bugtraq mailing list - 2005/08

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2005/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 18	² 11	³ 11	⁴ 18	⁵ 29	⁶ 6	⁷ 1
⁸ 12	⁹ 35	¹⁰ 21	¹¹ 21	¹² 15	¹³ 3	¹⁴ 3
¹⁵ 15	¹⁶ 18	¹⁷ 13	¹⁸ 24	¹⁹ 15	²⁰ 8	²¹ 1
²² 13	²³ 16	²⁴ 22	²⁵ 22	²⁶ 15	²⁷ 30	²⁸ 1
²⁹ 20	³⁰ 11	³¹ 28

Messages by day:

August 1 (18 messages)

OT: Looking for beta testers for Two-Factor Authentication Service (Mohit Muthanna <mohit.muthanna@...il.com>)
Re: OT: Looking for beta testers for Two-FactorAuthentication Service ("Kurt Seifried" <listuser@...fried.org>)
Re: OT: Looking for beta testers for Two-FactorAuthentication Service (Mohit Muthanna <mohit.muthanna@...il.com>)
[ GLSA 200508-01 ] Compress::Zlib: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Buffer overflow in BusinessMail email server system 4.60.00 (Reed Arvin <reedarvin@...il.com>)
Re: Did you miss us yet? (Dinis Cruz <dinis@...lus.net>)
Re: [VulnWatch] The Java applet sandbox and stateful firewalls (Dinis Cruz <dinis@...lus.net>)
[USN-157-1] Mozilla Thunderbird vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-158-1] gzip utility vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-159-1] unzip vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: [VulnWatch] The Java applet sandbox and stateful firewalls (Florian Weimer <fw@...eb.enyo.de>)
HACK IN THE BOX SECURITY CONFERENCE 2005 (alphademon <alpha_n_demon@...oo.com>)
[SVadvisory] - SQL injection in OpenBook 1.2.2 (svt@....nukleon.us)
PHPList Vunerability (ziot@...taboutpp.com)
[SECURITY] [DSA 771-1] New pdns packages fix denial of service (joey@...odrom.org (Martin Schulze))
ChurchInfo Multiple Vulnerabilities (thegreatone2176@...oo.com)
TSLSA-2005-0038 - multi (Trustix Security Advisor <tsl@...stix.org>)
Vulnerability in Trendmicro Officescan (sylvain.roger@...ucom.fr)

August 2 (11 messages)

Re: LSS Security Advisory: Winamp remote buffer overflow vulnerability (ljuranic@....hr)
Microsoft ActiveSync information leak and spoofing (3APA3A <3APA3A@...URITY.NNOV.RU>)
unzip TOCTOU file-permissions vulnerability (Imran Ghory <imranghory@...il.com>)
Re: Trillian Ver 3.1 saves password's in plain Text (security curmudgeon <jericho@...rition.org>)
Arab Portal (ABDUCTER_MINDS@...OO.COM)
Quick 'n Easy FTP Server 3.0 pro / lite (buffer overflow vulnerabilities) (matiteman@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.co…)
VBZoom Cross Site Scripting Vulnerabilities (almaster@...mail.com)
Re: Re : [Firefox Bug 302187] New: Shared section vulnerability when opening microsoft office document resulting in DoS (Cesar <cesarc56@...oo.com>)
[ GLSA 200508-03 ] nbSMTP: Format string vulnerability (Thierry Carrez <koon@...too.org>)
CAID 33239 - Computer Associates BrightStor ARCserve/Enterprise Backup Agents buffer overflow vulnerability ("Williams, James K" <James.Williams@...com>)
[NOBYTES.COM: #8] Naxtor Shopping Cart 1.0 - Information Disclosure & Possible SQL Injection ("John Cobb" <johnc@...ytes.com>)

August 3 (11 messages)

iDEFENSE Security Advisory 08.02.05: CA BrightStor ARCserve Backup Agent for MS SQL Server Buffer Overflow ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
[security bulletin] SSRT5998 Rev.0 HP System Management Homepage (v2.0.x) Denial of Service (DoS) & XSS (security-alert@...com)
Re: Quick 'n Easy FTP Server 3.0 pro / lite (buffer overflow vulnerabilities) (brom0815@....de)
Re: [NOBYTES.COM: #8] Naxtor Shopping Cart 1.0 - Information Disclosure & Possible SQL Injection (Patrick Morris <pmorris@...mesinfotech.com>)
Zip 2,31 bad default file-permissions vulnerability (Imran Ghory <imranghory@...il.com>)
[SECURITY] [DSA 772-1] New apt-cacher package fixes arbitrary command execution (joey@...odrom.org (Martin Schulze))
MDKSA-2005:128 - Updated mozilla packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: CAID 33239 - Computer Associates BrightStor ARCserve/Enterprise Backup Agents buffer overflow vulnerability (cybertronic@....net)
Silvernews 2.0.3 (possibly previous versions ) SQL Injection / Login Bypass / Remote commands execution / cross site scripting (retrogod@...ceposta.it)
[security bulletin] SSRT4682 rev.0 - Oracle for Openview (OfO) Critical Patch Update July 2005 (security-alert@...com)
Re: ClamAV Multiple Rem0te Buffer Overflows ("Steven M. Christey" <coley@...re.org>)

August 4 (18 messages)

Zone Alarm Security Contact ("David Cross" <davidcross@...t-n-track.com>)
[USN-160-1] Apache 2 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Mozilla Firefox InstallVersion->compareTo() vulnerability lowered severity status (Aviv Raff <avivra@...il.com>)
[USN-161-1] bzip2 utility vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Trillian Ver 3.1 saves password's in plain Text (Suramya Tomar <security@...amya.com>)
RE: On classifying attacks (Tim Nelson <tim.nelson@...alive.biz>)
SUSE Security Announcement: several kernel security problems (SUSE-SA:2005:044) (Ludwig Nussel <ludwig.nussel@...e.de>)
Scanning Software Bugs (Dan.Creed@...creeds.net)
Re: Mozilla Firefox InstallVersion->compareTo() vulnerability lowered severity status (Berend-Jan Wever <berendjanwever@...il.com>)
RE: Trillian Ver 3.1 saves password's in plain Text ("Keith Phillips" <kphillips@...rdreamcorp.com>)
FINAL Phrack Magazine release #63 is OUT (phrackstaff@...ack.org)
RE: Trillian Ver 3.1 saves password's in plain Text ("Darren Pilgrim" <dmp@...freak.org>)
Re: Trillian Ver 3.1 saves password's in plain Text (Technica Forensis <forensis.technica@...il.com>)
Re: Zip 2,31 bad default file-permissions vulnerability (Imran Ghory <imranghory@...il.com>)
Re: Trillian Ver 3.1 saves password's in plain Text (Technica Forensis <forensis.technica@...il.com>)
Re: Re: Quick 'n Easy FTP Server 3.0 pro / lite (buffer overflow vulnerabilities) (asierillo@...il.com)
Re: Zip 2,31 bad default file-permissions vulnerability (Lupe Christoph <lupe@...e-christoph.de>)
Re: Coldfusion Fusebox V4.1.0 Vulnerability ("Ian Mitchell" <trash@...ermagic.com>)

