesy Apache / IIS DoS vuln (+a question) (bugtraq <bugtraq@...urityfocus.lists.bitrouters.com>)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Guy Podjarny" <gpodjarny@...chfire.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Amit Klein <aksecurity@...il.com>)
[ MDKSA-2007:004 ] - Updated geoip packages fix geoipupdate vulnerability (security@...driva.com)
[KDE Security Advisory] ksirc Denial of Service vulnerability (Dirk Mueller <mueller@....org>)
Re: OpenPinboard <= Remote File Include ("Steven M. Christey" <coley@...re.org>)
Re: PHPKit 1.6.1 RC2 (faq/faq.php) Remote SQL Injection Exploit (yorn@...rymail.net)
Re: Uber Uploader 4.2 Arbitrary File Upload Vulnerability (recklessb@...rs.sourceforge.net)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Tom Stripling" <tstripling@...urityps.com>)
Sina UC ActiveX Multiple Remote Stack Overflow (Sowhat <smaillist@...il.com>)
Re: SAP Security Contact ("Stan Bubrouski" <stan.bubrouski@...il.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Brian Eaton" <eaton.lists@...il.com>)
ppc engine Multiple file inclusion (emel_gw_ini@...oo.com)
Re: Universal XSS with PDF files: highly dangerous (The Anarcat <anarcat@...rcat.ath.cx>)
magic photo storage website Multiple Remote File Inclusion (emel_gw_ini@...oo.com)
Re: [Full-disclosure] 0trace - traceroute on established connections (Alessandro Dellavedova <alessandro.dellavedova@...m-ieo-campus.it>)
Re: [Full-disclosure] 0trace - traceroute on established connections (Michal Zalewski <lcamtuf@...ne.ids.pl>)
rPSA-2007-0003-1 fetchmail (rPath Update Announcements <announce-noreply@...th.com>)
Re: [Full-disclosure] [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Jim Manico <jim@...ico.net>)
[USN-403-1] X.org vulnerabilities (Kees Cook <kees@...ntu.com>)
MITKRB5-SA-2006-002: kadmind (via RPC lib) calls uninitialized function pointer (Tom Yu <tlyu@....EDU>)
Re: [DCC SPAM] 0trace - traceroute on established connections (Lance James <lancej@...urescience.net>)
MITKRB5-SA-2006-003: kadmind (via GSS-API lib) frees uninitialized pointers (Tom Yu <tlyu@....EDU>)
Re: Cracking Steganography Application in less than ONE minute ("Michal Spadlinski" <gim913@...il.com>)
iDefense Security Advisory 01.09.07: Multiple Microsoft Products VML 'recolorinfo' Element Integer Overflow Vulnerabil… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 01.09.07: Microsoft Excel Long Palette Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 01.09.07: Microsoft Excel Invalid Column Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[USN-404-1] MadWifi vulnerability (Kees Cook <kees@...ntu.com>)
Re: a cheesy Apache / IIS DoS vuln (+a question) ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Tom Spector" <t.spector@...com>)
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous ("Marvin Simkin" <Marvin.Simkin@....edu>)
Easy Banner Pro Version 2.8 <= Remote File Inclusion (stormhacker@...mail.com)
CA BrightStor ARCserve Backup Tape Engine Exploit Security Notice ("Williams, James K" <James.Williams@...com>)
rPSA-2007-0004-1 bzip2 (rPath Update Announcements <announce-noreply@...th.com>)
Circumventing CSFR Form Token Defense (Jim Manico <jim@...ico.net>)
rPSA-2007-0005-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (rPath Update Announcements <announce-noreply@...th.com>)
iDefense Security Advisory 01.09.07: Multiple Vendor X Server Render Extension ProcRenderAddGlyphs Memory Corruption Vu… (iDefense Labs <labs-no-reply@...fense.c…)
[ MDKSA-2007-005 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities (security@...driva.com)
iDefense Security Advisory 01.09.07: Multiple Vendor X Server DBE Extension ProcDbeGetVisualInfo Memory Corruption Vuln… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 01.09.07: Multiple Vendor X Server DBE Extension ProcDbeSwapBuffers Memory Corruption Vulner… (iDefense Labs <labs-no-reply@...fense.c…)

January 10 (22 messages)

edit-x ecommerce (include_dir) Remote File include (emel_gw_ini@...oo.com)
iDefense Security Advisory 01.09.07: Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
slocate leaks filenames of protected directories (steven@...terwebnet.com)
Adobe Reader Remote Heap Memory Corruption - Subroutine Pointer Overwrite (Piotr Bania <bania.piotr@...il.com>)
[OpenPKG-SA-2007.006] OpenPKG Security Advisory (kerberos) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Ralph Angenendt <ralph@...g-alt-entf.org>)
Cisco Security Advisory: Cisco Unified Contact Center and IP Contact Center JTapi Gateway Vulnerability (Cisco Systems Product Security Incident Response Team <…)
Cisco Security Advisory: DLSw Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
iDefense Q-1 2007 Challenge (contributor <Contributor@...fense.com>)
[ MDKSA-2007:006 ] - Updated OpenOffice.org packages fix WMF vulnerability (security@...driva.com)
A Major design Bug in Steganography 1.7.x, 1.8 (latest) (Updated Version) (thesinoda@...mail.com)
Re: Re: Uber Uploader 4.2 Arbitrary File Upload Vulnerability (null_hack@...oo.com)
Re: [Full-disclosure] 0trace - traceroute on established connections (Jon Oberheide <jon@...rheide.org>)
VLC Format String Vulnerability also in XINE (Sven.Czaja@....de)
[ GLSA 200701-04 ] SeaMonkey: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
Re: slocate leaks filenames of protected directories (Dennis Jackson <dennis.jackson@...rect.co.uk>)
Re: SAP Security Contact ("Nick Boyce" <nick.boyce@...il.com>)
CS-Cart 1.3.3 (install.php) Remote File Include Vulnerability (ahmed_labib_hilmy@...oo.com)
Re: a cheesy Apache / IIS DoS vuln (+a question) (bugtraq <bugtraq@...urityfocus.lists.bitrouters.com>)
Re: Circumventing CSFR Form Token Defense (Florian Weimer <fw@...eb.enyo.de>)
Re: SAP Security Contact ("Thor (Hammer of God)" <thor@...merofgod.com>)
A Major design Bug in Camouflage 1.2.1 (latest) (thesinoda@...mail.com)

