bugtraq mailing list - 2008/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 5	² 10	³ 6	⁴	⁵
⁶ 20	⁷ 11	⁸ 15	⁹ 12	¹⁰ 8	¹¹	¹²
¹³ 15	¹⁴ 8	¹⁵ 19	¹⁶ 6	¹⁷ 6	¹⁸ 1	¹⁹
²⁰ 16	²¹ 6	²² 11	²³ 10	²⁴ 5	²⁵ 4	²⁶
²⁷ 18	²⁸ 5	²⁹ 9	³⁰ 25	³¹ 18

Messages by day:

October 1 (5 messages)

RE: MySQL command-line client HTML injection vulnerability ("Quark IT - Hilton Travis" <Hilton@...rkIT.com.au>)
Printlog <= 0.4: Remote File Edition Vulnerability (Pepelux <pepelux@...e-sec.org>)
Oracle Password Cracker written in PL/SQL (pete@...efinnigan.com)
Remote and Local File Inclusion Vulnerability <= 1.1 Rportal (kadfrox@...il.com)
phpMyID can act as a redirector and as headers injector (atomo64@...il.com)

October 2 (10 messages)

Re: MS Internet Explorer 7 Denial Of Service Exploit ("Pruett, Mike" <mpruett@...avision.com>)
[USN-649-1] OpenSSH vulnerabilities (Kees Cook <kees@...ntu.com>)
FreeBSD Security Advisory FreeBSD-SA-08:10.nd6 (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Adobe Flash Player plug-in null pointer dereference and browser crash ("Matthew Dempsky" <matthew@...himedia.com>)
XSS vulnerability in phpMyID (Raphael Geissert <atomo64@...il.com>)
Layered Defense Research Advisory: Juniper Netscreen Firewall Cross-Site-Scripting (XSS) event log injection (dh@...ereddefense.com)
Re: [MajorSecurity Advisory #53]BLUEPAGE CMS - Cross Site Scripting and Session Fixation Issues (admin@...orsecurity.de)
HostAdmin Cross-Site Scripting Vulnerabilities (admin@...st.ir)
Re: White Wolf Labs #080922-1: Exploitation Through ActiveSync 4.x ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Re: Blue Coat xss (Tom Kelly <tom.kelly@...ecoat.com>)

October 3 (6 messages)

Re: "Exploit creation - The random approach" or "Playing with random to build exploits" ("Nelson Brito" <nbrito@...ure.org>)
[USN-650-1] cpio vulnerability (Jamie Strandboge <jamie@...onical.com>)
Website Directory - XSS Exploit (Ghost hacker <ghost-r00t@...mail.com>)
Re: RE: MySQL command-line client HTML injection vulnerability (mrry.dmlo@...il.com)
Re: "Exploit creation - The random approach" or "Playing with random to build exploits" (Eygene Ryabinkin <rea-sec@...elabs.ru>)
Secunia Research: Trend Micro OfficeScan Directory Traversal Vulnerability (Secunia Research <remove-vuln@...unia.com>)

October 6 (20 messages)

CMME Multiple Information disclosure vulnerabilities (admin@...report.ir)
VMware Emulation Flaw x64 Guest Privilege Escalation (1/2) (ds.adv.pub@...il.com)
[SECURITY] [DSA-1645-1] New lighttpd packages fix various problems (Steve Kemp <skx@...ian.org>)
[ENABLESECURITY] Apple's Mail.app stores your S/MIME encrypted emails in clear text (publists@...blesecurity.com)
MetaGauge 1.0.0.17 Directory Traversal (brad.antoniewicz@...ndstone.com)
[ MDVSA-2008:209 ] pam_krb5 (security@...driva.com)
[ MDVSA-2008:210 ] mono (security@...driva.com)
FastStone Image Viewer v3.6 (malformed bmp image) DoS Exploit (crimson.loyd@...il.com)
VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security is… (VMware Security team <security@...are.c…)
RE: RE: MySQL command-line client HTML injection vulnerability ("Quark IT - Hilton Travis" <Hilton@...rkIT.com.au>)
PHPWebExplorer <= 0.09b: Local File Inclusion Vulnerability (Pepelux <pepelux@...e-sec.org>)
AyeView v2.20 (malformed gif image) DoS Exploit (crimson.loyd@...il.com)
iFoto, CSS-based GD2 photo gallery <= 1.0: Remote File Disclosure Vulnerability (Pepelux <pepelux@...e-sec.org>)
FOSS Gallery Admin Version <= 1.0 / Remote Arbitrary Upload Vulnerability (Pepelux <pepelux@...e-sec.org>)
FOSS Gallery Public Version <= 1.0 / Arbitrary file upload Vulnerabilities (Pepelux <pepelux@...e-sec.org>)
[SECURITY] [DSA 1643-1] New feta packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Re: AyeView v2.20 (malformed gif image) DoS Exploit ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
OpenNMS Multiple Vulnerabilities (Trancer <mtrancer@...il.com>)
[SECURITY] [DSA-1644-1] New mplayer packages fix integer overflows (Devin Carraway <devin@...ian.org>)
Motorola Timbuktu's Internet Locator Service real-time data exposed to public. (vulns@...tercore.com)

