bugtraq mailing list - 2005/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2005/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 26	² 15	³
⁴ 30	⁵ 22	⁶ 26	⁷ 16	⁸ 9	⁹ 10	¹⁰ 2
¹¹ 18	¹² 19	¹³ 29	¹⁴ 17	¹⁵ 33	¹⁶ 8	¹⁷ 1
¹⁸ 17	¹⁹ 20	²⁰ 32	²¹ 31	²² 34	²³ 10	²⁴ 4
²⁵ 31	²⁶ 31	²⁷ 16	²⁸ 29	²⁹ 25	³⁰ 5

Messages by day:

April 1 (26 messages)

Re: Bay Technical Associates telnet server logon bypass (Michael Brennen <mbrennen@....com>)
Re: DoS of LAN via D-Link switches (Scott Nelson <sbn@...rmeon.com>)
RE: eBay Account Phishing with eBay Redirect - Ebay fixed this + related XSS hole ("Rager, Anton (Anton)" <arager@...ya.com>)
WindowsXP malformed .wmf files DoS (<liquid@...erspace.org>)
RE: Invision Power Board v2.0.3 XSS vulnerabilities ("alex" <pigrelax@...dex.ru>)
Re: cPanel/WHM demo account problems (Beau Henderson <silentbob@...il.com>)
(PAPER) "Vision of danger: The Firefox Greasemonkey" (Piotr Bania <bania.piotr@...il.com>)
RE: [ISN] How To Save The Internet (Nuno Costa <webcenter@...o.pt>)
(Paper) Programming: The Heart of Web Security (Sumy <sanandres@...il.com>)
Reverse shell using netcat on AS/400 ("Shalom Carmel" <shalom@...era.com>)
Security holes in the iTunes Music Store ("Charles M. Hannum" <abuse@...malicious.com>)
[USN-103-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200504-01 ] telnet-bsd: Multiple buffer overflows (Thierry Carrez <koon@...too.org>)
CAU-2005-0001: Chat Service Users - "Oops! Wrong Window" Information Disclosure ("I)ruid" <druid@...ghq.org>)
[SECURITY] [DSA 703-1] New krb5 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 702-1] New ImageMagick packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
iDEFENSE Security Advisory 03.31.05: PHP getimagesize() Multiple Denial of Service Vulnerabilities ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
PayPal "security" measures ("Jeremy Rasmussen" <jeremycec@....com>)
[Hat-Squad Advisory] Bakbone NetVault Heap overflow Vulnerabilities ("Hat-Squad Security Team" <bugtraq@...-squad.com>)
Re: cPanel/WHM demo account problems (Darren <darren@...nel.net>)
Re: [HV-HIGH] Microsoft Jet DB engine vulnerabilities ("Thor (Hammer of God)" <thor@...merofgod.com>)
Buffer Overflow within the RUMBA product (Bahaa Naamneh <b_naamneh@...mail.com>)
DMA[2005-0401a] - 'IVT BlueSoleil Directory Transversal' ("KF (Lists)" <kf_lists@...italmunition.com>)
Solaris 10 Containers / Zones Security Flaw (jim allan <intehnet@...il.com>)
Information leak in the Linux kernel ext2 implementation (Arkoon Security Team <security@...oon.net>)
multiple remote denial of service vulnerabilities in Gaim (Jean-Yves Lefort <jylefort@...tele.be>)

April 2 (15 messages)

[ GLSA 200504-02 ] Sylpheed, Sylpheed-claws: Buffer overflow on message display (Thierry Carrez <koon@...too.org>)
Re: bzip2 TOCTOU file-permissions vulnerability (Steve Grubb <linux_4ever@...oo.com>)
In-game players kicking in the Quake 3 engine (Luigi Auriemma <aluigi@...istici.org>)
In-game server buffer-overflow in Jedi Academy 1.011 (Luigi Auriemma <aluigi@...istici.org>)
In-game server crash in Call of Duty 1.5b and United Offensive 1.51b (Luigi Auriemma <aluigi@...istici.org>)
RE: Microsoft Windows Server 2003 "Shell Folders" Directory Traversal Vulnerability ("Eiji James Yoshida" <ptrs-ejy@...iij4u.or.jp>)
Re: Solaris 10 Containers / Zones Security Flaw (Robert Escue <roescue@....net>)
MDKSA-2005:066 - Updated grip packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
MDKSA-2005:065 - Updated ImageMagick packages fix multiple vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
Re: Solaris 10 Containers / Zones Security Flaw (Jonathan Katz <jonathan.katz@...il.com>)
AlstraSoft EPay Pro v2.0 has file include and multiple xss vulnerabilities (dcrab <dcrab@...kerscenter.com>)
Re: [HV-HIGH] Microsoft Jet DB engine vulnerabilities (Denis Jedig <seclists@...eticon.de>)
How to write remote exploits ( V. 1.1) (Sumy <sanandres@...il.com>)
Yet Another Forum.net XSS vulnerabilities (maty siman <maty@...ckmarx.com>)
Re: bzip2 TOCTOU file-permissions vulnerability ("Jason V. Miller" <jmiller@...urityfocus.com>)

April 4 (30 messages)

Re: (PAPER) "Vision of danger: The Firefox Greasemonkey" ("Justin J. Novack" <jnovack@...il.com>)
[USN-104-1] unshar vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200504-03 ] Dnsmasq: Poisoning and Denial of Service vulnerabilities (Thierry Carrez <koon@...too.org>)
Re: How to write remote exploits ( V. 1.1) (emilio@....ufsc.br)
Re: [USN-104-1] unshar vulnerability (Florian Weimer <fw@...eb.enyo.de>)
Microsoft Windows Internet Name Service (WINS) Remote Heap Overflow Exploit ("class101@...-SQUAD.com" <class101@...-squad.com>)
SUSE Security Announcement: kernel local privilege escalation (SUSE-SA:2005:021) (Marcus Meissner <meissner@...e.de>)
Local buffer overflow on Aeon<=0.2a (<patr0n@...ru>)
possible privilege escalation on Sco OpenServer 5.0.7 (pasquale minervini <minervini@...ralnoise.com>)
[SECURITY] [DSA 705-1] New wu-ftpd packages fix denial of service (joey@...odrom.org (Martin Schulze))
AW: PayPal "security" measures ("Michael Rueve" <rueve@...ioconnect.net>)
Re: Solaris 10 Containers / Zones Security Flaw (jim allan <intehnet@...il.com>)
Re: [HV-HIGH] Microsoft Jet DB engine vulnerabilities ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: [HV-HIGH] Microsoft Jet DB engine vulnerabilities (Steve Shockley <steve.shockley@...ckley.net>)
[SECURITYREASON.COM] PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12 (Maksymilian Arciemowicz <max@...tsuper.pl>)
Full path disclosure and XSS in PHPNuke (SecurityReason <sp3x@...urityreason.com>)
[SECURITY] [DSA 704-1] New remstats packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
ArGoSoft FTP Server is still vuln + PoC exploit code (IHSTeam) (c0d3r@...team.com)
SonicWALL SOHO/10 - XSS vulnerability ("Oliver Karow" <Oliver.Karow@....de>)
[CLA-2005:946] Conectiva Security Announcement - MySQL (Conectiva Updates <secure@...ectiva.com.br>)
Disclosure of AS/400 user accounts via the FTP server ("Shalom Carmel" <shalom@...era.com>)
Re: [HV-HIGH] Microsoft Jet DB engine vulnerabilities (Son SonOfLilit <sonoflilit@...il.com>)
Re: Solaris 10 Containers / Zones Security Flaw (Darren Reed <avalon@...igula.anu.edu.au>)
Re: AW: PayPal "security" measures ("David F. Russell" <DFRussell@...mcop.net>)
phpMyAdmin Cross-site Scripting Vulnerability (Oriol Torrent Santiago <oriol.torrent@...il.com>)
Re: AW: PayPal 'security' measures (mike@...xweb.net)
RE: AW: PayPal "security" measures ("J B" <kybrdcowboy@...mail.com>)
Re: AW: PayPal "security" measures (Rainer Duffner <rainer@...ra-secure.de>)
RE: PayPal "security" measures ("McAllister, Andrew" <McAllisterA@...ystem.edu>)
Authenticaion bypass, Directory transversal and XSS vulnerabilities in PayProCart 3.0 - Profitcode Software (dcrab <dcrab@...kerscenter.com>)