August 5 (29 messages)

MDKSA-2005:129 - Updated apache2 packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:130 - Updated apache packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: Zip 2,31 bad default file-permissions vulnerability (Lupe Christoph <lupe@...e-christoph.de>)
Re: Coldfusion Fusebox V4.1.0 Vulnerability (steven@...ebug.org)
Re: ClamAV Multiple Rem0te Buffer Overflows (list@...0te.com)
Cisco IOS Shellcode - McAfee IPS Protection (planz 235 <planz2009@...il.com>)
Re: Zone Alarm Security Contact (security curmudgeon <jericho@...rition.org>)
Remote Password Compromise of Microsoft Active Sync 3.7.1 (nospam@...scanner.com)
Re: On classifying attacks (Crispin Cowan <crispin@...ell.com>)
Nate User Password Disclosed By Anonymous ("saintlinu" <saintlinu@...oo.co.kr>)
[ GLSA 200508-04 ] Netpbm: Arbitrary code execution in pstopnm (Thierry Carrez <koon@...too.org>)
Re: Mozilla Firefox InstallVersion->compareTo() vulnerability lowered severity status (Aviv Raff <avivra@...il.com>)
Nate User Password Disclosed By Anonymous ("saintlinu" <saintlinu@...oo.co.kr>)
Re: Scanning Software Bugs ("KF (lists)" <kf_lists@...italmunition.com>)
MDKSA-2005:131 - Updated ethereal packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: uguestbook exploit (security curmudgeon <jericho@...rition.org>)
Silvernews 2.0.3 remote command execution exploit, proxy server support! (tsl@...urityfocus.com, "[at]"@securityfocus.com, hackermail.com@...urityfocus.com)
[HSC Security Group] Multiple XSS in phpopenchat 3.0.2 (zinho@...kerscenter.com)
FlatNuke 2.5.5 (possibly prior versions) remote commands execution / cross site scripting / path disclosure (by rgod) (retrogod@...ceposta.it)
Re: Zip 2,31 bad default file-permissions vulnerability (Stephen C Woods <scw@...s.ucla.edu>)
TSLSA-2005-0040 - multi (Trustix Security Advisor <tsl@...stix.org>)
Re: Zip 2,31 bad default file-permissions vulnerability (Lupe Christoph <lupe@...e-christoph.de>)
Re: Trillian Ver 3.1 saves password's in plain Text (patrick <mccpat@...il.com>)
Comdev eCommerce config.php Vulnerability (none@...e.com)
tar preserves setuid bit (Imran Ghory <imranghory@...il.com>)
ipb Css bug(now public) (virusishacker@...il.com)
iDEFENSE Security Advisory 08.05.05: EMC Navisphere Manager Directory Traversal Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Defeating Citi-Bank Virtual Keyboard Protection ("Debasis Mohanty" <debasis@...kingspirits.com>)
Comdev eCommerce wce.download.php Download Vulnerability (none@...e.com)

August 6 (6 messages)

Root exploits in Lantonix Secure Console Server (c0ntex@...n-security.org)
Vulnerability in ePing and eTrace plugins of e107 (os2a.bto@...il.com)
Re: On classifying attacks (Thierry Carrez <koon@...too.org>)
Re: On classifying attacks (Shwaine <shwaine@...aine.com>)
RE: On classifying attacks ("Forte Systems - Iosif Peterfi" <toto@...tesys.ro>)
Re: On classifying attacks (Duncan Simpson <dps@...pson.demon.co.uk>)

August 7 (1 message)

[ GLSA 200508-05 ] Heartbeat: Insecure temporary file creation (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

August 8 (12 messages)

Gravity Board X v1.1 multiple vulnerabilities (retrogod@...ceposta.it)
Re: SQL IN PortailPHP ("Steven M. Christey" <coley@...re.org>)
SQL IN Open Bulletin Board (ABDUCTER_MINDS@...OO.COM)
Re: [NOBYTES.COM: #8] Naxtor Shopping Cart 1.0 - Information Disclosure & Possible SQL Injection (ICool <devfreedom@...il.com>)
E107 + IPB XSS Exploit (edward11@...tmaster.co.uk)
Re: ipb Css bug(now public) (mattmecham@...il.com)
XSS in forums CFBB v1.1.0 (stormhacker@...mail.com)
Advisory 13/2005: Remote code execution in SysCP (Christopher Kunz <christopher.kunz@...dened-php.net>)
RE: CAID 33239 - Computer Associates BrightStor ARCserve/Enterprise Backup Agents buffer overflow vulnerability ("Williams, James K" <James.Williams@...com>)
[SVadvisory#13] - SQL injection in MYFAQ 1.0 (svt@....nukleon.us)
Re: ipb Css bug(now public) (Nicolas Gregoire <ngregoire@...probe.com>)
[USN-162-1] ekg and Gadu library vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)

August 9 (35 messages)