January 11 (36 messages)

sazcart v1.5 (cart.php) Remote File include (emel_gw_ini@...oo.com)
Re: Circumventing CSFR Form Token Defense (bugtraq@...hag.de)
Re: Vendor guidelines regarding security contacts (Chris Wysopal <weld@...nwatch.org>)
Re: Circumventing CSFR Form Token Defense (Peter Watkins <peterw@....net>)
VMware ESX server security updates (VMware Security team <security@...are.com>)
DMA[2007-0107a] OmniWeb Javascript Alert Format String Vulnerabiity and DMA[2007-0109a] Apple Finder Disk Image Volume … ("K F (lists)" <kf_lists@...italmunition…)
Re: A Major design Bug in Steganography 1.7.x, 1.8 (latest) (Updated Version) ("Dave \"No, not that one\" Korn" <davek_throwaway@...mail.com>)
[ MDKSA-2007:007 ] - Updated nvidia driver packages fix vulnerability (security@...driva.com)
[ MDKSA-2007:009 ] - Updated kdenetwork packages fix ksirc vulnerability (security@...driva.com)
Re: Vendor guidelines regarding security contacts (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ MDKSA-2007:008 ] - Updated kerberos packages fix vulnerability (security@...driva.com)
Computer Terrorism (UK) :: Incident Response Centre - Microsoft Outlook Vulnerability (advisories@...puterterrorism.com)
WMF CreateBrushIndirect vulnerability (DoS) (Alexander Sotirov <asotirov@...ermina.com>)
Xine-ui format string Vulnerabilties. (saik0pod@...oo.com)
Jshop Server 1.3 (irvian@...siden.com)
Re: SAP Security Contact ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
Re: A Major design Bug in Steganography 1.7.x, 1.8 (latest) (Updated Version) (hlangos-bugtraq@...ominate.com)
phpBB (privmsg.php) XSS Exploit (info@...nhead.it)
RE: Circumventing CSFR Form Token Defense ("James C. Slora Jr." <james.slora@...a.com>)
Calyptix Security Advisory CX-2007-001 - Snort 2.6.1.2 Integer Underflow Vulnerability (Calyptix Advisories <advisories2007@...yptix.com>)
Re: slocate leaks filenames of protected directories (Ben Wheeler <b.wheeler@...c.ac.uk>)
FreeBSD Security Advisory FreeBSD-SA-07:01.jail (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
rPSA-2007-0006-1 krb5 krb5-server krb5-services krb5-test krb5-workstation (rPath Update Announcements <announce-noreply@...th.com>)
ZDI-07-004: CA BrightStor ARCserve Backup Tape Engine Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
[security bulletin] HPSBMA02175 SSRT061174 rev.1 - HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Read Access to Files (security-alert@...com)
LayerOne 2007 CFP Announced ("Layer One" <layeronecfp@...il.com>)
ZDI-07-002: CA BrightStor ARCserve Backup Tape Engine Code Execution Vulnerability (zdi-disclosures@...m.com)
ZDI-07-003: CA BrightStor ARCserve Backup Message Engine Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
easy-content filemanager (hackerbinhphuoc@...oo.com)
[USN-405-1] fetchmail vulnerability (Kees Cook <kees@...ntu.com>)
Digital Armaments Security Pre-Advisory 11.01.2007: Grsecurity Kernel PaX - Local root vulnerability (info@...italarmaments.com)
[ MDKSA-2007:010 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
[security bulletin] HPSBMA02176 SSRT051035 rev.1 - HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Execution of Arbitrary Co… (security-alert@...com)
Re: Perforce client: security hole by design (Crispin Cowan <crispin@...ell.com>)
LS-20061002 - Computer Associates BrightStor ARCserve Backup Remote Code Execution Vulnerability (advisories@...ec.com)
Nwom topsites v3.0 (lunY@...fucktard.com)

January 12 (32 messages)

LunarPoll (PollDir) Remote File Include Vulnerabilities (ilkerKandemir@...et.com)
Ezboxx multiple vulnerabilities. (Info@...Sec.com)
xss in phpmyadmin <= 2.8.1 (alfa@...tuax.be)
[ MDKSA-2007:011 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
[USN-406-1] OpenOffice.org vulnerability (Kees Cook <kees@...ntu.com>)
Re (3): Circumventing CSFR Form Token Defense (bugtraq@...hag.de)
Corsaire Security Advisory: ChainKey Java Code Protection Bypass issue ("advisories" <advisories@...saire.com>)
Web Honeynet Project: announcement, exploit URLs this Wednesday (Gadi Evron <ge@...uxbox.org>)
Lies? [Was: Re: Digital Armaments Security Pre-Advisory 11.01.2007: Grsecurity Kernel PaX - Local root vulnerability] (Lubomir Kundrak <lkundrak@...hat.com>)
Re: Vendor guidelines regarding security contacts (Ben Bucksch <news@...ksch.org>)
Re: [Full-disclosure] Web Honeynet Project: announcement, (bugtraq@...security.net)
Micro CMS <= 3.5 Remote File Include Exploit (ilkerKandemir@...et.com)
Re: slocate leaks filenames of protected directories ("Dave Moore" <dave.j.moore@...il.com>)
[CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: xss in phpmyadmin <= 2.8.1 (alfa@...tuax.be)
Re: phpBB (privmsg.php) XSS Exploit (neothermic@...bb.com)
Re: [Full-disclosure] Web Honeynet Project: announcement, (Gadi Evron <ge@...uxbox.org>)
Wordpress disclosure of Table Prefix Weakness (process@...ct.org)
seeking comments on disclosure articles (smcalearney@....com)
Re: Corsaire Security Advisory: ChainKey Java Code Protection Bypass issue (Jim Manico <jim@...ico.net>)
[ MDKSA-2007:012 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)
Re: slocate leaks filenames of protected directories (Ben Wheeler <b.wheeler@...c.ac.uk>)
AIOCP SQL Injection Vulnerability (coloss7@...il.com)
AIOCP Login Bypass Vulnerability (coloss7@...il.com)
Naig <= 0.5.2 (this_path) Remote File Include Vulnerability ("me you" <r.5.7@...mail.com>)
[ GLSA 200701-05 ] KDE kfile JPEG info plugin: Denial of Service (Raphael Marichez <falco@...too.org>)
[ GLSA 200701-06 ] w3m: Format string vulnerability (Raphael Marichez <falco@...too.org>)
[ GLSA 200701-07 ] OpenOffice.org: EMF/WMF file handling vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200701-08 ] Opera: Two remote code execution vulnerabilities (Raphael Marichez <falco@...too.org>)
Re: Vendor guidelines regarding security contacts ("Steven M. Christey" <coley@...us.mitre.org>)
[SECURITY] [DSA 1248-1] New libsoup packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDKSA-2007:013 ] - Updated libneon0.26 packages fix vulnerability (security@...driva.com)