April 5 (22 messages)

[USN-105-1] PHP4 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Re: I need uh Qwik-Fix please sho 'nuff! ("Jason Coombs" <jasonc@...ence.org>)
Re: I need uh Qwik-Fix please sho 'nuff! ("Jason Coombs" <jasonc@...ence.org>)
[USN-106-1] Gaim vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Sybase ASE Multiple Security Issues (#NISR05042005) (NGSSoftware Insight Security Research <nisr@...tgenss.com>)
[USN-107-1] racoon vulnerability (Martin Pitt <martin.pitt@...onical.com>)
gzip TOCTOU file-permissions vulnerability (Imran Ghory <imranghory@...il.com>)
SQL INJECTION in LinksLinks Pro. PHPBB Mod. (rock master <rock_mask@...mail.com>)
Logics Software BS2000 Host to Web Client ALL PLATFORMS (Román Ramírez <rramirez@...sethesun.es>)
[SECURITYREASON.COM] Full path disclosure and XSS in PHPNuke part 3 (sp3x <sp3x@...urityreason.com>)
FreeBSD Security Advisory FreeBSD-SA-05:02.sendfile (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Sanboxed browsing and authentication credentials (Max Moser <max.moser@...il.com>)
TSLSA-2005-0011 - kernel (Trustix Security Advisor <tsl@...stix.org>)
MailEnable Imapd remote BoF + Exploit [x0n3-h4ck] ("expanders" <expanders@...ero.it>)
iDEFENSE Labs Releases OllyDbg Breakpoint Manager ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
SQL INJECTION in DLMan Pro. PHPBB Mod. (rock master <rock_mask@...mail.com>)
[USN-108-1] GDK vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: How to write remote exploits ( V. 1.1) (Florian Maier <florian.maier@...nchen.de>)
[OpenPKG-SA-2005.005] OpenPKG Security Advisory (imapd) (OpenPKG <openpkg@...npkg.org>)
iDEFENSE Security Advisory 04.05.05: Computer Associates eTrust Intrusion Detection System CPImportKey DoS ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
MailEnable Smtpd remote Dos [x0n3-h4ck] ("CorryL" <corryl@...overde.com>)
Smartcard-Logon and NTLM-Backward Compatability ("Jan P. Monsch" <jan.monsch@...c.ch>)

April 6 (26 messages)

crontab from vixie-cron allows read other users crontabs (Karol Więsek <appelast@...mnbass.art.pl>)
[USN-109-1] MySQL vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200504-04 ] mit-krb5: Multiple buffer overflows in telnet client (Thierry Carrez <koon@...too.org>)
Re: Smartcard-Logon and NTLM-Backward Compatability (Saqib Ali <docbook.xml@...il.com>)
[ GLSA 200504-05 ] Gaim: Denial of Service issues (Luke Macken <lewk@...too.org>)
drone armies C&C report - March/2005 (Gadi Evron <gadi@...ila.gov.il>)
Microsoft Explorer Denial of Service (Luca Ercoli <io@...aercoli.it>)
Cisco Security Advisory: Vulnerabilities in the Internet Key Exchange Xauth Implementation (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
runcms/e-xoops 1.1A and below file upload vulnerability (pokley <pokleyzz@...n-associates.net>)
Active Auction House has multiple Sql injection, error and XSS vulnerabilities (dcrab <dcrab@...kerscenter.com>)
OSX - trojan apps can bypass authentication controls and gain root privilages (bert@...as.net)
FreeBSD Security Advisory FreeBSD-SA-05:03.amd64 (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[NOBYTES.COM: #6] CubeCart 2.0.6 - Information Disclosure ("John Cobb" <johnc@...ytes.com>)
Re: crontab from vixie-cron allows read other users crontabs (Richard Moore <rich@...tpoint.ltd.uk>)
RE: Microsoft Explorer Denial of Service ("Larry Seltzer" <larry@...ryseltzer.com>)
Cisco Security Advisory: Vulnerabilities in Cisco IOS Secure Shell Server (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: Microsoft Explorer Denial of Service ("Des Ward" <des_ward@...co.uk>)
iDEFENSE Security Advisory 04.06.05: IBM Lotus Domino Server Web Service DoS Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
LiteCommerce Sql injection and reveling errors vulnerability (dcrab <dcrab@...kerscenter.com>)
Re: PayPal "security" measures (sh0rtie <this.is@...il.com>)
[waraxe-2005-SA#041] - Critical Sql Injection in PhpNuke 6.x-7.6 Top module (Janek Vind <come2waraxe@...oo.com>)
RE: [NOBYTES.COM: #6] CubeCart 2.0.6 - Information Disclosure ("John Cobb" <johnc@...ytes.com>)
RE: PayPal "security" measures ("McAllister, Andrew" <McAllisterA@...ystem.edu>)
Re: OSX - trojan apps can bypass authentication controls and gain root privilages ("KF (lists)" <kf_lists@...italmunition.com>)
RE: [NOBYTES.COM: #6] CubeCart 2.0.6 - Information Disclosure ("Ravish Ahuja" <ravish@...next.com>)
Re: crontab from vixie-cron allows read other users crontabs (Gadi Evron <ge@...uxbox.org>)

April 7 (16 messages)

[ GLSA 200504-06 ] sharutils: Insecure temporary file creation (Luke Macken <lewk@...too.org>)
Re: crontab from vixie-cron allows read other users crontabs (David Malone <dwmalone@...hs.tcd.ie>)
Nokia Terminal Gateway default installation vulnerability (Miracle Maker <miraclemaker_gsm@...oo.com>)
Re: runcms/e-xoops 1.1A and below file upload vulnerability (pokley <pokleyzz@...n-associates.net>)
Re: [ GLSA 200503-12 ] Hashcash: Format string vulnerability (Adam Back <adam@...herspace.org>)
[SIG^2 G-TEC] SurgeFTP LEAK Command Denial-Of-Service Vulnerability (<chewkeong@...urity.org.sg>)
iDEFENSE Security Advisory 04.07.05: SGI IRIX gr_osview Information Disclosure Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 04.07.05: SGI IRIX gr_osview File Overwrite Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
[SECURITYREASON.COM] phpnuke 7.6 Multiple vulnerabilities in Downloads Module cXIb8O3.13 (Maksymilian Arciemowicz <max@...tsuper.pl>)
Macromedia Security Bulletin - ColdFusion MX 6.1 (securityzone@...romedia.com (Macromedia Security Zone))
[SECURITYREASON.COM] phpnuke 7.6 Multiple vulnerabilities in Web_Links Module cXIb8O3.14 (Maksymilian Arciemowicz <max@...tsuper.pl>)
OpenServer 5.0.6 OpenServer 5.0.7 : termsh atcronsh auditsh environment buffer overflows (please_reply_to_security@....com)
UnixWare 7.1.4 UnixWare 7.1.3 UnixWare 7.1.1 : CDE dtlogin unspecified double free (please_reply_to_security@....com)
UnixWare 7.1.4 : libtiff Multiple vulnerabilities (please_reply_to_security@....com)
UnixWare 7.1.4 : cdrecord local root exploit (please_reply_to_security@....com)
OpenServer 5.0.6 OpenServer 5.0.7 : cscope local attacker can remove arbitrary files (please_reply_to_security@....com)