[AppSecInc Advisory MYSQL05-V0002] Buffer Overflow in MySQL User Defined Functions (Team SHATTER <shatter@...secinc.com>)
[AppSecInc Advisory MYSQL05-V0001] Improper Filtering of Directory Traversal Characters in MySQL User Defined Functions (Team SHATTER <shatter@...secinc.com>)
[AppSecInc Advisory MYSQL05-V0003] Multiple Issues with MySQL User Defined Functions (Team SHATTER <shatter@...secinc.com>)
Re: [AppSecInc Advisory MYSQL05-V0002] Buffer Overflow in MySQL User Defined Functions ("David Litchfield" <davidl@...software.com>)
Mozilla Firefox up to 1.0.6 and Mozilla Thunderbird up to 1.0 url string obfuscation ("Marc Ruef" <maru@...p.ch>)
Re: Kent's Guestbook database exploit (security curmudgeon <jericho@...rition.org>)
Creating a secret web site on IIS 5.x using Alternative Data Streams (inge_eivind.henriksen@...llo.no)
Re: Scanning Software Bugs (Hugo van der Kooij <hvdkooij@...derkooij.org>)
Nate User Password Disclosed By Anonymous (saintlinu@...l2root.org)
Re: Cisco IOS Shellcode - McAfee IPS Protection (Darren Reed <avalon@...igula.anu.edu.au>)
nbSMTP v0.99 remote format string exploit (coki@...ystem.com.ar)
Re: tar preserves setuid bit (Neil McKellar <mckellar@...usplanet.net>)
[USN-163-1] xpdf vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Zip 2,31 bad default file-permissions vulnerability (Imran Ghory <imranghory@...il.com>)
Re: tar preserves setuid bit (Imran Ghory <imranghory@...il.com>)
Re: Defeating Citi-Bank Virtual Keyboard Protection (Daniel Bonekeeper <thehazard@...il.com>)
Re: tar preserves setuid bit (Sean Comeau <scomeau@...secwest.com>)
(no subject) (<kartoffelguru@...h.com>)
(no subject) (<kartoffelguru@...h.com>)
Re: Trillian Ver 3.1 saves password's in plain Text (Suramya Tomar <security@...amya.com>)
Re: GNU tar and the setuid bit (David Watson <baikie@...hat.freeserve.co.uk>)
Re: GNU tar and the setuid bit (David Watson <baikie@...hat.freeserve.co.uk>)
Re: (no subject) ("KF (lists)" <kf_lists@...italmunition.com>)
Re: [DCC SPAM] Defeating Citi-Bank Virtual Keyboard Protection (Secure Science Corporation Bugtraq <bugtraq@...urescience.net>)
iDEFENSE Security Advisory 08.09.05: AWStats ShowInfoURL Remote Command Execution Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
FunkBoard V0.66CF (possibly prior versions) cross site scripting, possible database username/password disclosure & board takeover,pos… (retrogod@...ceposta.it)
tool release: n.bug (Felix Lindner <felix.lindner@...ns.com>)
Re: (no subject) (Stan Bubrouski <stan.bubrouski@...il.com>)
Apple Safari & Javascript - KERN_INVALID_ADDRESS (0x0001) (Patrick Webster <pwebster@...geo.com.au>)
Sql injection and global variables poisoning in XMB Forum 1.9.1 (heintz@...mail.com)
Bugtraq ID: 14460 : Coldfusion Fusebox V4.1.0 Vulnerability (Adrocknaphobia <adrocknaphobia@...il.com>)
RE: Creating a secret web site on IIS 5.x using Alternative Data Streams ("James C Slora Jr" <Jim.Slora@...a.com>)
Re: tar preserves setuid bit ("Jeremy C. Reed" <reed@...dmedia.net>)
BID 14355, VERITAS NetBackup 5.1 Time Stamp Vulnerability (secure@...antec.com)
[security bulletin] SSRT5940 rev.1 - HP-UX Mozilla remote, unauthorized user may execute privileged code (security-alert@...com)

August 10 (21 messages)

Help put a stop to incompetent computer forensics (Jason Coombs <jasonc@...ence.org>)
Re: Mozilla Firefox up to 1.0.6 and Mozilla Thunderbird up to 1.0 url string obfuscation (Alessandro Amici <alexamici@...twebnet.it>)
RE: Help put a stop to incompetent computer forensics ("Christopher Day" <cday@...ardgroup.com>)
Re: Defeating Citi-Bank Virtual Keyboard Protection (AsTriXs <astrixs@...il.com>)
Design Flaw at Microsoft's AntiSpyware (manolisgavriil@...mail.com)
NSFOCUS SA2005-02 : Microsoft IE Devenum.dll COM Instantiation Remote Code Execution Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
Re: Help put a stop to incompetent computer forensics (James Tucker <jftucker@...il.com>)
Evolution multiple remote format string bugs (<sitic@....se>)
[security bulletin] SSRT051005 rev.0 - HP ProLiant DL585 Servers Unauthorized Remote Access (security-alert@...com)
[security bulletin] SSRT5957 rev.0 - HP Tru64 UNIX IPSEC Tunnel ESP Mode Remote Unauthorized Disclosure of Encrypted Dat… (Security Alert <secure@...hs.cup.hp.com…)
[security bulletin] SSRT5998 rev.1 - HP System Management Homepage (v2.0.x) Denial of Service (DoS) and XSS (security-alert@...com)
[KDE Security Advisory] kpdf temp file writing DoS vulnerability (Dirk Mueller <mueller@....org>)
Full path disclosure in CaLogic 1.22 and possible in older versions. (gb.network@...il.com)
Re: SQL IN Open Bulletin Board (security curmudgeon <jericho@...rition.org>)
CoolWebSearch found in massive spyware ring (Paul Laudanski <zx@...tlecops.com>)
MDKSA-2005:132 - Updated heartbeat packages fix temporary file vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:133 - Updated netpbm packages fix temporary file vulnerabilities (Mandriva Security Team <security@...driva.com>)
Privilege escalation in Linksys WLAN Monitor v2.0. (Reed Arvin <reedarvin@...il.com>)
Re: Operation Site-Key computer forensic searches ruled illegal (Jason Coombs <jasonc@...ence.org>)
Privilege escalation in Nortel Contivity VPN Client V05_01.030 (Jeff Peadro <jeff.peadro@...il.com>)
Re: Help put a stop to incompetent computer forensics (Jason Coombs <jasonc@...ence.org>)

August 11 (21 messages)

Re: Help put a stop to incompetent computer forensics (Technica Forensis <forensis.technica@...il.com>)
Re: Re: Help put a stop to incompetent computer forensics (Technica Forensis <forensis.technica@...il.com>)
[FLSA-2005:157701] Updated Apache httpd packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:157696] Updated gzip package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152889] Updated mc packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:129284] Updated spamassassin package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
ISS vs. Cisco: Chapter 2 (FX <fx@...noelit.de>)
Re: Compromising pictures of Microsoft Internet Explorer! (Michal Zalewski <lcamtuf@...ne.ids.pl>)
[USN-164-1] netpbm vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-166-1] Evolution vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-165-1] heartbeat vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: ISS vs. Cisco: Chapter 2 (Florian Weimer <fw@...eb.enyo.de>)
High Risk Vulnerability in Novell eDirectory Server ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
SUSE Security Announcement: Mozilla various security problems (SUSE-SA:2005:045) (Marcus Meissner <meissner@...e.de>)
Privilege escalation in Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3) (Reed Arvin <reedarvin@...il.com>)
[SECURITY] [DSA 773-1] New amd64 packages fix several bugs (joey@...odrom.org (Martin Schulze))
MDKSA-2005:138 - Updated cups packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
remote DOS on Wyse thin client 1125SE (Josh Zlatin-Amishav <josh@...at.cc>)
MDKSA-2005:137 - Updated ucd-snmp packages fix a DoS vulnerability (Mandriva Security Team <security@...driva.com>)
Fudforum: incompletely check of user rights in tree view gaining access to all messages (Alexander Heidenreich <alex@...temli.org>)
MDKSA-2005:135 - Updated kdegraphics packages fix vulnerability (Mandriva Security Team <security@...driva.com>)