October 7 (11 messages)

[SECURITY] [DSA-1646-1] New squid packages fix array bounds check (Devin Carraway <devin@...ian.org>)
[SECURITY] [DSA 1647-1] New php5 packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
Firefox Privacy Broken If Used to Open Web Page File (Liu Die Yu <liudieyu.com@...il.com>)
HostAdmin 3.* Remote File Include Vulnerabilities (admin@...st.ir)
Yerba SACphp <= 6.3 / Local File Inclusion Exploit (Pepelux <pepelux@...e-sec.org>)
Re: Verizon FIOS (and DSL?) wireless access point insecure default WEP key (Michael Scheidell <scheidell@...nap.net>)
[security bulletin] HPSBUX02375 SSRT080122 rev.1 - HP-UX Running NFS/ONCplus, Remote Denial of Service (DoS) (security-alert@...com)
[OPENX-SA-2008-002] OpenX 2.4.9 and 2.6.2 fix SQL injection vulnerability (Matteo Beccati <php@...cati.com>)
[ GLSA 200810-01 ] WordNet: Execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
Re: iFoto, CSS-based GD2 photo gallery <= 1.0: Remote File Disclosure Vulnerability (Lostmon@...il.com)
Re: Motorola Timbuktu's Internet Locator Service real-time data exposed to public. (artful38@...oo.com)

October 8 (15 messages)

[W02-1008] GearSoftware Powered Products Local Privilege Escalation (Microsoft Windows Kernel IopfCompleteRequest Integer Overflow) (vulns@...tercore.com)
ANNOUNCE - RFIDIOt version 0.1t released (Adam Laurie <adam@...roup.co.uk>)
Re: HostAdmin 3.* Remote File Include Vulnerabilities (admin@...orsecurity.de)
Cisco Security Advisory: Authentication Bypass in Cisco Unity (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Advisory: Graphviz Buffer Overflow Code Execution (roeeh@...ibm.com)
Windows Mobile 6 insecure password handling and too short WLAN-password ("MC Iglo" <mc.iglo@...glemail.com>)
[SECURITY] [DSA 1648-1] New mon packages fix insecure temporary files (thijs@...ian.org (Thijs Kinkhorst))
Re: MySQL command-line client HTML injection vulnerability (Michael Scheidell <scheidell@...nap.net>)
[SECURITY] [DSA 1649-1] New iceweasel packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Motorola Timbuktu's Internet Locator Service real-time data exposed to public. (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
ZDI-08-063: Novell eDirectory dhost.exe Content-Length Header Heap Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-064: Novell eDirectory dhost.exe Accept Language Header Heap Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-065: Novell eDirectory Core Protocol Opcode 0x0F Heap Overflow Vulnerability (zdi-disclosures@...m.com)
Token Kidnapping Windows 2003 PoC exploit (Cesar <cesarc56@...oo.com>)
ZDI-08-066: Novell eDirectory Core Protocol Opcode 0x24 Heap Overflow Vulnerability (zdi-disclosures@...m.com)

October 9 (12 messages)