April 8 (9 messages)

Article: Web Server Defacements (Sumy <sanandres@...il.com>)
[ GLSA 200504-07 ] GnomeVFS, libcdaudio: CDDB response overflow (Thierry Carrez <koon@...too.org>)
MDKSA-2005:067 - Updated sharutils packages fix multiple vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
Sql injection, xss and path disclosure vulnerabilities in PostNuke 0.760-RC3 (dcrab <dcrab@...kerscenter.com>)
MacOSX Java Runtime Environment Remote Denial-of-Service (DoS) Vulnerability (Marc Schoenefeld <schonef@...-muenster.de>)
MDKSA-2005:068 - Updated gtk+2.0 packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
MDKSA-2005:069 - Updated gdk-pixbuf packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
How to Report a Security Vulnerability to Microsoft ("Microsoft Security Response Center" <secure@...rosoft.com>)
phpBB Upload Script "up.php" Arbitrary File Upload (Status-x <phr4xz@...il.com>)

April 9 (10 messages)

Re: [SECURITYREASON.COM] PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12 (Paul Laudanski <zx@...tlecops.com>)
Re: [waraxe-2005-SA#041] - Critical Sql Injection in PhpNuke 6.x-7.6 Top module (Paul Laudanski <zx@...tlecops.com>)
RE: How to Report a Security Vulnerability toMicrosoft ("Randall M" <randallm@...mail.com>)
[VulnDiscuss] Re: [waraxe-2005-SA#041] - Critical Sql Injection in PhpNuke 6.x-7.6 Top module[Scanned] ("Paul Laudanski" <zx@...tlecops.com>)
[VulnDiscuss] Re: [SECURITYREASON.COM] PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12[Scanned] ("Paul Laudanski" <zx@...tlecops.com>)
PunBB <= 1.2.4 - change email to become admin exploit ("exploits@...iracy.de" <exploits@...iracy.de>)
Pafiledb ACTION Parameter XSS (tom cruise <the.n3t@...il.com>)
Double Choco Latte Remote Code Execution (JeiAr <security@...ftech.org>)
iDEFENSE Security Advisory 04.08.05: Microsoft Multiple E-Mail Client Address Spoofing Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
UnixWare 7.1.4 UnixWare 7.1.3 UnixWare 7.1.1 : telnet client multiple issues (please_reply_to_security@....com)

April 10 (2 messages)

[Artice] Click Fraud FAQ (Sumy <sanandres@...il.com>)
UPDATE: [ GLSA 200503-35 ] Smarty: Template vulnerability (Thierry Carrez <koon@...too.org>)

April 11 (18 messages)

[USN-110-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
zOOM Media Gallery - Simple SQL Injection discovery ("Andreas Constantinides" <aconstantinides@...sseyConsultants.com>)
OpenOffice DOC document Heap Overflow (adlab <lab@...ustech.com.cn>)
RE: How to Report a Security Vulnerability toMicrosoft ("Airey, John" <John.Airey@...b.org.uk>)
OpenText FirstClass 8.0 Client Arbitrary File Execution (dila <dilabox@...il.com>)
SUSE Security Announcement: various KDE security problems (SUSE-SA:2005:022) (Marcus Meissner <meissner@...e.de>)
================================ GNU Core Utilities race condition file-permissions vulnerability ===========================… (Imran Ghory <imranghory@...il.com>)
Multiple ModernBill 4.3.0 And Earlier Vulnerabilities ("GulfTech Security Research" <security@...ftech.org>)
TowerBlog <= 0.6 Admin Account View [x0n3-h4ck] ("CorryL" <corryl@...overde.com>)
Miranda IM and Miranda Installer Let Local Users Execute Arbitrary Code (Kozan <kozan@...magister.com>)
Re: Microsoft Explorer Denial of Service (Luca Ercoli <io@...aercoli.it>)
[ GLSA 200504-08 ] phpMyAdmin: Cross-site scripting vulnerability (Luke Macken <lewk@...too.org>)
iDEFENSE Security Advisory 04.11.05: Computer Associates BrightStor ARCserve Backup UniversalAgent Buffer Overflow ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Zone-H 2004 statistics are ready to be downloaded (Gerardo Astharot Di Giacomo <astharot@...e-h.org>)
Invision board 1.3.1 and below are vulnerable to a sql injection vulnerability [PATCH INCLUDED] (dcrab <dcrab@...kerscenter.com>)
OpenOffice DOC document Heap Overflow (lee xiaojun <airsupply@...fault.cn>)
RE: Miranda IM and Miranda Installer Let Local Users Execute Arbitrary Code ("Richard Stanway" <bugtraq@...ur1ty.net>)
Microsoft Windows image rendering DoS vuln (Andrew <gluttony@...il.com>)

April 12 (19 messages)

[WHITEPAPER] Bugger The Debugger ("Brett Moore" <brett.moore@...urity-assessment.com>)
Sql injection in jPortal version 2.3.1 (module banner) ("Marcin \"CiNU5\" Krupowicz" <marcin.krupowicz@...il.com>)
Directory transversal, sql injection and xss vulnerabilities in RadBids Gold v2 (dcrab <dcrab@...kerscenter.com>)
AzDGDatingPlatinum multiple vulnerabilities (<kre0n@...l.ru>)
XV multiple buffer overflows (update) (Greg Roelofs <newt@...ox.com>)
rpdump TOCTOU file-permissions vulnerability (Imran Ghory <imranghory@...il.com>)
rsnapshot Security Advisory 001 (security@...apshot.org)
Microsoft Jet (msjet40.dll) Exploit (Stuart Pearson <spearson@...puterterrorism.com>)
GLD (Greylisting daemon for Postfix) multiple vulnerabilities. ("dong-hun you" <xploit@...kermail.com>)
7a69Adv#23 - Jar tool directory transversal vulnerability (Pluf <pluf@...9ezine.org>)
WebCT 4.1 vulnerable to XSS attacks (<lacertosum@...oo.com>)
Sql injection in jPortal version 2.3.1 (module banner) ("Marcin \"CiNU5\" Krupowicz" <marcin.krupowicz@...il.com>)
Remote Buffer Overflow in Lotus Domino ("Next Generation Insight Security Research (NGS Software)" <mark@...software.com>)
iDEFENSE Security Advisory 04.12.05: Microsoft Windows CSRSS.EXE Stack Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 04.12.05: Microsoft MSHTA Script Execution Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 04.12.05: Microsoft Windows Internet Explorer Long Hostname Heap Corruption Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.co…)
iDEFENSE Security Advisory 04.12.05: Microsoft Internet Explorer DHTML Engine Race Condition Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
[ GLSA 200504-09 ] Axel: Vulnerability in HTTP redirection handling (vorlon@...too.org)
Details and PoC for MS05-020 MSIE DHTML Object handling vulnerabilities ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)

April 13 (29 messages)