August 12 (15 messages)

[USN-167-1] AWStats vulnerability (Martin Pitt <martin.pitt@...onical.com>)
MDKSA-2005:136 - Updated gpdf packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Windows 2000 universal exploit for MS05-039 (<sl0ppy@...h.ai>)
MDKSA-2005:134 - Updated xpdf packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
[USN-168-1] Gaim vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
FW: Updated Version & Exploit - Privilege escalation in Nortel Contivity VPN Client V05_01.030 (Jeff Peadro <jeff.peadro@...il.com>)
Xoops 2.2.1 Full Path Disclosure (none@...e.com)
[SECURITY] [DSA 774-1] New fetchmail packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
(MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow (Universal Exploit + no crash shellcode) (houseofdabus <houseofdabus@...ox.ru>)
My Bulletin Board RC 4 Vulnerabilities (phuket <phuket.bugtraq@...il.com>)
Insecure directory permissions of default installation of Kaspersky Anti-Virus for Unix/Linux File Servers will lead to… ("Dr. Peter Bieringer" <pbieringer@...as…)
Privilege escalation in Linksys WLAN Monitor v2.0 (Reed Arvin <reedarvin@...il.com>)
Re: Xoops 2.2.1 Full Path Disclosure (kato <gentoo@...enshade.com>)
Bluetooth: Theft of Link Keys for Fun and Profit? ("KF (lists)" <kf_lists@...italmunition.com>)
Grandstream Budge Tone 101/102 DoS Vulnerability (Kroma Pierre <kroma@...s.de>)

August 13 (3 messages)

Low security hole affecting Mentor's ADSLFR4II router (Tim Brown <securityfocus@...hine.org.uk>)
JaguarControl Activex Buffer Overflow (Tacettin Karadeniz <tacettinkaradeniz@...oo.com>)
SQL in PHPTB Topic Boards 2.0 (almaster@...mail.com)

August 14 (3 messages)

XSS Nordstroms.com (Jeff Peadro <jeff.peadro@...il.com>)
XSS www.jg-tc.com (Jeff Peadro <jeff.peadro@...il.com>)
(TOOL ANNOUNCEMENT) Efilter - automatic exception reporting utility (Piotr Bania <bania.piotr@...il.com>)

August 15 (15 messages)

[DRUPAL-SA-2005-004] Drupal 4.6.3 / 4.5.5 fixes critical XML-RPC issue (Uwe Hermann <uwe@...mann-uwe.de>)
[ GLSA 200508-06 ] Gaim: Remote execution of arbitrary code (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: Privilege escalation in Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3) (NoBrain NoPain <nobnop@...il.com>)
Advisory 15/2005: PHPXMLRPC Remote PHP Code Injection Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Advisory 14/2005: PEAR XML_RPC Remote PHP Code Injection Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Re: Privilege escalation in Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3) (Reed Arvin <reedarvin@...il.com>)
Re: Privilege escalation in Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3) (sec-list@...og.org)
Vulnerability found in CPAINT Ajax Toolkit (wiley14@...il.com)
[SECURITY] [DSA 761-2] New heartbeat packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
drone armies C&C report - July/2005 (Gadi Evron <gadi@...ila.gov.il>)
[SECURITY] [DSA 775-1] New Mozilla packages fix frame injection spoofing vulnerability (joey@...odrom.org (Martin Schulze))
Technical Note by Amit Klein: Detecting and Preventing HTTP Response Splitting and HTTP Request Smuggling Attacks at th… ("Amit Klein (AKsecurity)" <aksecurity@h…)
Serious flaw in Linksys wireless AP password security (Steve Scherf <bugtraq@...nsoft.com>)
Re: FunkBoard V0.66CF (possibly prior versions) cross site scripting, possible database username/password disclosure & board takeover… (colin@...kboard.co.uk)
Serious flaw in Linksys wireless AP password security (Steve Scherf <bugtraq@...nsoft.com>)

August 16 (18 messages)

[ GLSA 200508-07 ] AWStats: Arbitrary code execution using malicious Referrer information (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200508-08 ] Xpdf, Kpdf, GPdf: Denial of Service vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
MDKSA-2005:139 - Updated gaim packages fix yet more vulnerabilities (Mandriva Security Team <security@...driva.com>)
Corsaire Security Advisory: HP Ignite-UX passwd file disclosure issue (advisories <advisories@...saire.com>)
MDKSA-2005:140 - Updated proftpd packages fix format string vulnerabilities (Mandriva Security Team <security@...driva.com>)
249bytes reverse shellcode with "nooil tricks methods" (msuiche@...il.com)
Corsaire Security Advisory: HP Ignite-UX filesystem permissions issue (advisories <advisories@...saire.com>)
[SECURITY] [DSA 776-1] New clamav packages fix several problems (joey@...odrom.org (Martin Schulze))
SUSE Security Announcement: apache, apache2 request smuggling problem (SUSE-SA:2005:046) (Marcus Meissner <meissner@...e.de>)
[NOBYTES.COM: #9] ECW Shop 6.0.2 - Multiple Vulnerabilities ("John Cobb" <johnc@...ytes.com>)
RE: Serious flaw in Linksys wireless AP password security ("Robert Thompson Jr." <rthompson@...umbiabank.com>)
SQL injection in Persianblog (alireza hassani <trueend5@...oo.com>)
RE: Vulnerability found in CPAINT Ajax Toolkit ("Thor Larholm" <thor@...x.com>)
Hummingbird FTP Weak Password Encryption (nnposter@...rs.sourceforge.net)
Win32 Port of Nessusd (Tom Stracener <strace@...il.com>)
Re: Serious flaw in Linksys wireless AP password security (Steve Scherf <steve@...nsoft.com>)
RE: Serious flaw in Linksys wireless AP password security ("Robert Thompson Jr." <rthompson@...umbiabank.com>)
[security bulletin] SSRT4874 rev.0 - HP-UX Ignite-UX Remote Unauthorized Access ("Boren, Rich (HP SSRT)" <rich.boren@...com>)

August 17 (13 messages)