January 13 (6 messages)

Ipswitch WS_FTP 2007 Professional "wsftpurl" access violation vulnerability (sapheal@...k.pl)
Re: phpBB (privmsg.php) XSS Exploit (neothermic@...bb.com)
Re: Naig <= 0.5.2 (this_path) Remote File Include Vulnerability (maxpost@...ru)
PHP-Nuke <= 7.9 Old-Articles Block "cat" SQL Injection vulnerability (paisterist@...securityteam.net)
RE: seeking comments on disclosure articles ("Michael Scheidell" <scheidell@...nap.net>)
Trevorchan <= v0.7 Remote File Include Vulnerability (ilkerkandemir@...et.com)

January 15 (18 messages)

Ovidentia 5.6x Series Remote File İnclude (hotturk@...et.com)
Re: [Full-disclosure] 0trace - traceroute on established connections (Robert Święcki <jagger@...ecki.net>)
London DC4420 meet - Wednesday 17th January, 2007 (Major Malfunction <majormal@...ate-radio.org>)
[USN-407-1] libgtop2 vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Ipswitch WS_FTP 2007 Professional "wsftpurl" access violation vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
Oracle Passwords and OraBrute (paulw@...software.com)
Okul Web Otomasyon Sistemi (etkinlikbak.asp) SQL Injection Vulnerability (ilkerkandemir@...et.com)
Remedy Action Request System 5.01.02 - User Enumeration ("Davide Del Vecchio" <dante@...ghieri.org>)
Re: Re: Re: Uber Uploader 4.2 Arbitrary File Upload Vulnerability (recklessb@...rs.sourceforge.net)
[USN-408-1] krb5 vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Outpost Bypassing Self-Protection using file links Vulnerability (Matousec - Transparent security Research <research@...ousec.com>)
Jax Petition Book (languagepack) Remote File Include Vulnerabilities (ilkerkandemir@...et.com)
wcSimple Poll (password.txt) Remote Password Disclosure Vulnerablity (ilkerkandemir@...et.com)
InstantForum.NET Multiple Cross-Site Scripting Vulnerability (DoZ@...kersCenter.com)
Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities (bmatheny@...ocracy.net)
Uninformed Journal Release Announcement: Volume 6 (H D Moore <sflist@...italoffense.net>)
[USN-409-1] ksirc vulnerability (Martin Pitt <martin.pitt@...onical.com>)
liens_dynamiques xss and admin authentification (sn0oPy.team@...il.com)

January 16 (30 messages)

[ GLSA 200701-10 ] WordPress: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
Gallery <= 1.4.4-pl4 (phpbb_root_path) Remote File Include Vulnerability ("me you" <r.5.7@...mail.com>)
PHPATM Remote Password Disclosure Vulnerablity (nightmare@...ackerline.ir)
MS07-004 VML Integer Overflow Exploit (LifeAsaGeek@...il.com)
[ MDKSA-2007:017 ] - Updated wget packages fix ftp vulnerability (security@...driva.com)
[ MDKSA-2007:015 ] - Updated cacti packages SQL injection vulnerability (security@...driva.com)
[KDE Security Advisory] kpdf/kword/xpdf denial of service vulnerability (Dirk Mueller <mueller@....org>)
[ MDKSA-2007:016 ] - Updated fetchmail packages fix vulnerability (security@...driva.com)
dt_guestbook version 1.0f XSS vulnerability (jesper.jurcenoks@...vigilance.com)
rPSA-2007-0007-1 kdenetwork (rPath Update Announcements <announce-noreply@...th.com>)
Re: Gallery <= 1.4.4-pl4 (phpbb_root_path) Remote File Include Vulnerability (Chris Kelly <ckdake@...ake.com>)
[x0n3-h4ck] SmE FileMailer 1.21 Remote Sql Injextion Exploit (corrado.liotta@...ce.it)
Announcement: The Cross-site Request Forgery FAQ (bugtraq@...security.net)
Re: Gallery <= 1.4.4-pl4 (phpbb_root_path) Remote File Include Vulnerability (krasza@...il.com)
Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities (John McGuire <bugtraq@...eneandassoc.com>)
Re: Remedy Action Request System 5.01.02 - User Enumeration ("Davide Del Vecchio" <dante@...ghieri.org>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge (Simon Smith <simon@...soft.com>)
[ GLSA 200701-09 ] oftpd: Denial of Service (Raphael Marichez <falco@...too.org>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge ("K F (lists)" <kf_lists@...italmunition.com>)
vulnerability script indexu all versions (gamr-14@...mail.com)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge -I WILL BUY FOR MORE (Simon Smith <simon@...soft.com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge (Blue Boar <BlueBoar@...evco.com>)
rPSA-2007-0008-1 gd (rPath Update Announcements <announce-noreply@...th.com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge ("K F (lists)" <kf_lists@...italmunition.com>)
Re: Ipswitch WS_FTP 2007 Professional "wsftpurl" access violation vulnerability ("Eliah Kagan" <degeneracypressure@...il.com>)
[ MDKSA-2007:014 ] - Updated bluez-utils packages fix hidd vulnerability (security@...driva.com)
Re: Ipswitch WS_FTP 2007 Professional "wsftpurl" access violation vulnerability ("HACKPL - bugtraq/sapheal" <sapheal@...k.pl>)
[ GLSA 200701-11 ] Kronolith: Local file inclusion (Raphael Marichez <falco@...too.org>)
[ GLSA 200701-12 ] Mono: Information disclosure (Raphael Marichez <falco@...too.org>)
Re: Trevorchan <= v0.7 Remote File Include Vulnerability (Stefano Zanero <s.zanero@...urenetwork.it>)