Centra 7 XSS Exploit (Clorox <elac2k@...mail.com>)
IRM 011: Sygate,Security Agent (Sygate Secure Enterprise) Fail Open DoS (IRM Advisories <advisories@...plc.com>)
eGroupWare Leaks Files ("Gerald Quakenbush" <geraldq@...termindsecuritygroup.com>)
Placing Backdoors Through Firewalls (Sumy <sanandres@...il.com>)
Re: Sql injection, xss and path disclosure vulnerabilities in PostNuke 0.760-RC3 ("Dionysios G. Synodinos" <synodinos@...il.com>)
QuickTime for Windows malformed GIF DoS (<liquid@...erspace.org>)
JavaMail allows directory traversal in attachments (Rafael San Miguel Carrasco <smcsoc@...oo.es>)
Re: Sql injection, xss and path disclosure vulnerabilities in PostNuke 0.760-RC3 (Maksymilian Arciemowicz <max@...tsuper.pl>)
DoKuWiki file-upload vulnerabilities (kreon <kre0n@...l.ru>)
Window Washer 6.0: False Sense of Security (WBG Links <wbglinks@...il.com>)
RE: iDEFENSE Security Advisory 04.08.05: Microsoft Multiple E-Mail Client Address Spoofing Vulnerability ("Larry Seltzer" <larry@...ryseltzer.com>)
WordPress XSS and HTML injection (Nicolas Montoza <xonico@...il.com>)
Multiple High Risk flaws fixed in Oracle ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Patch available for critical Veritas i3 Server vulnerability ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Multiple medium risk flaws fixed in new version of PHP (late advisory) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[ GLSA 200504-10 ] Gld: Remote execution of arbitrary code (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: gzip TOCTOU file-permissions vulnerability (Martin Pitt <martin.pitt@...onical.com>)
zOOM Media Gallery - Simple SQL Injection discovery ("Andreas Constantinides" <aconstantinides@...sseyConsultants.com>)
'Widcomm BTW (Microsoft Windows BT stack) Directory Transversal' ("KF (lists)" <kf_lists@...italmunition.com>)
[ GLSA 200504-11 ] JunkBuster: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Windows kernel overflow fixed ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[ GLSA 200504-12 ] rsnapshot: Local privilege escalation (Thierry Carrez <koon@...too.org>)
IBM WebSphere Widespread configuration JSP disclosure ("SPI Labs" <spilabs@...dynamics.com>)
Gld 1.5 released (security fix) (Salim Gasmi <salim@...mi.net>)
cpio TOCTOU file-permissions vulnerability (Imran Ghory <imranghory@...il.com>)
[SECURITY] [DSA 707-1] New mysql packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
NetManage RUMBA 7.4 Profile Handling Multiple Buffer Overflow Vulnerabilities (Bahaa Naamneh <b_naamneh@...mail.com>)
[SECURITY] [DSA 706-1] New axel packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
MDKSA-2005:070 - Updated MySQL packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)

April 14 (17 messages)

ms05016 POC (zwell zwell <suei8423@....com>)
HTTP RESPONSE SPLITTING by Diabolic Crab (dcrab <dcrab@...kerscenter.com>)
LG U8120 Mobile Phone Denial of Service (Luca Ercoli <io@...aercoli.it>)
Re: gzip TOCTOU file-permissions vulnerability (Derek Martin <code@...zashack.org>)
Re: gzip TOCTOU file-permissions vulnerability ("Peter J. Holzer" <hjp@....ac.at>)
Multiple Sql injection and XSS vulnerabilities in phpBB Plus v.1.52 and below and some of its modules. (dcrab <dcrab@...kerscenter.com>)
Re: gzip TOCTOU file-permissions vulnerability (Joey Hess <joeyh@...ian.org>)
serendipity SQL Injection vulnerability (kreon <kre0n@...l.ru>)
Bug#299007: gzip TOCTOU file-permissions vulnerability (psz@...hs.usyd.edu.au)
[USN-111-1] Squid vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-112-1] PHP4 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Internet Explorer wininet.dll URL parsing memory corruption technical details (3APA3A <3APA3A@...URITY.NNOV.RU>)
Multiple vulnerabilities in Yager 5.24 (Luigi Auriemma <aluigi@...istici.org>)
MDKSA-2005:071 - Updated gaim packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
All4WWW-Homepagecreator Remote Command Execution (Francisco Alisson <dominusvis@...ck21.com.br>)
sumus[v0.2.2]: (httpd) remote buffer overflow exploit. (Vade 79 <v9@...ehalo.deadpig.org>)
Security Contact for NetApp ? (Fabrice Marie <fmarie@...il.com>)

April 15 (33 messages)

Computer Associates BrightStor ARCserve Backup and BrightStor Enterprise Backup UniversalAgent buffer overflow vulnerabi… ("Williams, James K" <James.Williams@ca.…)
Re: Security Contact for NetApp ? (Antonio Varni <antonio.varni@...il.com>)
BCS Asia 2005 Slides and pictures (Anthony Zboralski <bcs2005@...lua.com>)
Multiple multiple sql injection/errors and xss vulnerabilities in OneWorldStore (dcrab <dcrab@...kerscenter.com>)
Re: serendipity SQL Injection vulnerability (<sebastian@...n.net>)
Re: gzip TOCTOU file-permissions vulnerability (Derek Martin <code@...zashack.org>)
RE: gzip TOCTOU file-permissions vulnerability ("Mark Senior" <Mark.Senior@....ab.ca>)
Trojan file issue in Musicmatch software ("Hyperdose Security" <robfly@...erdose.com>)
Trusted Site Cross Site Scripting Elevation of Privilege in Musicmatch ("Hyperdose Security" <robfly@...erdose.com>)
Re: gzip TOCTOU file-permissions vulnerability (Steve Grubb <linux_4ever@...oo.com>)
Re: bzip2 TOCTOU file-permissions vulnerability (Steve Grubb <linux_4ever@...oo.com>)
Re: gzip TOCTOU file-permissions vulnerability (Derek Martin <code@...zashack.org>)
[ GLSA 200504-13 ] OpenOffice.Org: DOC document Heap Overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200504-14 ] monkeyd: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
FreeBSD Security Advisory FreeBSD-SA-05:04.ifconf (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Improper log file storage in Musicmatch software ("Hyperdose Security" <robfly@...erdose.com>)
Re: gzip TOCTOU file-permissions vulnerability (Theodor Milkov <zimage@...soft.com>)
[SECURITY] [DSA 709-1] New libexif packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
windux-linux-gui-rainbow-lanman-cracker released (Philippe Oechslin <philippe.oechslin@...ectif-securite.nospam.ch>)
[Overflow.pl] GOCR - Multiple vulnerabilities ("Overflow.pl" <adv@...rflow.pl>)
[SECURITY] [DSA 708-1] New PHP3 packages fix denial of service (joey@...odrom.org (Martin Schulze))
Dameware NT Utilities and MiniRemote Control <= 4.9 vulnerability (Jordi Corrales <jordi@...llsec.net>)
Enumeration of AS/400 users and their status via POP3 ("Shalom Carmel" <shalom@...era.com>)
myBloggie 2.1.1 (Francisco Alisson <dominusvis@...ck21.com.br>)
Arbitrary file overwrite possible by Musicmatch ActiveX control ("Hyperdose Security" <robfly@...erdose.com>)
Re: gzip TOCTOU file-permissions vulnerability (devnull@...ents.Montreal.QC.CA)
Vulnerabilities in sphpblog (echo staff <y3dips@...o.or.id>)
[ECHO_ADV_12$2005] Vulnerabilities in sphpblog (echo staff <y3dips@...o.or.id>)
Re: gzip TOCTOU file-permissions vulnerability ("Peter J. Holzer" <hjp@....ac.at>)
Mafia Blog (Francisco Alisson <dominusvis@...ck21.com.br>)
Re: gzip TOCTOU file-permissions vulnerability (Scott Gifford <sgifford@...pectclass.com>)
[Overflow.pl] Libsafe - Safety Check Bypass Vulnerability ("Overflow.pl" <adv@...rflow.pl>)
Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below (dcrab <dcrab@...kerscenter.com>)

April 16 (8 messages)