FC2 BLOG Cross-Site Scripting Vulnerabilities (xsp <xisigr@...il.com>)
[security bulletin] HPSBMA02376 SSRT080099 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting … (security-alert@...com)
PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection (ProCheckUp Research <research@...checkup.com>)
[security bulletin] HPSBMA02362 SSRT080044, SSRT080045, SSRT080042 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Ser… (security-alert@...com)
News Manager Remote SQL Injection Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
PR07-31: Unauthenticated SQL Injection, XSS on Login Page and Username Enumeration on DPSnet Case Progress (ProCheckUp Research <research@...checkup.com>)
[security bulletin] HPSBMA02374 SSRT080046 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Service (DoS) (security-alert@...com)
Re: Token Kidnapping Windows 2003 PoC exploit (groovydude@...asteofbandwidth.com)
Re: Motorola Timbuktu's Internet Locator Service real-time data exposed to public. (therese.vanryne@...orola.com)
[ GLSA 200810-02 ] Portage: Untrusted search path local root vulnerability (Robert Buchholz <rbu@...too.org>)
Re: PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Re: PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection (lee.e.rian@...sus.gov)

October 10 (8 messages)

CA ARCserve Backup Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: News Manager Remote SQL Injection Vulnerability (packet@...ketstormsecurity.org)
[SECURITY] CVE-2008-3271 - Apache Tomcat information disclosure (Mark Thomas <markt@...che.org>)
ZDI-08-067: Apple CUPS 1.3.7 (HP-GL/2 filter) Remote Code Execution Vulnerability (zdi-disclosures@...m.com)
[USN-651-1] Ruby vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re[2]: PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Re: PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection (ProCheckUp Research <research@...checkup.com>)
[LC-2008-04] Nokia Browser Array Sort Denial Of Service Vulnerability (luca.carettoni@...isoft.com)

October 13 (15 messages)

iSEC Partners Security Advisory - 2008-002-lenovornr - Lenovo Rescue and Recovery 4.20 (Chris Clark <cclark@...cpartners.com>)
İltaweb Alışveriş Sistemi (tr) Sql inj (ozdemirtravel@...il.com)
[ MDVSA-2008:211 ] cups (security@...driva.com)
[ MDVSA-2008:210-1 ] mono (security@...driva.com)
NewLife Blogger <= v3.0 / Insecure Cookie Handling & SQL Injection Vulnerability (Pepelux <pepelux@...e-sec.org>)
CA BrightStor ARCServe BackUp Message Engine Remote Command Injection Vulnerability (cocoruder <cocoruder@...il.com>)
Uninformed Journal Release Announcement: Volume 10 (sflist@...italoffense.net)
Marvell Driver Malformed Association Request Vulnerability (Laurent Butti <laurent.butti@...nge-ftgroup.com>)
[SECURITY] [DSA 1646-2] New squid packages fix array bounds check (Devin Carraway <devin@...ian.org>)
CREATE ANY DIRECTORY to SYSDBA (paul.wright@...cleforensics.com)
[SECURITY] [DSA 1650-1] New openldap2.3 packags fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1651-1] New ruby1.8 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1652-1] New ruby1.9 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Re: Token Kidnapping Windows 2003 PoC exploit (ideaburner@...oo.com)
[SECURITY] [DSA 1653-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)

October 14 (8 messages)

[RISE-2008001] Sun Solstice AdminSuite sadmind adm_build_path() Buffer Overflow Vulnerability (RISE Security <advisories@...esecurity.org>)
WP Comment Remix 1.4.3 Multiple Vulnerabilities (g30rg3_x <g30rg3x@...security.org>)
Telecom Italia Alice Pirelli routers backdoor discoverd to activate telnet/ftp/tftp from internal LAN/WLAN. (drpepppperone@...il.com)
Webscene eCommerce (level) Remote Sql Injection (angel@...ng.cc)
[USN-653-1] D-Bus vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-652-1] LittleCMS vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1654-1] New libxml2 packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)
iDefense Security Advisory 10.14.08: Microsoft Host Integration Server 2006 Command Execution Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

October 15 (19 messages)