Unicode Buffer Overflow in WinFtp Server 1.6.8 ("Donato Ferrante" <fdonato@...istici.org>)
Re: Win32 Port of Nessusd (Michael Boman <michael.boman@...il.com>)
[ GLSA 200508-09 ] bluez-utils: Bluetooth device name validation vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Buffer-overflow in Chris Moneymaker's World Poker Championship 1.0 (Luigi Auriemma <aluigi@...istici.org>)
Cisco Security Advisory: Cisco Clean Access Unauthenticated API Access (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
NOVL-2005010098073 GroupWise Password Caching ("Ed Reed" <ereed@...ell.com>)
[SECURITYREASON.COM] phpAdsNew/phpPgAds 2.0.5 Local file inclusion cXIb8O3.16 (max@...tsuper.pl)
Re: SQL injection in Persianblog (nummish <nummish@...il.com>)
SQL injection in mediabox404 v1.2 (cedric@...urityfocus.com, tissieres@...urityfocus.com, objectif-securite@...urityfocus.com, ch@...urityfocus.com)
[SECURITY] [DSA 777-1] New Mozilla packages fix frame injection spoofing vulnerability (joey@...odrom.org (Martin Schulze))
PHPTB Topic Board <= 20: Multiple PHP injection vulnerabilities (goszynskif@...il.com)
[PHPADSNEW-SA-2005-001] phpAdsNew and phpPgAds 2.0.6 fix multiple vulnerabilities (Matteo Beccati <matteo@...cati.com>)
MSN Messenger Password Decrypter for WinXP/2003 (ViPeR <viper31337@...oo.co.in>)

August 18 (24 messages)

Internet Explorer 6 Meta Refresh Parsing Weakness (Moritz Naumann <info@...itz-naumann.com>)
Re: Internet Explorer 6 Meta Refresh Parsing Weakness (tuytumadre@....net)
COM objects and MSIE vulnerabilities recap + additional fix (Berend-Jan Wever <berendjanwever@...il.com>)
Bypassing the new /GS protection in VC++ 7.1 (D K <dwarkeeper@...il.com>)
mutt buffer overflow (Peter Valchev <pvalchev@...htly.net>)
Re: mutt buffer overflow ("Frank Denis \(Jedi/Sector One\)" <j@...eftpd.org>)
Sensitive Information Disclosure Vulnerability in Kinetics Kiosk Product ("Jason Coombs" <jasonc@...ence.org>)
Juniper Netscreen VPN Username Enumeration Vulnerability (Roy Hills <Roy.Hills@...-monitor.com>)
Re: Sensitive Information Disclosure Vulnerability in Kinetics Kiosk Product (Sam Evans <wintrmte@...il.com>)
Zorum 3.5 remote code execution poc exploit (retrogod@...ceposta.it)
Password Disclosure in Whisper32 ("Alexey Agapov" <agapov25@...bler.ru>)
Re: [SECURITY] [DSA 777-1] New Mozilla packages fix frame injection spoofing vulnerability (Douglas Duckworth <stlpcsecurity@...il.com>)
Bluez hcid popen() explained. ("KF (lists)" <kf_lists@...italmunition.com>)
BBCaffe 2.0 cross site scripting poc (retrogod@...eposta.it)
MDKSA-2005:143 - Updated kdegraphics packages fix kfax vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:142 - Updated libtiff packages fixes vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:141 - Updated evolution packages fixes format string vulnerabilities (Mandriva Security Team <security@...driva.com>)
runcms highlight.php hole (Security Lists <secure@...online.com>)
PHPFreeNews V1.40 and prior Multiple Vulnerabilities (h4cky0u@...il.com)
Re: Sensitive Information Disclosure Vulnerability in Kinetics Kiosk Product ("Jay D. Dyson" <jdyson@...achery.net>)
UnixWare 7.1.4 UnixWare 7.1.3 : cpio race condition and directory traversal issues fixed. (please_reply_to_security@....com)
DevC++ V.4.9.9.2 NULL BYTE INSERTION / OBFUSCATION FLAW (by rgod) (retrogod@...ceposta.it)
MDKSA-2005:144 - Updated wxPythonGTK packages several vulnerabilities (Mandriva Security Team <security@...driva.com>)
w-agora 4.2.0 and prior Remote Directory Travel Vulnerability (h4cky0u@...il.com)

August 19 (15 messages)

ATutor 1.5.1 and prior multiple XSS Vulnerabilities (h4cky0u@...il.com)
[ GLSA 200508-10 ] Kismet: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[USN-169-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200508-11 ] Adobe Reader: Buffer Overflow (Thierry Carrez <koon@...too.org>)
Re: Sensitive Information Disclosure Vulnerability in Kinetics Kiosk Product ("Zow" Terry Brugger <zow@...l.gov>)
Re: Internet Explorer 6 Meta Refresh Parsing Weakness (Moritz Naumann <info@...itz-naumann.com>)
Secunia Research: HAURI Anti-Virus Compressed Archive Directory Traversal (Secunia Research <vuln@...unia.com>)
[USN-170-1] gnupg vulnerability (Martin Pitt <martin.pitt@...onical.com>)
anti-phishing implementation (Bjorn Borg <bjorn.brg@...il.com>)
Re: anti-phishing implementation (Saqib Ali <docbook.xml@...il.com>)
WinAce Temporary File Parsing Buffer Overflow Vulnerability (atmaca@...mail.com)
[SECURITY] [DSA 778-1] New mantis packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Cisco Clean Access Agent (Perfigo) bypass (llhansen-bugtraq@...ms.edu)
Fwd: Tor security advisory: DH handshake flaw (Chris Palmer <chris@....org>)
Vul in MyBB (s2b@...mail.com)

August 20 (8 messages)

Re: [Fwd: anti-phishing implementation] (Bjorn Borg <bjorn.brg@...il.com>)
RE: anti-phishing implementation ("Lyal Collins" <lyal.collins@...2it.com.au>)
[USN-171-1] PHP4 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
IBM Lotus Notes multiple disclosures of password hashes ("Shalom Carmel" <shalom@...era.com>)
Woltlab Burning Board <= 2.2.2/2.3.3 modcp.php SQL injection (admin@...znet.com)
[SECURITY] [DSA 779-1] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Bugs Land Down Under v800 (bl2k@...bgard.org)
ToorCon 7 Lineup Finalized & Pre-Registration Ending ("h1kari@...rcon.org" <h1kari@...rcon.org>)

August 21 (1 message)

Re: Secunia Research: HAURI Anti-Virus Compressed Archive Directory Traversal (Andreas Marx <gega-it@....de>)

August 22 (13 messages)