Re: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below (JeiAr <security@...ftech.org>)
Re: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below (Paul Laudanski <zx@...tlecops.com>)
[VulnDiscuss] Re: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below[Scanned] ("Paul Laudanski" <zx@...tlecops.com>)
[DR001] AppleWebKit XMLHttpRequest arbitrary file disclosure vulnerability (David Remahl <vuln@...ahl.se>)
phpBB datenbank mod has XSS/SQL Injection in the id variable (tom cruise <the.n3t@...il.com>)
Re: gzip TOCTOU file-permissions vulnerability ("Dmitry Yu. Bolkhovityanov" <bolkhov@....inp.nsk.su>)
Re: ================================ GNU Core Utilities race condition file-permissions vulnerability =================… ("Pavel Kankovsky" <peak@...o.troja.mff.…)
Require many large corporate emails for contact regarding vulnerability. (dcrab <dcrab@...kerscenter.com>)

April 17 (1 message)

[ECL] Windows IP Options DoS POC [ECL] (Yuri Gushin <yuri@...ipse.org.il>)

April 18 (17 messages)

Firesearching 1 + 2 [Firefox 1.0.2] ("mikx" <mikx@...x.de>)
Firelinking [Firefox 1.0.2] ("mikx" <mikx@...x.de>)
[ GLSA 200504-15 ] PHP: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
SUSE Security Announcement: cvs (SUSE-SA:2005:024) (krahmer@...e.de (Sebastian Krahmer))
Re: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
Vulnerability in Coppermine Photo Gallery 1.3.* (GHC team <team@....ru>)
phpBB - Knowledge Base MOD - SQL-Injection and Full Path Disclosure (<deluxe@...urity-project.org>)
[SECURITY] [DSA 710-1] New gtkhtml packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: HTTP RESPONSE SPLITTING by Diabolic Crab ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
ERNW Security Advisory 01/2005 (Mailinglists <mozilla@...-guide.de>)
RE: Firelinking [Firefox 1.0.2] ("Scovetta, Michael V" <Michael.Scovetta@...com>)
[AppSecInc Team SHATTER Security Advisory] Denial of Service in Oracle interMedia (Team SHATTER <shatter@...secinc.com>)
[AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_CDC_SUBSCRIBE and DBMS_CDC_ISUB… (Team SHATTER <shatter@...secinc.com>)
[AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_METADATA package (Team SHATTER <shatter@...secinc.com>)
[AppSecInc Team SHATTER Security Advisory] SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE procedure (Team SHATTER <shatter@...secinc.com>)
[AppSecInc Team SHATTER Security Advisory] SQL Injection in CREATE_SCN_CHANGE_SET procedure (Team SHATTER <shatter@...secinc.com>)
[ GLSA 200504-16 ] CVS: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

April 19 (20 messages)

iDEFENSE Security Advisory 04.18.05: McAfee Internet Security Suite 2005 Insecure File Permission Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
The first open source spyware (gilbert nzeka <dark_khaalel@...oo.fr>)
- Argeniss - Oracle exploits and workarounds (Cesar <cesarc56@...oo.com>)
[ GLSA 200504-17 ] XV: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200504-18 ] Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
MS05-021 Microsoft Exchange X-LINK2STATE Heap Overflow PoC ("Evgeny Pinchuk" <EvgenyP@...ware.com>)
MDKSA-2005:072 - Updated php packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
Portcullis Security Advisory 05-012 Ebay Session Riding Vulnerability ("Paul J Docherty" <PJD@...tcullis-security.com>)
[SECURITY] [DSA 711-1] New info2www packages fix cross-site scripting vulnerability (joey@...odrom.org (Martin Schulze))
Re: cpio TOCTOU file-permissions vulnerability (Steve G <linux_4ever@...oo.com>)
Directoy Traversal Attack in apexec.pl (.%00./-Bug) (<msdarkflyer@...uxmail.org>)
RE: ERNW Security Advisory 01/2005 [ EXPLOIT ] (<cybertronic@....net>)
UBB Thread printthread.php SQL Injection (Hillel Himovich <hll@...vision.net.il>)
File Selection May Lead to Command Execution (GM#015-IE) (GreyMagic Security <security@...ymagic.com>)
[SECURITY] [DSA 712-1] New geneweb packages fix insecure file operations (joey@...odrom.org (Martin Schulze))
CAU - New Tool: hcraft - HTTP Vuln Request Crafter ("I)ruid" <druid@...ghq.org>)
PAKCON II: Call for Papers (CfP - 2005) (Ayaz Ahmed Khan <ayaz@...con.org>)
Announcing PAKCON II (2005)! (Ayaz Ahmed Khan <ayaz@...con.org>)
RE: Portcullis Security Advisory 05-012 Ebay Session Riding Vulnerability ("GulfTech Security Research" <security@...ftech.org>)
Capital One's website inadvertently assists phishing (Joseph Barillari <bugtraq@...illari.org>)

April 20 (32 messages)

[ GLSA 200504-19 ] MPlayer: Two heap overflow vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
RealNetworks RealPlayer/RealOne Player/Helix Player Remote Heap Overflow (Piotr Bania <bania.piotr@...il.com>)
[CLA-2005:947] Conectiva Security Announcement - MySQL (Conectiva Updates <secure@...ectiva.com.br>)
DUportal Pro 3.4 has MANY Sql injection and Sql Errors. (dcrab <dcrab@...kerscenter.com>)
[SECURITY] [DSA 661-2] New f2c packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
SUSE Security Announcement: PostgreSQL buffer overflow problems (SUSE-SA-2005:027) (Marcus Meissner <meissner@...e.de>)
SUSE Security Announcement: RealPlayer buffer overflow in RAM file handling (SUSE-SA:2005:026) (Marcus Meissner <meissner@...e.de>)
[HSC Security Group] Ocean12 Calendar manager 1.01 SQL injection (Zinho <zinho@...kerscenter.com>)
Neslo Desktop Rover Remote DoS Vulnerability (Adam Baldwin <evilpacket@...il.com>)
ICMP attacks against TCP (Proof-of-Concept code) (MS05-019, CISCO:20050412) (houseofdabus HOD <houseofdabus@...ox.ru>)
Multiple eGroupware Vulnerabilities ("GulfTech Security Research" <security@...ftech.org>)
RE: iDEFENSE Security Advisory 04.18.05: McAfee Internet Security Suite 2005 Insecure File Permission Vulnerability ("Boyce, Nick" <nick.boyce@....com>)
Multiple Security Issues Found In AZBB ("GulfTech Security Research" <security@...ftech.org>)
Re: Capital One's website inadvertently assists phishing (Joseph Barillari <bugtraq@...illari.org>)
Re: Capital One's website inadvertently assists phishing (Allen Parker <infowolfe@...il.com>)
Annuaire Netref v4.2 [ fwrite php ] vulnerability (jaguar <webmaster@...ab.com>)
Ecommerce-Carts SQL injection vulnerability ( IHSTeam ) (c0d3r@...team.com)
[waraxe-2005-SA#042] - Multiple vulnerabilities in Coppermine Photo Gallery 1.3.2 (Janek Vind <come2waraxe@...oo.com>)
Shoutbox SCRIPT <= 3.0.2 Administrative MD5 Username and Password Retrieval [x0n3-h4ck] ("CorryL" <corryl@...overde.com>)
Linux vsyscalls may be used as attack vectors (Clad Strife <thadeum@...il.com>)
Secure Science Corporation Application Software Advisory 055 (SSC Advisory Notice <bugtraq@...urescience.net>)
[OpenPKG-SA-2005.006] OpenPKG Security Advisory (mysql) (OpenPKG <openpkg@...npkg.org>)
Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Stephen Frost <sfrost@...wman.net>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("David F. Skoll" <dfs@...ringpenguin.com>)
gzip directory traversal vulnerability (Imran Ghory <imranghory@...il.com>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Stephen Frost <sfrost@...wman.net>)
Re: Vulnerability in Coppermine Photo Gallery 1.3.* (<nibbler999@...rs.sf.net>)
PMsoftware mini http server remote stack overflow exploit (IHSTeam) (c0d3r@...team.com)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Tom Lane <tgl@....pgh.pa.us>)
cpio directory traversal vulnerability (Imran Ghory <imranghory@...il.com>)
Linux vsyscalls may be used as attack vectors (Clad Strife <thadeum@...il.com>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("Jim C. Nasby" <decibel@...ibel.org>)