CORE-2008-1010: VLC media player XSPF Memory Corruption (CORE Security Technologies Advisories <advisories@...esecurity.com>)
ZDI-08-068: Microsoft Office Excel BIFF File Format Parsing Stack Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-069: Microsoft Internet Explorer componentFromPoint Memory Corruption Vulnerability (zdi-disclosures@...m.com)
TPTI-08-07: Microsoft Windows Message Queuing Service Heap Overflow and Memory Disclosure Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
iDefense Security Advisory 10.14.08: Microsoft Visual Basic for Applications - Multiple Vulnerabilities ("labs-no-reply@...fense.com" <labs-no-reply@...fense.c…)
[USN-654-1] libexif vulnerabilities (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 10.14.08: Sun Java Web Proxy Server FTP Resource Handling Heap-Based Buffer Overflow ("labs-no-reply@...fense.com" <labs-no-reply@id…)
[USN-655-1] exiv2 vulnerabilities (Kees Cook <kees@...ntu.com>)
Vivid Ads Shopping Cart (cid) Remote SQL Injection (djmomo@...e.com)
MS OWA 2003 Redirection Vulnerability (Martin Suess <martin.suess@...c.ch>)
Exploit for MS08-066 - AFD.sys kernel memory overwrite. (Reversemode <advisories@...ersemode.com>)
Paper: Adventures with a certain Xen vulnerability (Joanna Rutkowska <joanna@...isiblethingslab.com>)
Internet Explorer 6 componentFromPoint() remote memory disclosure and remote code execution ("Ivan Fratric" <ifsecure@...il.com>)
[ MDVSA-2008:212 ] libxml2 (security@...driva.com)
Re: MS OWA 2003 Redirection Vulnerability (Stefano Di Paola <stefano.dipaola@...ec.it>)
[security bulletin] HPSBMA02349 SSRT080043 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Unauthorized Access to Data (security-alert@...com)
Multiple Flash Authoring Heap Overflows - Malformed SWF Files (Paul Craig <paul.craig@...urity-assessment.com>)
[ MDVSA-2008:213 ] dbus (security@...driva.com)
[USN-656-1] CUPS vulnerabilities (Jamie Strandboge <jamie@...onical.com>)

October 16 (6 messages)

HACKATTACK Advisory 20081016]WEB//NEWS SQL Injection and Cookie Manipulation (office@...kattack.at)
SEC Consult SA-20081016-0 :: Remote command execution in Instant Expert Analysis (Bernhard Mueller <research@...-consult.com>)
rPSA-2008-0294-1 postfix (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0295-1 rails (rPath Update Announcements <announce-noreply@...th.com>)
[ MDVSA-2008:214 ] mon (security@...driva.com)
Re: Re: MS OWA 2003 Redirection Vulnerability (martin.suess@...c.ch)

October 17 (6 messages)

[SECURITY] [DSA 1655-1] New Linux 2.6.24 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Doubt in MySQL Quick Admin <= 1.5.5 (COOKIE) Local File Inclusion Vulnerability POC posted on milworm (vinodsharma.mimit@...il.com)
flashchat severe bug (ch0p83@...il.com)
Re: Doubt in MySQL Quick Admin <= 1.5.5 (COOKIE) Local File Inclusion Vulnerability POC posted on milworm (g30rg3_x <g30rg3x@...il.com>)
Re: MS OWA 2003 Redirection Vulnerability - [MSRC 7368br] (Davide Del Vecchio <dante@...ghieri.org>)
Application-level OS fingerprinting research - pre-release hashes (dan.crowley@...il.com)

October 18 (1 message)

Re: [Full-disclosure] MS OWA 2003 Redirection Vulnerability - [MSRC7368br] ("Morning Wood" <se_cur_ity@...mail.com>)

October 20 (16 messages)

HITBSecConf2008 - Malaysia: Online registration closes on 24th Oct (Praburaajan <prabu@...kinthebox.org>)
[ MDVSA-2008:208-1 ] pam_mount (security@...driva.com)
Re: MS OWA 2003 Redirection Vulnerability - [MSRC7368br] ("Davide Dante Del Vecchio" <dante@...ghieri.org>)
CVE-2008-2625: Oracle DBMS � Proxy Authentication Vulnerability (shulman@...erva.com)
CVE-2008-4000: Oracle PeopleTools � Authentication Weakness (shulman@...erva.com)
Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121 (Fabian Fingerle <fabian@...ensalat.eu>)
Secunia Research: HP SiteScope SNMP Trap Script Insertion Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Lee has posted more detailed response to Fyodor's TCP/IP DoS post (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[Tool] sqlmap 0.6.1 released ("Bernardo Damele A. G." <bernardo.damele@...il.com>)
[SECURITY] [DSA 1656-1] New cupsys packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
London DEFCON meet - DC4420 - Thursday October 23rd (Major Malfunction <majormal@...ate-radio.org>)
FireGPG Passphrase And Cleartext Vulnerability (Mike Benham <moxie@...ughtcrime.org>)
Last Call for DeepSec IDSC 2008 in Vienna (DeepSec Conference Vienna <deepsec@...psec.net>)
[Off-Topic] How I was busted. Story of a poor lonesome hacker (Jerome Athias <jerome.athias@...e.fr>)
[SECURITY] [DSA 1657-1] New qemu packages fix denial of service (Steve Kemp <skx@...ian.org>)
[TKADV2008-010] VLC media player TiVo ty Processing Stack Overflow Vulnerability (Tobias Klein <tk@...pkit.de>)