January 17 (15 messages)

SYMSA-2007-001: Oracle Application Server 10g - Directory Traversal (research@...antec.com)
Re: WMF CreateBrushIndirect vulnerability (DoS) (temp0_123@...l.ru)
ZDI-07-005: Sun Microsystems Java GIF File Parsing Memory Corruption Vulnerability (zdi-disclosures@...m.com)
Re: MS07-004 VML Integer Overflow Exploit (lifeasageek@...il.com)
Windows logoff bug possible security vulnerability and exploit. (Rage Coder <ragecoder@....com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge (Blue Boar <BlueBoar@...evco.com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge (Simon Smith <simon@...soft.com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge -I WILL BUY FOR MORE (Jim Manico <jim@...ico.net>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge (Simon Smith <simon@...soft.com>)
[SECURITY] [DSA 1250-1] New cacti packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ISecAuditors Security Advisories] Oracle Reports Web Cartridge (RWCGI60) vulnerable to XSS (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge (Tim Newsham <newsham@...a.net>)
[x0n3-h4ck] myBloggie 2.1.5 XSS exploit (corrado.liotta@...ce.it)
Microsoft Help Workshop .CNT contents files buffer overflow vulnerability (porkythepig@...pi.pl)
Re: Windows logoff bug possible security vulnerability and exploit. (3APA3A <3APA3A@...URITY.NNOV.RU>)

January 18 (22 messages)

[security bulletin] HPSBUX02181 SSRT061289 rev.1 - HP-UX Running IPFilter, Remote Unauthorized Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBST02184 SSRT071296 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-001 Through MS07… (security-alert@...com)
Multiple OS kernel insecure handling of stdio file descriptor (XFOCUS Security Team <security@...cus.org>)
FW: [cacti-announce] Cacti 0.8.6j Released ("Warner Moore" <wmoore@....com>)
CYBSEC - Security Advisory: SAP Internet Graphics Service (IGS) Remote Buffer Overflow (CYBSEC Advisories <advisories@...sec.com>)
[USN-410-1] poppler vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Cisco Security Advisory: SSL/TLS Certificate and SSH Public Key Validation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Re: FW: [cacti-announce] Cacti 0.8.6j Released (Steve Friedl <steve@...xwiz.net>)
Re: Multiple OS kernel insecure handling of stdio file descriptor (3APA3A <3APA3A@...URITY.NNOV.RU>)
[security bulletin] HPSBPI02185 SSRT071290 rev.1 - HP Jetdirect Running ftp, Remote Denial of Service (DoS) (security-alert@...com)
Directory Traversal in ArsDigita Community System (Elliot Kendall <ekendall@...ndeis.edu>)
[ MDKSA-2007:018 ] - Updated koffice packages fix crafted pdf file vulnerability (security@...driva.com)
[ MDKSA-2007:019 ] - Updated pdftohtml packages fix crafted pdf file vulnerability (security@...driva.com)
[ MDKSA-2007:020 ] - Updated poppler packages fix crafted pdf file vulnerability (security@...driva.com)
[ MDKSA-2007:021 ] - Updated xpdf packages fix crafted pdf file vulnerability (security@...driva.com)
Re: Multiple OS kernel insecure handling of stdio file descriptor (Peter Jeremy <peter.jeremy@...atel-lucent.com.au>)
[ MDKSA-2007:022 ] - Updated tetex packages fix crafted pdf file vulnerability (security@...driva.com)
[x0n3-h4ck] sabros.us 1.7 XSS Exploit (corrado.liotta@...ce.it)
[ MDKSA-2007:023 ] - Updated libgtop2 packages fix buffer overflow vulnerability (security@...driva.com)
Re: [_SUSPEKT] - Re: [Full-disclosure] iDefense Q-1 2007 Challenge - Bayesian Filter detected spam (Simon Smith <simon@...soft.com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge -I WILL BUY FOR MORE (Simon Smith <simon@...soft.com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge -I WILL BUY FOR MORE (Simon Smith <simon@...soft.com>)

January 19 (14 messages)

Re: [Full-disclosure] iDefense Q-1 2007 Challenge -I WILL BUY FOR MORE (Simon Smith <simon@...soft.com>)
Re: Windows logoff bug possible security vulnerability and exploit. (Rage Coder <ragecoder@....com>)
Re: [Full-disclosure] iDefense Q-1 2007 Challenge -I WILL BUY FOR MORE (Roman Medina-Heigl Hernandez <roman@...labs.com>)
EUSecWest 2007 Papers (Dragos Ruiu <dr@....net>)
Re: CMS Made Simple non-permanent XSS (ted@...madesimple.org)
MyShoutBox Multiple Cross-Site Scripting Vulnerability (DoZ@...kersCenter.com)
Layered Defense Research Advisory: BitDefender Client 8.02 Format String Vulnerability (dh@...ereddefense.com)
TSLSA-2007-0003 - multi (Trustix Security Advisor <tsl@...stix.org>)
DoS against AVM Fritz!Box 7050 (and others) (collin@...aversion.net)
Help project files (.HPJ) buffer overflow vulnerability in Microsoft Help Workshop (porkythepig@...pi.pl)
Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass (advisory07@...p.ru)
WzdFTPD < 8.1 Denial of service (S21sec Labs <labs@...sec.com>)
DIMVA 2007: Final Call for Papers (Robin Sommer <info@...va.org>)
[RISE-2007001] Apple Mac OS X 10.4.x kernel shared_region_map_file_np() memory corruption vulnerability (RISE Security <advisories@...esecurity.org>)

January 20 (6 messages)

a-forum xss (sn0oPy@...nir-geopolitique.net)
Re: Multiple OS kernel insecure handling of stdio file descriptor (Shiva Persaud <shivapd@...tin.ibm.com>)
Login Manager Multiple HTML Injections (DoZ@...kersCenter.com)
Paypal Subscription Manager Multiple HTML Injections (DoZ@...kersCenter.com)
SMF "index.php?action=pm" Cross Site-Scripting (Advisory@...a-security.net)
Digital Armaments Security Advisory 20.01.2007: Grsecurity Kernel PaX Vulnerability (info@...italarmaments.com)