April 21 (31 messages)

Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Tom Lane <tgl@....pgh.pa.us>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("Jim C. Nasby" <decibel@...ibel.org>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Bruce Momjian <pgman@...dle.pha.pa.us>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Tom Lane <tgl@....pgh.pa.us>)
Re: Microsoft Windows image rendering DoS vuln (patrick <mccpat@...il.com>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("David F. Skoll" <dfs@...ringpenguin.com>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Stephen Frost <sfrost@...wman.net>)
[ GLSA 200504-20 ] openMosixview: Insecure temporary file creation (Thierry Carrez <koon@...too.org>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted (Tino Wildenhain <tino@...denhain.de>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted (Rod Taylor <pg@....ca>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted (Tino Wildenhain <tino@...denhain.de>)
directory traversal in Yawcam 0.2.5 ("Donato Ferrante" <fdonato@...istici.org>)
[PLSN-0004] - Buffer overflow in PostgreSQL (Peachtree Linux Security Team <security@...chtree.burdell.org>)
MDKSA-2005:076 - Updated xli packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:074 - Updated gnome-vfs2 packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("Joshua D. Drake" <jd@...mandprompt.com>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Josh Berkus <josh@...iodbs.com>)
[SECURITY] [DSA 701-2] New samba packages fix correct sporadic crash (joey@...odrom.org (Martin Schulze))
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Stephen Frost <sfrost@...wman.net>)
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Jim Knoble <jmknoble@...ox.com>)
MDKSA-2005:073 - Updated cvs packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Vulnerability kali's tagboard (piker piker <piker_666@...mail.com>)
MDKSA-2005:075 - Updated libcdaudio1 packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Re: Vulnerability kali's tagboard (Jason Dodson <jasond@...fleet.com>)
xine security announcement: multiple heap overflows in MMS and Real RTSP streaming clients (Michael Roitzsch <mroi@...rs.sourceforge.net>)
RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("Mike Fratto" <mfratto@....com>)
Re: Microsoft Windows image rendering DoS vuln (patrick <mccpat@...il.com>)
[SECURITY] [DSA 713-1] New junkbuster packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Stephen Frost <sfrost@...wman.net>)
[PLSN-0001] - Multiple PHP vulnerabilities (Peachtree Linux Security Team <security@...chtree.burdell.org>)
APG Classmaster Workstation Windows SMB share access vulnerability (Alex Garrett <alex@...loitthissite.org>)

April 22 (34 messages)

TSLSA-2005-0013 - cvs (Trustix Security Advisor <tsl@...stix.org>)
MDKSA-2005:077 - Updated cdrecord packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Canonicalization and directory traversal in iSeries FTP security products ("Shalom Carmel" <shalom@...era.com>)
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Lance James <lancej@...urescience.net>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Bruno Wolff III <bruno@...ff.to>)
[PLSN-0002] - Multiple vulnerabilities in Gaim (Peachtree Linux Security Team <security@...chtree.burdell.org>)
[KDE Security Advisory]: Kommander untrusted code execution (Dirk Mueller <dirk@....org>)
Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Stephen Frost <sfrost@...wman.net>)
[KDE Security Advisory]: kimgio input validation errors (Dirk Mueller <dirk@....org>)
UPDATE: [ GLSA 200504-16 ] CVS: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
UPDATE: [ GLSA 200410-10 ] gettext: Insecure temporary file handling (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200504-21 ] RealPlayer, Helix Player: Buffer overflow vulnerability (Thierry Carrez <koon@...too.org>)
[PLSN-0003] - Remote exploits in mplayer (Peachtree Linux Security Team <security@...chtree.burdell.org>)
Multiple Sql injection and XSS in Asp Nuke 0.80 (Working exploits included) (dcrab <dcrab@...kerscenter.com>)
[PLSN-0002] - Multiple vulnerabilities in Gaim (Peachtree Linux Security Team <security@...chtree.burdell.org>)
Re: Microsoft Windows image rendering DoS vuln (Randy <rho@...net.edu>)
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted (Michael Samuel <michael@...net.net>)
Multiple vulnerabilities in Argosoft Mail Server 1.8.7.6 (ShineShadow <ss_contacts@...mail.com>)
[ GLSA 200504-22 ] KDE kimgio: PCX handling buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200504-23 ] Kommander: Insecure remote script execution (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("Mark Senior" <Mark.Senior@....ab.ca>)
RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("Mike Fratto" <mfratto@....com>)
RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords ("Mike Fratto" <mfratto@....com>)
[PLSN-0003] - Remote exploits in MPlayer (Peachtree Linux Security Team <security@...chtree.burdell.org>)
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Jim Knoble <jmknoble@...ox.com>)
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Stephen Frost <sfrost@...wman.net>)
[PLSN-0001] - Multiple vulnerabilities in Gaim (Peachtree Linux Security Team <security@...chtree.burdell.org>)
Microsoft Windows image rendering DoS vuln (Luis Alberto Cortes Zavala <napa@...kersoft.net>)
Re: Microsoft Windows image rendering DoS vuln (Jesse Morgan <jesse@...terpm.net>)
Re: RealNetworks RealPlayer/RealOne Player/Helix Player Remote Heap Overflow (Göran Sandahl <goran@...ndahl.net>)
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords (Antoine Martin <antoine@...afix.co.uk>)
BitDefender 8 - Race condition vulnerability (SecuBox fRoGGz <unsecure@...teme.com>)
FreeBSD Security Advisory FreeBSD-SA-05:05.cvs (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SePro Bugtraq] WBB - WoltLab Burning Board <= 2.3.1 - XSS Vulnerability (22.04.05) (<deluxe@...urity-project.org>)

April 23 (10 messages)

Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted (Stephen Frost <sfrost@...wman.net>)
Multiple Sql injection vulnerabilities in BK Forum v.4 (dcrab <dcrab@...kerscenter.com>)
ACSblog bug (farhad koosha <farhadkey@...oo.com>)
New auto download / install / exploit URL? (Gandalf The White <gandalf@...ital.net>)
-==phpBB 2.0.14 Multiple Vulnerabilities==- (HaCkZaTaN <hck_zatan@...mail.com>)
artmedic_links5 remote file access exploit (Adam n30n Simuntis <n30n@...film.net.pl>)
Multiple Sql injection and XSS in CartWIZ ASP Cart (dcrab <dcrab@...kerscenter.com>)
Local file detection found through Adobe Reader ActiveX control ("Hyperdose Security" <robfly@...erdose.com>)
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted (Antoine Martin <antoine@...afix.co.uk>)
E-Cart v1.1 Remote Command Execution (Nicolas Montoza <xonico@...il.com>)

April 24 (4 messages)

Re: -==phpBB 2.0.14 Multiple Vulnerabilities==- (Paul Laudanski <zx@...tlecops.com>)
[VulnDiscuss] Re: -==phpBB 2.0.14 Multiple Vulnerabilities==-[Scanned] ("Paul Laudanski" <zx@...tlecops.com>)
Re: [VulnDiscuss] Re: -==phpBB 2.0.14 Multiple Vulnerabilities==-[Scanned] (Dave Aitel <dave@...unitysec.com>)
Re: [VulnDiscuss] Re: -==phpBB 2.0.14 Multiple Vulnerabilities==-[Scanned] (Steve Friedl <steve@...xwiz.net>)