October 21 (6 messages)

Insomnia : ISVA-081020.1 - Altiris Deployment Server Agent - Privilege Escalation ("Brett Moore" <brett.moore@...omniasec.com>)
[USN-657-1] Amarok vulnerability (Jamie Strandboge <jamie@...onical.com>)
Google Chrome OnbeforeUload and OnUnload Null Check Vulnerability. (Aditya K Sood <0kn0ck@...niche.org>)
SECOBJADV-2008-04: Symantec Veritas Storage Foundation Memory Disclosure Vulnerability (Security Objectives Corporation <advisories@...urity-objectives.com>)
n.runs-SA-2008.008 - Internet Explorer HTML Object Memory Corruption and Remote Code Execution ("security@...ns.com" <security@...ns.com>)
[tool] crapto1 released (blapost@...il.com)

October 22 (11 messages)

FGA-2008-23:EMC NetWorker Denial of Service Vulnerability (noreply-secresearch@...tinet.com)
Opera Stored Cross Site Scripting Vulnerability (Roberto Suggi <roberto.suggi@...urity-assessment.com>)
Secunia Research: HP OpenView Products Shared Trace Service Denial of Service (Secunia Research <remove-vuln@...unia.com>)
Advisory for Oracle CPU October 2008 - APEX Flows excessive privileges (Pete Finnigan <pete@...efinnigan.com>)
Secunia Research: GNU Enscript "setfilename" Special Escape Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Trend Micro OfficeScan CGI Parsing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco PIX and Cisco ASA (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
SECOBJADV-2008-05: Symantec Veritas Storage Foundation Arbitrary File Read Vulnerability (Security Objectives Corporation <advisories@...urity-objectives.com>)
SNMP Injection: Achieving Persistent HTML Injection via SNMP on Embedded Devices (ProCheckUp Research <research@...checkup.com>)
Re: FGA-2008-23:EMC NetWorker Denial of Service Vulnerability (Security_Alert@....com)
[SECURITY] [DSA 1658-1] New dbus packages fix denial of service (thijs@...ian.org (Thijs Kinkhorst))

October 23 (10 messages)

phpcrs <= 2.06 / Local File Inclusion Vulnerability (this is the correct :) (Pepelux <pepelux@...e-sec.org>)
vshop - Axcoto cart <= 0.1alpha / Local File Inclusion Vulnerability (Pepelux <pepelux@...e-sec.org>)
GoodTech SSH Remote Buffer Overflow Exploit (writ3r@...il.com)
freeSSHd (stf - rename) Buffer Overflow Vulnerability (writ3r@...il.com)
SiteEngine 5.x Multiple Remote Vulnerabilities (xuanmumu@...il.com)
Re: MJGuest 6.8 GT Cross Site Scripting Vulnerability (alighieri_m@...ero.it)
Re: vshop - Axcoto cart <= 0.1alpha / Local File Inclusion Vulnerability ("Jose Luis" <pepeluxx@...il.com>)
txtshop - beta 1.0 / Local File Inclusion Vulnerability (Pepelux <pepelux@...e-sec.org>)
[security bulletin] HPSBST02379 SSRT080143 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-056 to MS08-066 (security-alert@...com)
[SECURITY] [DSA 1659-1] New libspf2 packages fix potential remote code execution (Florian Weimer <fw@...eb.enyo.de>)

October 24 (5 messages)