January 22 (24 messages)

XSS in 212cafeBoard ( Verision 0.08 & 6.30 Beta ) (xx_hack_xx_2004@...mail.com)
Sun Microsystems Java GIF File Parsing Memory Corruption Vulnerability Prove Of Concept Exploit (luoluonet@....com)
Wiki-how path disclosure (iamtheevil1@...il.com)
Re: [Full-disclosure] Check Point Connectra End Point security bypass (Felix Lindner <fx@...re-labs.com>)
Re: SMF "index.php?action=pm" Cross Site-Scripting (lfx4sodas@...il.com)
FishCart [injection sql] (saps.audit@...il.com)
Re: Multiple OS kernel insecure handling of stdio file descriptor (Carson Gaspar <carson@...tos.org>)
FreeForum 0.9.0 <=- (index.php fpath) Remote File Include Vulnerability ("me you" <r.5.7@...mail.com>)
Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass (jn@....de)
[SECURITY] [DSA 1251-1] New netrik packages fix arbitary shell command execution (Steve Kemp <skx@...ian.org>)
Re: [Full-disclosure] Multiple OS kernel insecure handling of stdio file descriptor (Troy Bollinger <troy@...tin.ibm.com>)
XMB "U2U Instant Messenger" Cross-Site Scripting (Advisory@...a-security.net)
Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass ("security@...pot.de" <security@...pot.de>)
XSS in Guestbook ( v.4.00 beta ) (xx_hack_xx_2004@...mail.com)
SQL Injection in Unique Ads ( UDS ) (xx_hack_xx_2004@...mail.com)
cmsimple 2.7 Remote File Include ("mr alkomandoz" <k3g@...kermail.com>)
Microsoft Visual C++ (.RC) resource files buffer overflow vulnerability (porkythepig@...pi.pl)
phpAdsNew 2.0.7 Remote File Include ("mr alkomandoz" <k3g@...kermail.com>)
PHP Link Directory XSS Vulnerability version <= 3.0.6 (jussi.vuokko@...lehouse.com)
Full Path Disclosure in Open-Realty ( v2.3.4 ) (xx_hack_xx_2004@...mail.com)
Fantastic News <=- (news.php) Remote File Include Vulnerability ("me you" <r.5.7@...mail.com>)
Check Point Connectra End Point security bypass ("Roni Bachar" <roni@...et.co.il>)
Re: Re: SMF "index.php?action=pm" Cross Site-Scripting (alexbove@...il.com)
[x0n3-h4ck] bitweaver 1.3.1 XSS Exploit (corrado.liotta@...ce.it)

January 23 (34 messages)

UploadScript <=- v1.02 (password.txt) Remote Password Disclosure Vulnerability ("me you" <r.5.7@...mail.com>)
Uploader <= (userdata/user_1.txt) Password Disclosure Vulnerability ("me you" <r.5.7@...mail.com>)
[ GLSA 200701-13 ] Fetchmail: Denial of Service and password disclosure (Matthias Geerdsen <vorlon@...too.org>)
Re: FishCart [injection sql] (Michael Brennen <michael@...hnet.us>)
SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before ("Rolf Huisman" <r.l.r.huisman@...e.nl>)
[ GLSA 200701-14 ] Mod_auth_kerb: Denial of Service (Raphael Marichez <falco@...too.org>)
[ GLSA 200701-15 ] Sun JDK/JRE: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200701-16 ] Adobe Acrobat Reader: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
rPSA-2007-0011-1 wget (rPath Update Announcements <announce-noreply@...th.com>)
Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting (Outlaw@...a-security.net)
Safari Improperly Parses HTML Documents & BlogSpot XSS vulnerability (Jose Avila III <jose@...ra.com>)
Re: Fantastic News <=- (news.php) Remote File Include Vulnerability <- bogus... again (Mailinglists Address <mailinglist@...resshosting.net>)
[ MDKSA-2007:024 ] - Updated kdegraphics packages fix crafted pdf file vulnerability (security@...driva.com)
AToZed Software Intraweb Component for Borland Delphi and Kylix DoS vulnerability ("C0r3 1mp4ct" <c0r31mp4ct@...il.com>)
Bluetooth DoS by obex push (hornung@...washington.edu)
Bluetooth DoS by obex push (Armin Hornung <hornung@...washington.edu>)
rPSA-2007-0012-1 ed (rPath Update Announcements <announce-noreply@...th.com>)
xss filter to protect from xss attacks ("Anurag Agarwal" <anurag.agarwal@...oo.com>)
Re: Multiple OS kernel insecure handling of stdio file descriptor (eugeny gladkih <john@...eb.com>)
Re: Bluetooth DoS by obex push [readable] (hornung@...washington.edu)
Adobe ColdFusion Information Disclosure ("zck zck" <zckzck@...il.com>)
[ GLSA 200701-17 ] libgtop: Privilege escalation (Matthias Geerdsen <vorlon@...too.org>)
Re: Digital Armaments Security Advisory 20.01.2007: Grsecurity Kernel PaX Vulnerability (nospam@...ek.kroemeke.eu)
Re: phpAdsNew 2.0.7 Remote File Include (l.d.0@...mail.com)
rPSA-2007-0015-1 libsoup (rPath Update Announcements <announce-noreply@...th.com>)
Re: Windows logoff bug possible security vulnerability and exploit. ("Bart ...." <need4angel@...mail.com>)
[ECHO_ADV_62$2007] Upload Service 1.0 remote file inclusion (y3dips@...il.com)
rPSA-2007-0014-1 libgtop (rPath Update Announcements <announce-noreply@...th.com>)
Re: Multiple SQL injections and XSS in FishCart 3.1 (michael@...hnet.us)
SUSE Security Announcement: squid (SUSE-SA:2007:012) (Thomas Biege <thomas@...e.de>)
RANDOM PHP QUOTE 1.0 (pwd.txt) Remote Password Disclosur (the.tiger100@...il.com)
Re: DoS against AVM Fritz!Box 7050 (and others) (Matthias Wenzel <bugtraq-list@...zoo.de>)
[ GLSA 200701-18 ] xine-ui: Format string vulnerabilities (Raphael Marichez <falco@...too.org>)
[ MDKSA-2006:217-2 ] - Updated proftpd packages fix vulnerabilities (security@...driva.com)