April 25 (31 messages)

[INetCop Security Advisory] Snmppd potentially format string vulnerability. ("dong-hun you" <xploit@...kermail.com>)
TSLSA-2005-0015 - postgresql (Trustix Security Advisor <tsl@...stix.org>)
[SNS Advisory No.80] nProtect:Netizen Arbitrary File Download Vulnerability (snsadv@....co.jp (snsadv))
[ GLSA 200504-24 ] eGroupWare: XSS and SQL injection vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
[CIRT.DK - Advisory] Novell Nsure Audit 1.0.1 Denial of Service ("CIRT.DK Advisory" <advisory@...t.dk>)
remote command execution in inserter.cgi script (fireboy fireboy <fireboynet@...mails.com>)
Sql Injection in Confixx 3.06 & 3.08 & 3.?? ? ("Erich Klaus" <DR.erich@....net>)
DMA[2005-0423a] - 'Nokia Affix Bluetooth Integer Underflow' ("KF (lists)" <kf_lists@...italmunition.com>)
Multiple SQL Injections in StorePortal 2.63 (dcrab <dcrab@...kerscenter.com>)
remote command execution in include.cgi script (fireboy fireboy <fireboynet@...mails.com>)
MS05-019 Windows IP options DoS exploit (GomoR <bugtraq@...or.org>)
hyper.cgi script file show bug (fireboy fireboy <fireboynet@...mails.com>)
remote command execution in citat.pl script (fireboy fireboy <fireboynet@...mails.com>)
remote command execution in includer.cgi script (fireboy fireboy <fireboynet@...mails.com>)
Possible XSS in User-Agent (Nicolas Montoza <xonico@...il.com>)
Yager <= 5.24 Remote Buffer Overflow Exploit (<cybertronic@....net>)
E-Cart v1.1 Remote Command Execution Vulnerability ("Emanuele \"z\\\" Gentili" <emanuele@...ietolug.org>)
[Overflow.pl] ImageMagick ReadPNMImage() Heap Overflow (Damian Put <pucik@...rflow.pl>)
MailEnable HTTPS Buffer Overflow [x0n3-h4ck] ("CorryL" <corryl@...overde.com>)
Re: [VulnDiscuss] Re: -==phpBB 2.0.14 Multiple Vulnerabilities==-[Scanned] (bkfsec <bkfsec@....lonestar.org>)
remote command execution in text.cgi script (fireboy fireboy <fireboynet@...mails.com>)
Re: BitDefender 8 - Race condition vulnerability (Ovidiu Constantin <oconstantin@...defender.com>)
index.cgi script XSS + file show (fireboy fireboy <fireboynet@...mails.com>)
remote command execution in forum.pl script (fireboy fireboy <fireboynet@...mails.com>)
RE: New auto download / install / exploit URL? ("Geoff Vass" <geoff@...zow.com.au>)
WoltLab Burning Board <= 2.3.1 PL2 - XSS Vulnerability (24.04.05) (<admin@...znet.com>)
remote command execution in ad.cgi script (fireboy fireboy <fireboynet@...mails.com>)
[security bulletin] SSRT5954 rev.0 HP-UX TCP/IP Remote Denial of Service (DoS) ("Boren, Rich (SSRT)" <rich.boren@...com>)
dBpowerAMP Auxiliary - Abnormal execution (SecuBox fRoGGz <unsecure@...teme.com>)
RE: Possible XSS in User-Agent ("Scovetta, Michael V" <Michael.Scovetta@...com>)
Re: index.cgi script XSS + file show ("D.C. van Moolenbroek" <xanadu@...llo.nl>)

April 26 (31 messages)

iDEFENSE Security Advisory 04.25.05: MySQL MaxDB Webtool Remote Stack Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 04.25.05: MySQL MaxDB Webtool Remote Lock-Token Stack Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Re: -==phpBB 2.0.14 Multiple Vulnerabilities==- (Paul Laudanski <zx@...tlecops.com>)
iDEFENSE Security Advisory 04.26.05: MySQL MaxDB Webtool Remote 'If' Stack Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 04.26.05: Citrix Program Neighborhood Agent Arbitrary Shortcut Creation Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 04.26.05: Citrix Program Neighborhood Agent Buffer Overflow ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
ADV: NetTerm's NetFtpd 4.2.2 Buffer Overflow + PoC Exploit (shadown <shadown@...il.com>)
[SECURITY] [DSA 714-1] New kdelibs packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Multiple SQL Injections in MetaCart e-Shop V-8 (dcrab <dcrab@...kerscenter.com>)
Multiple SQL Injections in MetaCart2 for PayPal (dcrab <dcrab@...kerscenter.com>)
Multiple SQL Injections in MetaCart2 for SQL Server Special Edition U.K (dcrab <dcrab@...kerscenter.com>)
MetaCart2 for PayFlow Multiple Sql Injection Vulnerabilities (dcrab <dcrab@...kerscenter.com>)
Multiple SQL Injections in MetaBid Auctions (dcrab <dcrab@...kerscenter.com>)
E-Cart E-Commerce Software EXPLOIT ("Emanuele \"z\\\" Gentili" <emanuele@...ietolug.org>)
[ GLSA 200504-25 ] Rootkit Hunter: Insecure temporary file creation (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[exploits] phpMyVisites 1.3 local file retrieval (Max Cerny <max@...rny.cz>)
GrayCMS php code injection (Kold <maggik@...a.net>)
tcpdump(/ethereal)[]: (RSVP) rsvp_print() infinite loop DOS. (Vade 79 <v9@...ehalo.us>)
tcpdump[v3.8.x/v3.9.1]: ISIS, BGP, and LDP infinite loop DOS exploits. (Vade 79 <v9@...ehalo.us>)
[PLSN-0007] new libcdaudio package available (Peachtree Linux Security Team <security@...chtree.burdell.org>)
[ GLSA 200504-26 ] Convert-UUlib: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[PLSN-0006] new libexif package available (Peachtree Linux Security Team <security@...chtree.burdell.org>)
[PLSN-0005] new cvs package available (Peachtree Linux Security Team <security@...chtree.burdell.org>)
IE - cross site click detection? (ViPeR <viper31337@...oo.co.in>)
Re: Discovering and Stopping Phishing/Scam Attacks (Randy <rho@...net.edu>)
SQL-injections in Invision Power Board v2.0.1 (CENSORED <censored@...l.ru>)
[ GLSA 200504-27 ] xine-lib: Two heap overflow vulnerabilities (Thierry Carrez <koon@...too.org>)
Discovering and Stopping Phishing/Scam Attacks (steven@...ebug.org)
[Hackers Center Security Group] Sqwebmail Http Splitting Vulnerability (Zinho <zinho@...kerscenter.com>)
Re: Discovering and Stopping Phishing/Scam Attacks (Lode Vermeiren <lode@...u.cx>)
Re: New auto download / install / exploit URL? (joke0 <joke0@...cali.fr>)

April 27 (16 messages)