[USN-658-1] Moodle vulnerability (Kees Cook <kees@...ntu.com>)
iPei cross site scripting Vulnerablity (Ghost hacker <ghost-r00t@...mail.com>)
MS08-067 - Where can I find an exploit for this? ("Chip Panarchy" <forumanarchy@...il.com>)
Re: MS08-067 - Where can I find an exploit for this? ("Salvador III Manaois" <badzmanaois@...il.com>)
Re: MS08-067 - Where can I find an exploit for this? ("Salvador III Manaois" <badzmanaois@...il.com>)

October 25 (4 messages)

Java Web start vulnerability (varun.srivastav@...il.com)
HTTPBruteForcer released (Jerome Athias <jerome.athias@...e.fr>)
Re: HTTPBruteForcer released (raven <locrideweb@...ero.it>)
Re: HTTPBruteForcer released (The Anarcat <anarcat@...rcat.ath.cx>)

October 27 (18 messages)

Windows RPC MS08-067 FAQ document released (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[SECURITY] [DSA 1660-1] New clamav packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)
BotNet on the Rise (faghani@...c.ir)
bcoos 1.0.13 Remote File Include Vulnerability ("Cru3l.b0y" <cru3l.b0y@...il.com>)
[security bulletin] HPSBMA02373 SSRT071467 rev.2 - HP Insight Diagnostics Running on Linux and Windows, Remote Unauthorized Access to File… (security-alert@...com)
XSS in phpMyadmin (hadikiamarsi@...mail.com)
Windows RPC MS08-067 FAQ document updated (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
ClubHack2008 [India] - CFP Closing Soon (ClubHack <seclist@...bhack.com>)
MyBB 1.4.2: Multiple Vulnerabilties ("Micheal Cottingham" <techie.micheal@...il.com>)
MSF eXploit Builder v2 Alpha Sources Released (Jerome Athias <jerome.athias@...e.fr>)
n.runs-SA-2008.009 - Eaton MGE OPS Network Shutdown Module - authentication bypass vulnerability and remote code execut… ("security@...ns.com" <security@...ns.co…)
Writeup by Amit Klein (Trusteer): Address Bar Spoofing for IE6 (Amit Klein <amit.klein@...steer.com>)
Re: Writeup by Amit Klein (Trusteer): Address Bar Spoofing for IE6 (Amit Klein <amit.klein@...steer.com>)
rPSA-2008-0305-1 pcre (rPath Update Announcements <announce-noreply@...th.com>)
[ MDVSA-2008:215 ] wireshark (security@...driva.com)
Blaze Media Pro 8.02 SE vulnerability (ipsdix@...il.com)
rPSA-2008-0306-1 libxslt (rPath Update Announcements <announce-noreply@...th.com>)
Re: MyBB 1.4.2: Multiple Vulnerabilties (krzysztof.kozlowski@...ik.net.pl)

October 28 (5 messages)

[ MDVSA-2008:216 ] emacs (security@...driva.com)
PHP-Nuke Module League (team&tid) XSS Vulnerability (Ehsan_Hp200@...mail.com)
A video can crash ANY iphone/ipod and a few libraries. (zibree@...il.com)
[ MDVSA-2008:217 ] lynx (security@...driva.com)
[ MDVSA-2008:218 ] lynx (security@...driva.com)

October 29 (9 messages)

Aria-Security.com: Saba 2.0 Cross Site Scripting [PASSIVE] (The-0utl4w@...a-Security.com)
Re: MySQL command-line client HTML injection vulnerability (okuno@...ql.com)
Quassel IRC: connection hijacking (Wouter Coekaerts <wouter@...kaerts.be>)
Re: Quassel IRC: connection hijacking (Wouter Coekaerts <wouter@...kaerts.be>)
Re: [ MDVSA-2008:217 ] lynx (Thomas Dickey <dickey@....com>)
Secunia Research: Adobe PageMaker PMD File Processing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
KVIrc version 3.4.0 Virgo remote format string proof of concept exploit. (fabio <ctrlaltca@...ero.it>)
[SECURITY] [DSA 1661-1] New OpenOffice.org packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Advanced application-level OS fingerprinting (dan.crowley@...il.com)

October 30 (25 messages)