January 24 (27 messages)

[ MDKSA-2007:025 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)
[ GLSA 200701-19 ] OpenLDAP: Insecure usage of /tmp during installation (Raphael Marichez <falco@...too.org>)
subscribe (pwd.txt) Remote Password Disclosur (the.tiger100@...il.com)
rPSA-2007-0013-1 poppler tetex tetex-afm tetex-dvips tetex-fonts tetex-latex tetex-xdvi (rPath Update Announcements <announce-noreply@...th.com>)
[USN-411-1] libsoup vulnerability (Kees Cook <kees@...ntu.com>)
PR06-14: IP Phones based on Centrality Communications/Aredfox PA168 chipset weak session management vulnerability (ProCheckUp Research <research@...checkup.com…)
Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include Vulnerability ("me you" <r.5.7@...mail.com>)
SUSE Security Announcement: xine (SUSE-SA:2007:013) (Thomas Biege <thomas@...e.de>)
[ MDKSA-2007:026 ] - Updated squid packages fix vulnerabilities (security@...driva.com)
[ GLSA 200701-20 ] Centericq: Remote buffer overflow in LiveJournal handling (Raphael Marichez <falco@...too.org>)
[USN-412-1] GeoIP vulnerability (Kees Cook <kees@...ntu.com>)
[USN-413-1] BlueZ vulnerability (Kees Cook <kees@...ntu.com>)
Re: Safari Improperly Parses HTML Documents & BlogSpot XSS vulnerability (Robert Tasarz <robert.tasarz@...entech.pl>)
[Aria-Security Team] MyBB Cross-Site Scripting (Advisory@...a-Security.Net)
Toxiclab Shoutbox Password Disclosure Vulnerability (beks@...mail.org)
Secunia Research: NCTsoft Products NCTAudioFile2 ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Sienzo Digital Music Mentor NCTAudioFile2 ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[CAID 34993]: CA BrightStor ARCserve Backup for Laptops and Desktops Multiple Overflow Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: AToZed Software Intraweb Component for Borland Delphi and Kylix DoS vulnerability (mail@...ihariri.com)
ZixForum <= 1.14 (Zixforum.mdb) Remote Password Disclosure Vulnerability ("me you" <r.5.7@...mail.com>)
Maxtricity Tagger Password Disclosure Vulnerability (beks@...mail.org)
Re: Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include Vulnerability (Stefano Zanero <s.zanero@...urenetwork.it>)
Re: FreeForum 0.9.0 <=- (index.php fpath) Remote File Include Vulnerability (Stefano Zanero <s.zanero@...urenetwork.it>)
Re: Secunia Research: NCTsoft Products NCTAudioFile2 ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Cisco Security Advisory: Crafted TCP Packet Can Cause Denial of Service (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: IPv6 Routing Header Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Crafted IP Option Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)

January 25 (48 messages)

[OPENADS-SA-2007-001] phpAdsNew and phpPgAds 2.0.9-pr1 vulnerability fixed (Matteo Beccati <php@...cati.com>)
Re: phpAdsNew 2.0.7 Remote File Include (matteo@...cati.com)
Weaknesses in Pingback Design (bmatheny@...ocracy.net)
[ GLSA 200701-21 ] MIT Kerberos 5: Arbitrary Remote Code Execution (Matthias Geerdsen <vorlon@...too.org>)
DoS against Telligent Community Server (bmatheny@...ocracy.net)
[security bulletin] HPSBUX02186 SSRT071299 rev.1 - HP-UX running Apache Remote Execution of Arbitrary Code, Denial of Service (DoS), Unaut… (security-alert@...com)
ZDI-07-006: Citrix Metaframe Presentation Server Print Provider Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
Multiple Remote Vulnerabilities in Wordpress (bmatheny@...ocracy.net)
Oracle Buffer Overflow in DBMS_REPCAT_UNTRUSTED.UNREGISTER_SNAPSHOT (Team SHATTER <shatter@...secinc.com>)
Oracle Buffer Overflow in DBMS_LOGMNR.ADD_LOGFILE (Team SHATTER <shatter@...secinc.com>)
Oracle Buffer Overflow in DBMS_LOGREP_UTIL.GET_OBJECT_NAME (Team SHATTER <shatter@...secinc.com>)
Oracle Multiple Buffer Overflows and DoS attacks in public procedures of MDSYS.MD (Team SHATTER <shatter@...secinc.com>)
[CAID 34818]: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL (Team SHATTER <shatter@...secinc.com>)
Oracle Buffer Overflow in DBMS_DRS.GET_PROPERTY (Team SHATTER <shatter@...secinc.com>)
[USN-414-1] Squid vulnerabilities (Kees Cook <kees@...ntu.com>)
Remove all admin->root authorization prompts from OSX ("K F (lists)" <kf_lists@...italmunition.com>)
Re: AToZed Software Intraweb Component for Borland Delphi and Kylix DoS vulnerability (bounce@...ihariri.com)
rPSA-2007-0019-1 gtk (rPath Update Announcements <announce-noreply@...th.com>)
ASP NEWS <= V3 (news_detail.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Xero Portal v1.2 (phpbb_root_path) Remote File Include Vulnerablity (xorontr@...il.com)
uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
EzDatabase Multiple Cross-Site Scripting Vulnerability (DoZ@...kersCenter.com)
ASP EDGE <= V1.2b (user.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Re: phpCOIN <= RC-1 (modules/mail/index.php) Remote File Include Vulnerability (str0ke <str0ke@...w0rm.com>)
makit news/blog poster <=v3(news_page.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
BIND remote exploit (low severity) [Fwd: Internet Systems Consortium Security Advisory.] (Lebbeous Weekley <lebbeous@...ricanelabs.com>)
Aztek Forum 4.1 Multiple Vulnerabilities Exploit (gmdarkfig@...il.com)
phpCOIN <= RC-1 (modules/mail/index.php) Remote File Include Vulnerability ("me you" <r.5.7@...mail.com>)
[x0n3-h4ck] Siteman 1.1.11 Remote Md5 Hash Disclosure Vulnerability (corrado.liotta@...ce.it)
[x0n3-h4ck] Siteman 2.0.x2 Remote Md5 Hash Disclosure Vulnerability (corrado.liotta@...ce.it)
GPS 1.2 Content Managing System (print.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
[NETRAGARD-20061218 SECURITY ADVISORY] [@Mail WebMail Cross Site Request Forgery] (Netragard Security Advisories <advisories@...ragard.com>)
Re: Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL ("Steven M. Christey" <coley@...re.org>)
[ GLSA 200701-22 ] Squid: Multiple Denial of Service vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
Buffer overflow in VSAPI library of Trend Micro VirusWall 3.81 for Linux (Sebastian Wolfgarten <sebastian.wolfgarten@....net>)
The certification password of Internet Explorer 7 and operation of auto complete (support@...poroworks.ne.jp)
high5 Review script Security Risk (anon@...n.com)
RE: Remove all admin->root authorization prompts from OSX ("Marvin Simkin" <Marvin.Simkin@....edu>)
Re: Aztek Forum 4.1 Multiple Vulnerabilities Exploit (gmdarkfig@...il.com)
Re: Remove all admin->root authorization prompts from OSX ("A. Shaw" <osxauth@...oo.com>)
Vulnerability disclosure comments (Shawna McAlearney <SMcAlearney@....com>)
Re: Oracle Buffer Overflow in DBMS_LOGREP_UTIL.GET_OBJECT_NAME ("Steven M. Christey" <coley@...re.org>)
Omniture SiteCatalyst Multiple Cross-Site Scripting Vulnerabilities (DoZ@...kersCenter.com)
Re: [Full-disclosure] 0trace - traceroute on established connections (Jon Oberheide <jon@...rheide.org>)
Re: AToZed Software Intraweb Component for Borland Delphi and Kylix DoS vulnerability ("C0r3 1mp4ct" <c0r31mp4ct@...il.com>)
Re: ZixForum <= 1.14 (Zixforum.mdb) Remote Password Disclosure Vulnerability (anonym@...nym.com)
RubyGems 0.9.0 and earlier installation exploit (Eric Hodel <drbrain@...ment7.net>)