Re: BBCode [IMG] [/IMG] Tag Vulnerability (Paul Laudanski <zx@...tlecops.com>)
[ Suresec Advisories ] - Several MacOS X vulnerabilities (Suresec Advisories <advisories@...esec.org>)
Nephp Publisher Enterprise 3.04 Cross Site Scripting (bl2k@...bgard.org)
SUSE Security Announcement: Adobe Reader Plugin buffer overflow (SUSE-SA:2005:047) (Marcus Meissner <meissner@...e.de>)
ELM < 2.5.8 Remote Exploit POC (c0ntexb@...il.com)
Cisco Security Advisory: SSL Certificate Validation Vulnerability in IDS Management Software (Cisco Systems Product Security Incident Response Team <psirt@...co…)
RE: Cisco Clean Access Agent (Perfigo) bypass ("Dario Ciccarone (dciccaro)" <dciccaro@...co.com>)
DMA[2005-0818a] - 'Apple OSX dsidentity privilege abuse' ("KF (lists)" <kf_lists@...italmunition.com>)
Cisco Security Advisory: Cisco Intrusion Prevention System Vulnerable to Privilege Escalation (Cisco Systems Product Security Incident Response Team <psirt@...c…)
RE: Cisco Clean Access Agent (Perfigo) bypass ("Dario Ciccarone (dciccaro)" <dciccaro@...co.com>)
SQL Injection and PHP Code Injection Vulnerabilities in PHPKit 1.6.1 (phuket <phuket.bugtraq@...il.com>)
[SECURITYREASON.COM] Multiple vulnerabilities in PostNuke 0.760-RC4b=>x cXIb8O3.15 (max@...tsuper.pl)
Remote IIS 5.x and IIS 6.0 Server Name Spoof (inge_eivind.henriksen@...llo.no)

August 23 (16 messages)

Re: RE: Cisco Clean Access Agent (Perfigo) bypass (cdmiller-bugtraq@...ms.edu)
32919 - Computer Associates Message Queuing (CAM/CAFT) multiple vulnerabilities ("Williams, James K" <James.Williams@...com>)
[ GLSA 200508-12 ] Evolution: Format string vulnerabilities (Stefan Cornelius <dercorny@...too.org>)
[ GLSA 200508-12 ] Evolution: Format string vulnerabilities (Stefan Cornelius <dercorny@...too.org>)
Re: Remote IIS 5.x and IIS 6.0 Server Name Spoof (3APA3A <3APA3A@...URITY.NNOV.RU>)
[USN-172-1] lm-sensors vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-173-1] PCRE vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 781-1] New Mozilla Thunderbird packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 782-1] New bluez-utils packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
MDKSA-2005:145 - Updated openvpn packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
Server crash in Ventrilo 2.3.0 (Luigi Auriemma <aluigi@...istici.org>)
MDKSA-2005:146 - Updated php-pear packages fix more PEAR XML-RPC vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:148 - Updated vim packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Re: ELM < 2.5.8 Remote Exploit POC (skulls_phantoms_1@...urityfocus.com)
Oracle Password Checker (ak@...-database-security.com)
[ GLSA 200508-12 ] Evolution: Format string vulnerabilities (Stefan Cornelius <dercorny@...too.org>)

August 24 (22 messages)

Mercora IMRadio 4.0.0.0 Discloses Passwords to Local Users (kozan@...instructors.com)
ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users (kozan@...instructors.com)
Re: Interspire ArticleLive 2005 (php version) is vulnerable to XSS (eddie@...erspire.com)
MDKSA-2005:147 - Updated slocate packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
[ GLSA 200508-13 ] PEAR XML-RPC, phpxmlrpc: New PHP script injection vulnerability (Thierry Carrez <koon@...too.org>)
LeapFTP .lsq Buffer Overflow Vulnerability ("Sowhat ." <smaillist@...il.com>)
Secunia Research: HAURI Anti-Virus ACE Archive Handling Buffer Overflow (Secunia Research <vuln@...unia.com>)
Secunia Research: SqWebMail Attached File Script Insertion Vulnerability (Secunia Research <vuln@...unia.com>)
(no subject) ("Donato Ferrante" <fdonato@...istici.org>)
[USN-173-2] PCRE vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[RLSA_01-2005] QNX inputtrap arbitrary file read vulnerability (julio@...slabs.com.br)
New Whitepaper - The Pharming Guide (NGSSoftware Insight Security Research <nisr@...tgenss.com>)
Cross-site scripting vulnerability in BEA WebLogic administration console (GomoR <bugtraq@...or.org>)
PaFileDB 3.1 - SQL-Injection (astovidatu@...urity-project.org)
Re: Beehive Forum Multiple Vulnerabilities (wibble@...ble.securityfocus.com)
[SECURITY] [DSA 783-1] New mysql packages fix insecure temporary file (joey@...odrom.org (Martin Schulze))
Foojan PHP Weblog Information Disclosure - Refferer Html Injection (ali202@...termail.com)
Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users (Allen Parker <infowolfe@...il.com>)
RE: Remote IIS 5.x and IIS 6.0 Server Name Spoof ("Sacha Faust" <sfaust@...dynamics.com>)
Re: LeapFTP .lsq Buffer Overflow Vulnerability (Kaveh Razavi <c0d3rz_team@...oo.com>)
[ GLSA 200508-14 ] TikiWiki, eGroupWare: Arbitrary command execution through XML-RPC (Thierry Carrez <koon@...too.org>)
unload event in ie/mozilla/opera (Tobias Boonstoppel <boonstoppel@...il.com>)

August 25 (22 messages)