[ MDVSA-2008:220 ] kernel (security@...driva.com)
[ MDVSA-2008:221 ] aterm (security@...driva.com)
Re: MS08-067 - Where can I find an exploit for this? (illumina7i <illumina7i@...il.com>)
Re: MS08-067 - Where can I find an exploit for this? ("Isaias Calderon" <isaias.calderon@...il.com>)
PHP-Nuke Module BookCatalog (category&catid) Remote SQL injection Vulnerability (Ehsan_Hp200@...mail.com)
rPSA-2008-0309-1 lighttpd (rPath Update Announcements <announce-noreply@...th.com>)
[ MDVSA-2008:219 ] mplayer (security@...driva.com)
[funsec] ICANN Terminates EstDomains' Registrar Accreditation (fwd) (Gadi Evron <ge@...uxbox.org>)
Tool update: VoIPER v0.07 (nnp <version5@...il.com>)
IranMC ( detail.php?Kala ) Remote SQL injection Vulnerability (Ehsan_Hp200@...mail.com)
rPSA-2008-0307-1 nfs-client nfs-server nfs-utils (rPath Update Announcements <announce-noreply@...th.com>)
PHP-Nuke Module Sectionsnew (printpage&artid) Remote SQL injection Vulnerability (Ehsan_Hp200@...mail.com)
Re: [Full-disclosure] [funsec] ICANN Terminates EstDomains' Registrar Accreditation (fwd) (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: Advanced application-level OS fingerprinting ("Berend-Jan Wever" <berendjanwever@...il.com>)
[ MDVSA-2008:222 ] Eterm (security@...driva.com)
PHP-Nuke Module Current_Issue (summary&id) Remote SQL injection Vulnerability (Ehsan_Hp200@...mail.com)
rPSA-2008-0308-1 samba samba-client samba-server samba-swat (rPath Update Announcements <announce-noreply@...th.com>)
DebugDiag (CrashHangExt.dll 1.0) NULL Pointer Dereference (crimson.loyd@...il.com)
harlandscripts Mypage.php Sql Injection (beenudel1986@...il.com)
ZDI-08-070: SonicWALL Content-Filtering Universal Script Injection Vulnerability (zdi-disclosures@...m.com)
iDefense Security Advisory 10.30.08: Novell eDirectory NCP Get Extension Information Request Memory Corruption Vulnerab… ("labs-no-reply@...fense.com" <labs-no-r…)
[USN-661-1] Linux kernel regression (Jamie Strandboge <jamie@...onical.com>)
ZDI-08-071: IBM Tivoli Storage Manager Express for Microsoft SQL Heap Overflow Vulnerability (zdi-disclosures@...m.com)
iDefense Security Advisory 10.30.08: Adobe PageMaker Key Strings Stack Buffer Overflow (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200810-03 ] libspf2: DNS response buffer overflow (Robert Buchholz <rbu@...too.org>)

October 31 (18 messages)

2008 OpenVAS Contest (The OpenVAS Team <timb@...nvas.org>)
Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day ("Adrian P" <unknown.pentester@...il.com>)
spitfirephoto Pro pages.php Sql Injection (beenudel1986@...il.com)
phpWebSite links.php Sql Injection (beenudel1986@...il.com)
U-Mail Webmail 'edit.php' Arbitrary File Write Vulnerability (WSN1983@...IL.COM)
VMSA-2008-0017 Updated ESX packages for libxml2, ucd-snmp, libtiff (VMware Security Team <security@...are.com>)
Cpanel 11.x Local File Inclusion & Cross Site Scripting - Discovered By Khashayar Fereidani (irancrash@...il.com)
iDefense Security Advisory 10.31.08: OpenOffice EMF Record Parsing Multiple Integer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day (sipherr@...il.com)
Secunia Research: Interact SQL Injection and Cross-Site Request Forgery (Secunia Research <remove-vuln@...unia.com>)
Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day (sipherr@...il.com)
iDefense Security Advisory 10.31.08: Oracle WebLogic Apache Connector (iDefense Labs <labs-no-reply@...fense.com>)
[Paper] Reflective Dll Injection (stephen_fewer@...monysecurity.com)
Typo <= 5.1.3 Multiple Vulnerabilities (L4teral <l4teral@...il.com>)
Re: Java Web start vulnerability (varun.srivastav@...il.com)
[ MDVSA-2008:121-1 ] freetype2 (security@...driva.com)
RE: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day (Jim Harrison <Jim@...tools.org>)
Final notification about "POC2008" Conference (pocadm@...il.com)

269 messages

Powered by blists - more mailing lists