January 26 (21 messages)

Medium Risk Vulnerability in PGP Desktop ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Re: [Full-disclosure] rPSA-2007-0011-1 wget (Ron DuFresne <dufresne@...ternet.com>)
[USN-410-2] teTeX vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 200701-24 ] VLC media player: Format string vulnerability (Matthias Geerdsen <vorlon@...too.org>)
[OPENADS-SA-2007-002] Max Media Manager v0.1.29 and v0.3.30 vulnerability fixed (Matteo Beccati <php@...cati.com>)
Movable Type <= 3.33 XSS Exploit (teracci2002@...oo.co.jp)
Re: Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting (sirdarckcat@...il.com)
[ MDKSA-2007:027 ] - Updated xine-ui packages fix vulnerabilities (security@...driva.com)
Re: SMF "index.php?action=pm" Cross Site-Scripting (Lise Moorveld <lise_moorveld@...oo.com>)
[ GLSA 200701-23 ] Cacti: Command execution and SQL injection (Matthias Geerdsen <vorlon@...too.org>)
Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger (hainamluke@...oo.com)
PHP Membership Manager Cross-Site Scripting Vulnerability (DoZ@...kersCenter.com)
FdScript <= v1.3.2 Remote File Disclosure Vulnerability (ajannhwt@...mail.com)
S21sec-034-en: Cisco VTP DoS vulnerability (S21sec Labs <labs@...sec.com>)
iDefense Security Advisory 01.26.07: Multiple Vendor libchm Page Block Length Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Remove all admin->root authorization prompts from OSX (Baptiste Malguy <baptiste.malguy@...easynet.net>)
Re: Remove all admin->root authorization prompts from OSX (Ben Bucksch <news@...ksch.org>)
Re: Remove all admin->root authorization prompts from OSX (John Smith <genericjohnsmith@...il.com>)
rPSA-2007-0021-1 bind bind-utils (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0020-1 rmake (rPath Update Announcements <announce-noreply@...th.com>)
Dexia website security alert (Jos Kirps <jos@...ps.com>)

January 27 (14 messages)

WS_FTP 2007 Professional SCP handling format string vulnerability ("Michal Bucko" <michal.bucko@...k.pl>)
Re: [OPENADS-SA-2007-002] Max Media Manager v0.1.29 and v0.3.30 vulnerability fixed (Matteo Beccati <php@...cati.com>)
[ MDKSA-2007:029 ] - Updated libsoup packages fix DoS vulnerability (security@...driva.com)
stompy the session stomper - tool availability (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Full Disclosure: Arbitrary Code Execution in LedgerSMB CVE-2006-5872 (Chris Travers <chris@...atrontech.com>)
[USN-398-4] Firefox regression (Kees Cook <kees@...ntu.com>)
Re: Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger (Outlaw@...a-security.net)
Open Conference Systems = 2.8.2 Remote File Inclusion (trzindan@...mail.com)
[ MDKSA-2007:028 ] - Updated ulogd packaged to address buffer overflow vulnerability (security@...driva.com)
AdMentor (banners) admin SQL injection (sn0oPy.team@...il.com)
local Calendar System v1.1 (lcStdLib.inc) Remote File Include (trzindan@...mail.fr)
RE: Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger ("Ahmed Sheipani" <sheipani@...il.com>)
[SECURITY] [DSA 1252-1] New vlc packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1253-1] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))

January 29 (27 messages)