RE: unload event in ie/mozilla/opera ("David Gillett" <gillettdavid@...a.edu>)
Re: Mercora IMRadio 4.0.0.0 Discloses Passwords to Local Users (3APA3A <3APA3A@...URITY.NNOV.RU>)
[ GLSA 200508-15 ] Apache 2.0: Denial of Service vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200508-16 ] Tor: Information disclosure (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: LeapFTP .lsq Buffer Overflow Vulnerability (Damien Palmer <alacrity@...il.com>)
Advisory: iTAN not as secure as claimed (release@...team-pentesting.de)
MS05_039 Exploitation (different languages) (Roman Medina-Heigl Hernandez <roman@...labs.com>)
Re: unload event in ie/mozilla/opera (Drew Haven <drew.haven@...il.com>)
[SECURITY] [DSA 784-1] New courier packages fix denial of service (joey@...odrom.org (Martin Schulze))
Portcullis Security Advisory 05-014 HP Openview Remote Command Execution Vulnerability ("Paul J Docherty" <PJD@...tcullis-security.com>)
[ GLSA 200508-17 ] libpcre: Heap integer overflow (Stefan Cornelius <dercorny@...too.org>)
[SECURITY] [DSA 785-1] New libpam-ldap packages fix authentication bypass (joey@...odrom.org (Martin Schulze))
[security bulletin] SSRT4702 rev.0 - HP-UX running Veritas 3.3/3.5 unauthorized data access ("Boren, Rich (HP SSRT)" <rich.boren@...com>)
Re: Portcullis Security Advisory 05-014 HP Openview Remote Command Execution Vulnerability ("David Litchfield" <davidl@...software.com>)
Re: LeapFTP .lsq Buffer Overflow Vulnerability (Kaveh Razavi <c0d3rz_team@...oo.com>)
Tool for Identifying Rogue Linksys Routers (Martin Mkrtchian <dotsecure@...il.com>)
Quake 2 Lithium Mod V 1.24 Macro Expansion Vuln? (nukemmeister@...il.com)
An Illustrated Guide to IPSec (Steve Friedl <steve@...xwiz.net>)
Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users (Nick Boyce <nick.boyce@...il.com>)
RE: unload event in ie/mozilla/opera ("Early, Clint" <clint.early@....com>)
Re: MS05_039 Exploitation (different languages) (<ad@...ss101.org>)
Re: [NOBYTES.COM: #8] Naxtor Shopping Cart 1.0 - Information Disclosure & Possible SQL Injection (devfreedom@...il.com)

August 26 (15 messages)

ssl-login-checkbox faked in Lycos webmail-frontend ("Fischer, Andreas" <Andreas.Fischer@...ystems.com>)
Re: unload event in ie/mozilla/opera ("Stefan Kelm" <stefan.kelm@...orvo.de>)
Tool Announcement: AIRT -- the Advanced Incident Response Tool 0.4.2 released ("madsys" <admin@...ist.iscas.ac.cn>)
Re: unload event in ie/mozilla/opera (Niels Bakker <niels-bugtraq@...ker.net>)
Re: unload event in ie/mozilla/opera (Tobias Boonstoppel <boonstoppel@...il.com>)
Astaro Security Linux 6.0 - HTTP CONNECT Access Localhost Weakness (oliver karow <oliver.karow@....de>)
CORRECTION: Remote IIS 5.x and IIS 6.0 Server Name Spoof (Mark Burnett <mb@...o.net>)
Simple PHP Blog File Upload and User Credentials Exposure Vulnerabilities (Scott Dewey <wr0ck@...crew.net>)
[ GLSA 200508-18 ] PhpWiki: Arbitrary command execution through XML-RPC (Thierry Carrez <koon@...too.org>)
Re: MS05_039 Exploitation (different languages) (Sanjay Rawat <sanjayr@...oto.com>)
Sophos Antivirus Library Remote Heap Overflow (list@...0te.com)
Re: MS05_039 Exploitation (different languages) (Roman Medina-Heigl Hernandez <roman@...labs.com>)
[USN-174-1] courier vulnerability (Martin Pitt <martin.pitt@...onical.com>)
22nd Chaos Communication Congress 2005: Call for Papers (fukami <fukami@...lin.ccc.de>)
Re: Tool for Identifying Rogue Linksys Routers (Mike Frantzen <frantzen@....com>)

August 27 (30 messages)

RE: Tool for Identifying Rogue Linksys Routers ("Thomas Guyot-Sionnest" <Thomas@...go.com>)
Re: unload event in ie/mozilla/opera (Godwin Stewart <gstewart@...mcop.net>)
Re: MS05_039 Exploitation (different languages) (Fabrice MOURRON <fmourron@...probe.com>)
Re: Tool for Identifying Rogue Linksys Routers (Joshua Wright <jwright@...borg.com>)
[SECURITY] [DSA 787-1] New backup-manager package fixes several vulnerabilities (joey@...odrom.org (Martin Schulze))
MDKSA-2005:152 - Updated php packages fix integer overflow vulnerability (Mandriva Security Team <security@...driva.com>)
Re: Tool for Identifying Rogue Linksys Routers (Graham Wilson <graham@...od.org>)
RE: Tool for Identifying Rogue Linksys Routers ("Matt Mercer" <MattM@...amidcorporation.com>)
Re: [ GLSA 200508-14 ] TikiWiki, eGroupWare: Arbitrary command execution through XML-RPC (Cangrejito Playero <cangrejitoplayero@...il.com>)
AWstats Path Disclosure Vulnerability (fournaux@...erdev.com)
[security bulletin] SSRT051023 rev.0 - HP Openview Network Node Manager (OV NNM) Remote Unauthorized Access ("Boren, Rich (HP SSRT)" <rich.boren@...com>)
MDKSA-2005:150 - Updated bluez-utils packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:151 - Updated pcre packages fix integer overflow vulnerability (Mandriva Security Team <security@...driva.com>)
Re: unload event in ie/mozilla/opera (Michael Shigorin <mike@...n.org.ua>)
Multiple PHP Images Galleries EXIF Metadata XSS Vulnerabilities (Cedric Cochin <cedric.cochin@...il.com>)
[SECURITY] [DSA 786-1] New simpleproxy packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
DMA[2005-0826a] - 'Nokia Affix Bluetooth btsrv poor use of popen()' ("KF (lists)" <kf_lists@...italmunition.com>)
MDKSA-2005:149 - Updated lm_sensors packages fix temporary file vulnerability (Mandriva Security Team <security@...driva.com>)
Re: Tool for Identifying Rogue Linksys Routers (Dave Hull <ireadit@...il.com>)
RE: Sophos Antivirus Library Remote Heap Overflow ("Dowling, Gabrielle" <dowlingg@...lcrom.com>)
Looking Glass v20040427 arbitrary commands execution / cross site scripting (retrogod@...ceposta.it)
Re: Tool for Identifying Rogue Linksys Routers ("Paul" <pvnick@...il.com>)
Re: Tool for Identifying Rogue Linksys Routers (Volker Tanger <vtlists@...e.de>)
MDKSA-2005:154 - Updated python packages fix integer overflow vulnerability (Mandriva Security Team <security@...driva.com>)
Re: Tool for Identifying Rogue Linksys Routers (Mike Kershaw <dragorn@...metwireless.net>)
MDKSA-2005:153 - Updated gnumeric packages fix integer overflow vulnerability (Mandriva Security Team <security@...driva.com>)
XSS security hole in phpwebnotes. (nf2 <nf2@...einwelt.at>)
Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users (Nicholas Knight <nknight@...awaynet.com>)
Re: Tool for Identifying Rogue Linksys Routers (Paul Halliday <paul.halliday@...il.com>)
Re: Tool for Identifying Rogue Linksys Routers (Tony Rall <trall@...aden.ibm.com>)