New Whitepaper: Stopping Automated Attack Tools ("Gunter Ollmann (NGS)" <gunter@...software.com>)
RE: Discovering and Stopping Phishing/Scam Attacks (<matt.neeley@...ilyfeaturedproducts.com>)
Re: Discovering and Stopping Phishing/Scam Attacks (byte_jump <bytejump@...il.com>)
Re: Discovering and Stopping Phishing/Scam Attacks (Crispin Cowan <crispin@...unix.com>)
RE: Discovering and Stopping Phishing/Scam Attacks ("Scovetta, Michael V" <Michael.Scovetta@...com>)
SUSE Security Announcement: Mozilla Firefox, Mozilla various security problems (SUSE-SA:2005:028) (Marcus Meissner <meissner@...e.de>)
Black Hat USA 2005 Reminder CFP closing soon! (Jeff Moss <jmoss@...ckhat.com>)
[HSC Security Group] Comersus v6 Script injection (Zinho <zinho@...kerscenter.com>)
myPHP Forum v3 (possible v1 & 2 also) Identification 'spoof' (Terencentanio Enache <terencentanio.enache@...penworld.com>)
Re: SQL-injections in Invision Power Board v2.0.1 ("Steven M. Christey" <coley@...re.org>)
[SECURITY] [DSA 715-1] New cvs packages fix unauthorised repository access (joey@...odrom.org (Martin Schulze))
iDEFENSE Labs Releases dltrace ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
[SECURITY] [DSA 717-1] New lsh packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 716-1] New gaim packages fix denial of service (joey@...odrom.org (Martin Schulze))
[CLA-2005:950] Conectiva Security Announcement - evolution (Conectiva Updates <secure@...ectiva.com.br>)
[CLA-2005:949] Conectiva Security Announcement - gaim (Conectiva Updates <secure@...ectiva.com.br>)

April 28 (29 messages)

SQL-injections in koobi-cms (CENSORED <censored@...l.ru>)
Buffer overflow in KMiNT21 Software Golden FTP Server Pro v2.52 (10.04.2005) (Reed Arvin <reedarvin@...il.com>)
Privilege escalation in BakBone NetVault 7.1 (Reed Arvin <reedarvin@...il.com>)
Privilege escalation in BulletProof FTP Server v2.4.0.31 (Reed Arvin <reedarvin@...il.com>)
Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88) (Reed Arvin <reedarvin@...il.com>)
[CLA-2005:948] Conectiva Security Announcement - squid (Conectiva Updates <secure@...ectiva.com.br>)
ZRCSA-200501 - Multiple vulnerabilities in Claroline (Sieg Fried <Siegfried@...e-h.org>)
RE: IE - cross site click detection? (ViPeR <viper31337@...oo.co.in>)
OT: Two Factor Authentication on Linux / Mac / Windows (Mohit Muthanna <mohit.muthanna@...il.com>)
High risk flaw in HP OpenView Radia Management Agent (NGSSoftware Insight Security Research <nisr@...tgenss.com>)
Re: Re: Discovering and Stopping Phishing/Scam Attacks ("J. Oquendo" <root@...lrouted.us>)
[ GLSA 200504-28 ] Heimdal: Buffer overflow vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: New auto download / install / exploit URL? (Hermann Arens <hermi@...online.de>)
Security contact at sourceforge? (Joxean Koret <joxeankoret@...oo.es>)
RE: Capital One's website inadvertently assists phishing ("Rager, Anton (Anton)" <arager@...ya.com>)
[SECURITY] [DSA 718-2] New ethereal packages fix buffer overflow (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 719-1] New prozilla packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 718-1] New ethereal packages fix buffer overflow (joey@...odrom.org (Martin Schulze))
Re: Vulnerability kali's tagboard (security curmudgeon <jericho@...rition.org>)
phpBB Notes Mod SQL Injection Vulnerability (GulfTech Security Research <security@...ftech.org>)
Re: tcpdump(/ethereal)[]: (RSVP) rsvp_print() infinite loop DOS. (Romain Francoise <rfrancoise@...ian.org>)
Re: tcpdump[v3.8.x/v3.9.1]: ISIS, BGP, and LDP infinite loop DOS exploits. (Romain Francoise <rfrancoise@...ian.org>)
Netflix Site may assist Phishing (Sara Togian <saratogian@...il.com>)
Borland Security Contact (Dave Armstrong <davea@...software.com>)
Webcache Client Requests Bypass OHS mod_access Restrictions (Alexander Kornbrust <ak@...-database-security.com>)
insecure user account lam-runtime-7.0.6-2mdk rpm (Scott Grayban <sgrayban@...gnet.us>)
File appending vulnerability in Oracle Webcache 9i (Alexander Kornbrust <ak@...-database-security.com>)
Cross Site Scripting in Oracle Webcache 9i Adminstrator Application (Alexander Kornbrust <ak@...-database-security.com>)
[Security Bulletin] SSRT5958 rev.0 - HP OpenView Radia Mgmt. Portal (RMP) Radia Mgmt. Agent Remote unauthorized Privileg… ("Boren, Rich (SSRT)" <rich.boren@...com…)

April 29 (25 messages)

[HSC Security Group] Ocean12 Mailing List Manager Pro SQL injection (Zinho <zinho@...kerscenter.com>)
Cross Site Scripting in BEA Admin Console (Alexander Kornbrust <ak@...-database-security.com>)
Re: Security contact at sourceforge? (Scott Grayban <scott@...enterprises.com>)
Re: Vulnerability kali's tagboard (Jesus <root@...urrected.us>)
Re: Borland Security Contact ("KF (lists)" <kf_lists@...italmunition.com>)
RE: Netflix Site may assist Phishing ("pak_ml" <pak_ml@...penworld.com>)
Re: New auto download / install / exploit URL? (Nicob <nicob@...ob.net>)
DHS Security Contact ("Jason Coombs" <jasonc@...ence.org>)
Multiple Sql injections in phpCoin v1.2.2 and below (dcrab <dcrab@...kerscenter.com>)
Safari HTTPS Overflow (Gilbert Verdian <gverdian@...research.org>)
NY sues Spyware Intermix, funded by Tiaa-Cref (Paul Laudanski <zx@...tlecops.com>)
Golden FTP Server Pro remote stack BOF exploit (IHSTeam) (c0d3r@...team.com)
MDKSA-2005:080 - Updated libxpm4 packages fix libXpm vulnerabilities (Mandriva Security Team <security@...driva.com>)
Multiples Full Path Disclosure in php-nuke 7.6 (and below) (Luis Fernando <spiderkid@...il.com>)
MDKSA-2005:079 - Updated perl packages to fix rmtree vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:078 - Updated squid packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
[CAN-2005-1063] Administration protocol abuse leads to Service and System Denial of Service (Secure Computer Group <scg@....es>)
[CAN-2005-1062] Administration protocol abuse allows local/remote password cracking (Secure Computer Group <scg@....es>)
DEF CON - New CTF Organizers chosen! (The Dark Tangent <dtangent@...con.org>)
Re: Safari HTTPS Overflow (David Riley <oscar@...-rileys.net>)
Re: Safari HTTPS Overflow (Braden Thomas <braden127@...ealbox.com>)
Re: Re: Borland Security Contact (Markus Stenzel <olray-dragon@...anime.org>)
Mac OS X Cocktail 3.5.4 admin password disclosure ("sonderling" <sonderling@...hmail.com>)
Snmppd SNMP proxy daemon format string exploit (<cybertronic@....net>)
Apache hacks (./atac, d0s.txt) (Andrew Y Ng <ayn@...rewNg.com>)

April 30 (5 messages)

[ GLSA 200504-29 ] Pound: Buffer overflow vulnerability (Thierry Carrez <koon@...too.org>)
[Articles] brute forcing - discovering weak logins and more (Sumy <sanandres@...il.com>)
[ GLSA 200504-30 ] phpMyAdmin: Insecure SQL script installation (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Defcon Capture the Flag registration is open (Kenshoto <ctf@...shoto.com>)
Microsoft WINS Vulnerability + OS/SP Scanner (class <ad@...ss101.org>)

566 messages

Powered by blists - more mailing lists