Re: Open Conference Systems = 2.8.2 Remote File Inclusion (Michał Melewski <mike@...stein.kill-9.pl>)
[OpenPKG-SA-2007.007] OpenPKG Security Advisory (bind) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
[SECURITY] [DSA 1254-1] New bind9 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
MDPro 1.0.76 - Multiple Remote Vulnerabilities (adexior@...il.com)
Internet Explorer 7 ActiveX bgColor property NULL pointer dereference (DoS) (Alexander Sotirov <asotirov@...ermina.com>)
[OpenPKG-SA-2007.008] OpenPKG Security Advisory (cvstrac) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
Xt-Stats v.2.4.0.b3 - Remote File Include Vulnerabilities (h4cked.eg@...mail.com)
Re: Dexia website security alert (Thierry Zoller <Thierry@...ler.lu>)
Fake: Open Conference Systems = 2.8.2 Remote File Inclusion (bzhbfzj3001@...akemail.com)
Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include (Stefano Zanero <s.zanero@...urenetwork.it>)
CVSTrac 2.0.0 Denial of Service (DoS) vulnerability ("Ralf S. Engelschall" <rse@...elschall.com>)
Defeating CAPTCHAs via Averaging (noreply9871234@...-habe-fertig.com)
Phorum HTML Injection Vulnerability (DoZ@...kersCenter.com)
Re: stompy the session stomper - tool availability (Rogan Dawes <lists@...es.za.net>)
gnopaste <= 0.5.3 (index.php) Remote File Include Vulnerability (trzindan@...mail.fr)
AdMentor (banners) admin SQL injection (sn0oPy.team@...il.com)
Re: Fake: Open Conference Systems = 2.8.2 Remote File Inclusion (Michał Melewski <mike@...stein.kill-9.pl>)
Re: Phorum HTML Injection Vulnerability (brian@...rum.org)
Re: Windows logoff bug possible security vulnerability and exploit. (Rage Coder <ragecoder@....com>)
Re: Fake: Open Conference Systems = 2.8.2 Remote File Inclusion (Michał Melewski <mike@...stein.kill-9.pl>)
Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include (Gadi Evron <ge@...uxbox.org>)
Arbitrary Code Execution in SQL-Ledger and LedgerSMB through redirects (Chris Travers <chris@...atrontech.com>)
Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include (Stefano Zanero <s.zanero@...urenetwork.it>)
[ GLSA 200701-25 ] X.Org X server: Multiple vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
Re: Re: Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL (shatter@...secinc.com)
Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include (Simple Nomad <thegnome@...c.org>)
Re: stompy the session stomper - tool availability (Michal Zalewski <lcamtuf@...ne.ids.pl>)

January 30 (18 messages)

Re: Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger ("3B.Security Researcher" <3b.maillist@...il.com>)
Re: Open Conference Systems = 2.8.2 Remote File Inclusion (Stefano Zanero <s.zanero@...urenetwork.it>)
VII National Computer and Information Security Conference ACIS 2007 - COLOMBIA (Jeimy Cano <jjcano@...oo.com>)
RBL - ASP (scripts with db) SQL injection (sn0oPy.team@...il.com)
Oracle - Indirect Privilege Escalation and Defeating Virtual Private Databases ("David Litchfield" <davidl@...software.com>)
[DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue (Uwe Hermann <uwe@...mann-uwe.de>)
COSEINC Alert: Microsoft Agent Heap Overflow Vulnerability Technical Details (Patched) ("Coseinc" <alu@...einc.com>)
rPSA-2007-0020-2 rmake (rPath Update Announcements <announce-noreply@...th.com>)
Re: [Full-disclosure] S21sec-034-en: Cisco VTP DoS vulnerability (Clay Seaman-Kossmeyer <ckossmey@...co.com>)
RBL - ASP (scripts with db) SQL injection (sn0oPy.team@...il.com)
Re: gnopaste <= 0.5.3 (index.php) Remote File Include Vulnerability (Francesco Laurita <francesco@...ncesco-laurita.info>)
PhP Generic library & framework (include_path) Remote File Include Exploit (umutc4n@...mail.com)
Re: Fake: Open Conference Systems = 2.8.2 Remote File Inclusion (bzhbfzj3001@...akemail.com)
EncapsCMS 0.3.6 (common_foot.php) Remote File Include (trzindan@...mail.fr)
Atsphp 5.0.1 [Top Sites] [index.php] - Remote File Include (trzindan@...mail.fr)
Re: Defeating CAPTCHAs via Averaging (Alexander Klimov <alserkli@...ox.ru>)
[ MDKSA-2007:030 ] - Updated bind packages fix DoS vulnerabilities (security@...driva.com)
Re: BOGUS: Atsphp 5.0.1 [Top Sites] [index.php] - Remote File Include (Mailinglists Address <mailinglist@...resshosting.net>)

January 31 (20 messages)

Remote Unauthenticated Code Execution CA BrightStor ARCserve Backup ("NGS Software Insight Security Research" <mark@...bery.com>)
Remote Unauthenticated Code Execution II CA BrightStor ARCserve Backup for Laptops & Desktops ("NGS Software Insight Security Research" <mark@...bery.com>)
OWASP JBroFuzz 0.4 Fuzzer Released! (subere@...on.org)
Remote DOS BrightStor ARCserve Backup for Laptops & Desktops ("NGS Software Insight Security Research" <mark@...bery.com>)
Remote Unauthenticated Resource Exhaustion CA Mobile BackupService ("NGS Software Insight Security Research" <mark@...bery.com>)
Oracle 10g R2 Enterprise Manager Directory Traversal ("NGS Software Insight Security Research" <mark@...bery.com>)
2007 Security OPUS CFP: Closed (Agenda included) (Sharkey <pdxsharkey@...il.com>)
Cisco Security Advisory: SIP Packet Reloads IOS Devices Not Configured for SIP (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[ECHO_ADV_63$2007] Cadre remote file inclusion (y3dips@...il.com)
Re: Atsphp 5.0.1 [Top Sites] [index.php] - Remote File Include (Casey Marshall <rsdio@...astatic.org>)
Re: Defeating CAPTCHAs via Averaging (Fred Leeflang <fredl@...chie.org>)
Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include (Gadi Evron <ge@...uxbox.org>)
[SECURITY] [DSA 1255-1] New libgtop2 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Windows Vista and unexported kernel symbols (Part II, 32bits version) ("Matthieu Suiche" <msuiche@...il.com>)
[ GLSA 200701-27 ] ELinks: Arbitrary Samba command execution (Raphael Marichez <falco@...too.org>)
[ GLSA 200701-28 ] thttpd: Unauthenticated remote file access (Raphael Marichez <falco@...too.org>)
BBED - Oracle Block Browser and Editor (pete@...efinnigan.com)
[ GLSA 200701-26 ] KSirc: Denial of Service vulnerability (Raphael Marichez <falco@...too.org>)
[SECURITY] [DSA 1256-1] New gtk+2.0 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Re: stompy the session stomper - tool availability (Michal Zalewski <lcamtuf@...ne.ids.pl>)

702 messages

Powered by blists - more mailing lists