August 28 (1 message)

Re: Sophos Antivirus Library Remote Heap Overflow (list@...0te.com)

August 29 (20 messages)

Xcon2005 papers released (alert7 <alert7@...cus.org>)
Secunia Research: SqWebMail HTML Emails Script Insertion Vulnerability (Secunia Research <vuln@...unia.com>)
Multiple CMS/Forum Vulnablilties ("pacifico\", 0] //--></script>a" <jbiaso@...il.com>)
PHP-Fusion <= v6.00.107 XSS exploit (slacker4ever_1@...o.com)
FUD Forum < 2.7.1 PHP code injection vurnelability (riklaunim@...il.com)
Land Down Under (bendeniz_avci@...mail.com)
Multiple vulnerabilities in BFCommand & Control for Battlefield 1942 and Vietnam (Luigi Auriemma <aluigi@...istici.org>)
[cosmoshop <= 8.10.78] be the shopadmin in one step (innate@....de)
[SECURITY] [DSA 788-1] New kismet packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Land Down Under 801 And Prior Multiple SQL Injection Vulnerabilities (h4cky0u.org@...il.com)
SimplePHPBlog Arbitrary File Deletion and Sample Exploit ("'ken'@FTU" <ken@...security.com>)
Re: unload event in ie/mozilla/opera (gegegz@....com)
Vulnerability in Helpdesk software Hesk 0.92 (s2b@...mail.com)
WASC-Articles: 'Preventing Log Evasion in IIS' (contact@...appsec.org)
PunBB BBCode IMG Tag Script Injection Vulnerability (y3dips@...o.or.id)
iDEFENSE Security Advisory 08.29.05: Adobe Version Cue VCNative Arbitrary Library Loading Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 08.29.05: Adobe Version Cue VCNative Arbitrary File Overwrite Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
iDEFENSE Security Advisory 08.29.05: Symantec AntiVirus 9 Corporate Edition Local Privilege Escalation Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.…)
Member.php SQL Injection in MyBB (W7ED@...MAIL.COM)
[SECURITY] [DSA 789-1] New PHP 4 packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))

August 30 (11 messages)

AutoLinks Pro 2.1 (none@...e.com)
BNBT EasyTracker Remote Denial of Service Vulnerability ("Sowhat ." <smaillist@...il.com>)
[USN-173-3] Fixed apache2 packages for USN-173-2 (Martin Pitt <martin.pitt@...onical.com>)
e107 0.6 forum_post.php create new topics in non-existing forums (Marc Ruef <marc.ruef@...putec.ch>)
[UNTRUE] Gadu-Gadu supposedly fixed the invisible detection vulnerability? (Maciej Soltysiak <maciej@...tysiak.com>)
[ GLSA 200508-19 ] lm_sensors: Insecure temporary file creation (Thierry Carrez <koon@...too.org>)
[ GLSA 200508-20 ] phpGroupWare: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
SUSE Security Announcement: php4/php5 Pear::XML_RPC code injection and PCRE integer overflow problems (SUSE-SA:2005:049) (Marcus Meissner <meissner@...e.de>)
BNBT EasyTracker Remote Denial of Service Vulnerability ("Sowhat ." <smaillist@...il.com>)
SUSE Security Announcement: pcre integer overflows (SUSE-SA:2005:048) (Marcus Meissner <meissner@...e.de>)
phpLDAPadmin 0.9.6 - 0.9.7/alpha5 (possibly prior versions) system disclosure, (retrogod@...ceposta.it)

August 31 (28 messages)

Re: ICMP attacks against TCP: Conclusions (Dan Yefimov <dan@...htwave.net.ru>)
[SECURITY] [DSA 790-1] New phpldapadmin packages fix unauthorised access (joey@...odrom.org (Martin Schulze))
Re: PunBB BBCode IMG Tag Script Injection Vulnerability (Aaron Horst <anthrax101@...il.com>)
Fetchmail 6.2.5 exploit for Bugtraq ID: 14349 (bannedit@...ntiernet.net)
Re: Vulnerability in Helpdesk software Hesk 0.92 (not@...en.com)
[SECURITY] [DSA 791-1] New maildrop packages fix arbitrary group mail command execution (joey@...odrom.org (Martin Schulze))
MS05-042 Security Update Problems ("Andrew McCullough" <amccullough@...eus.co.uk>)
Re: Vulnerability in Helpdesk software Hesk 0.92 (Thomas Krüger <krueger@...ns.de>)
Re: BNBT EasyTracker Remote Denial of Service Vulnerability ("Sowhat ." <smaillist@...il.com>)
[USN-173-4] PCRE vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Re: Tool for Identifying Rogue Linksys Routers (Gregory Boyce <gboyce@...belly.com>)
[ GLSA 200508-21 ] phpWebSite: Arbitrary command execution through XML-RPC and SQL injection (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200508-22 ] pam_ldap: Authentication bypass vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Call for new mailing lists @ SecurityFocus (Alfred Huger <ah@...urityfocus.com>)
secure client-side platform (<liudieyu@...rella.name>)
[security bulletin] SSRT051004 rev.0 - HP-UX Java Runtime Environment (JRE) Untrusted Applet Elevates Privilege (security-alert@...com)
Indiatimes Messenger 6.0 Buffer Overflow (Remote) (ViPeR <viper31337@...oo.co.in>)
[security bulletin] SSRT051003 rev.0 - HP-UX Java Web Start remote unauthorized privileged access (security-alert@...com)
[SECURITY] [DSA 792-1] New pstotext packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
XSS in GreyMatter blog (poizon@...urityinfo.ru)
Obsidis #1 Call for Papers (angelo@...iello.org)
Simple Machine Forum 1-0-5 (possibly prior versions) user IP address / information disclosure (retrogod@...ceposta.it)
Re: ICMP attacks against TCP: Conclusions (Damien Miller <djm@...drot.org>)
Flatnuke 2.5.6 (possibly prior versions) Underlying system information disclosure / Administrative & users credentials disclosure (retrogod@...ceposta.it)
[0dS] vulnerability in theo's asshole (<j3d1m4st4c0d4@...hmail.com>)
RE: secure client-side platform ("Beauford, Jason" <jbeauford@...htInOnePet.com>)
CMS Made Simple <= 0.10 - PHP injection (groszynskif@...il.com)
Vulnerability in Symantec Anti Virus Corporate Edition v9.x (golovast@...il.com)

476 messages

Powered by blists - more mailing lists