bugtraq mailing list - 2006/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2006/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 1
² 2	³ 33	⁴ 23	⁵ 34	⁶ 53	⁷ 12	⁸ 2
⁹ 12	¹⁰ 40	¹¹ 25	¹² 28	¹³ 29	¹⁴ 13	¹⁵ 9
¹⁶ 23	¹⁷ 43	¹⁸ 29	¹⁹ 13	²⁰ 25	²¹ 8	²² 8
²³ 4	²⁴ 11	²⁵ 21	²⁶ 34	²⁷ 18	²⁸ 9	²⁹ 7
³⁰ 28	³¹ 21

Messages by day:

January 1 (1 message)

[xfocus-SD-060101]AIX getCommand&getShell two vulnerabilities (XFOCUS Security Team <security@...cus.org>)

January 2 (2 messages)

[USN-233-1] fetchmail vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-234-1] cpio vulnerability (Martin Pitt <martin.pitt@...onical.com>)

January 3 (33 messages)

WMF round-up, updates and de-mystification (Gadi Evron <ge@...uxbox.org>)
Re: WMF round-up, updates and de-mystification (Nancy Kramer <nekramer@...dtheater.net>)
Re: WMF round-up, updates and de-mystification (InfoSecBOFH <infosecbofh@...il.com>)
Re: WMF round-up, updates and de-mystification (InfoSecBOFH <infosecbofh@...il.com>)
[ GLSA 200601-01 ] pinentry: Local privilege escalation (Thierry Carrez <koon@...too.org>)
RE: WMF round-up, updates and de-mystification ("Peter Ferrie" <pferrie@...antec.com>)
Re: WMF round-up, updates and de-mystification (gat0r <gat0r@...ghguy.net>)
Re: WMF Exploit (Justin Myers <masterbofh@...il.com>)
[KAPDA::#19] - Html Injection in vBulletin 3.5.2 (alireza hassani <trueend5@...oo.com>)
Re: RE: WMF Exploit (grasshopa@...urityfocus.com, at@...urityfocus.com, gmail@...urityfocus.com, com@...urityfocus.com)
Re: WMF Exploit (Frank Knobbe <frank@...bbe.us>)
[eVuln] PHPjournaler SQL Injection Vulnerability (alex@...ln.com)
[eVuln] Chipmunk Guestbook XSS Vulnerability (alex@...ln.com)
[eVuln] Chimera Web Portal System Multiple Vulnerabilities (alex@...ln.com)
NicoFTP Stack Overflow (k4p0k4p0@...mail.com)
[eVuln] inTouch Authentication Bypass (alex@...ln.com)
Drupal all versiyon xss cehennem.org (liz0@...mail.com)
[eVuln] B-net Software Multiple XSS Vulnerabilities (alex@...ln.com)
[eVuln] ScozBook "adminname" Authentication Bypass (alex@...ln.com)
SCO Openserver 5.0.x exploit ("rod hedor" <rodhedor@...mail.com>)
[eVuln] oaBoard PHP Code Execution (alex@...ln.com)
RE: Webwasher CSM Appliance Script Security Restriction Bypass ("Frank Berzau" <frank@...erguard.com>)
[eVuln] VEGO Web Forum SQL Injection Vulnerability (alex@...ln.com)
Winrar 3.30 Local Buffer Overflow (Alpha_Programmer@...uxMail.ORG)
Re: Drupal all versiyon xss cehennem.org (RSnake <rsnake@...cking.com>)
Re: Drupal all versiyon xss cehennem.org (security@...pal.org)
WMF SETABORTPROC exploit (SanjayR <sanjayr@...oto.com>)
RE: WMF Exploit ("Paul" <pvnick@...il.com>)
Re: [funsec] WMF round-up, updates and de-mystification (Pierre Vandevenne <pierre@...arescue.com>)
RE: [Full-disclosure] WMF round-up, updates and de-mystification ("Larry Seltzer" <larry@...ryseltzer.com>)
RE: WMF round-up, updates and de-mystification ("Krpata, Tyler" <tkrpata@....com>)
[eVuln] VEGO Links Builder Authentication Bypass (alex@...ln.com)
Re: WMF round-up, updates and de-mystification (Gadi Evron <gevron@...il.com>)

January 4 (23 messages)

RE: [funsec] WMF round-up, updates and de-mystification ("Larry Seltzer" <larry@...ryseltzer.com>)
RE: Buffer Overflow vulnerability in WindowsDisplay Manager [Suspected] ("Paul" <pvnick@...il.com>)
Recruitment Software allows MySQL credentials disclosure (Rafael San Miguel Carrasco <smcsoc@...oo.es>)
[eVuln] phpBook PHP Code Execution (alex@...ln.com)
WSJ: The new "metasploit" computer virus ("Richard M. Smith" <rms@...puterbytesman.com>)
[eVuln] PHPenpals SQL Injection Vulnerabilit (alex@...ln.com)
Re: WMF round-up, updates and de-mystification (Adam Shostack <adam@...eport.org>)
[KDE Security Advisory] UPDATE: kpdf/xpdf multiple integer overflows (Dirk Mueller <mueller@....org>)
Rockliffe Directory Transversal Vulnerability (Josh Zlatin <jzlatin@...at.cc>)
Rockliffe Mailsite User Enumeration Flaw (Josh Zlatin <jzlatin@...at.cc>)
Re: Rockliffe Directory Transversal Vulnerability (Stan Bubrouski <stan.bubrouski@...il.com>)
Re: WMF SETABORTPROC exploit (Alexander Sotirov <asotirov@...ermina.com>)
WMF exploit (Andreas Marx <gega-it@....de>)
Another WMF exploit workaround (Ivan Arce <ivan.arce@...esecurity.com>)
Download Accelerator Plus can be tricked to download malicious file (visitbipin@...mail.com)
Re[2]: Rockliffe Directory Transversal Vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
RE: WMF round-up, updates and de-mystification (Brance Amussen <brance@....edu>)
[eVuln] Lizard Cart CMS SQL Injection Vulnerability (alex@...ln.com)
RE: WMF round-up, updates and de-mystification (Mario Contestabile <marioc@...puter.org>)
RE: RE: WMF round-up, updates and de-mystification ("Krpata, Tyler" <tkrpata@....com>)
Re: WMF Exploit (Paul Laudanski <zx@...tlecops.com>)
[ GLSA 200601-02 ] KPdf, KWord: Multiple overflows in included Xpdf code (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: WMF round-up, updates and de-mystification ("Crist J. Clark" <cristjc@...cast.net>)

January 5 (34 messages)

New from the MS Advisory ("Larry Seltzer" <larry@...ryseltzer.com>)
Re[2]: [funsec] WMF round-up, updates and de-mystification (Pierre Vandevenne <pierre@...arescue.com>)
Windows PHP 4.x "0-day" buffer overflow (<mercenary@...hmail.com>)
Dumb IE6/XP denial of service found on the web (8ux1fpd02@...akemail.com)
HylaFAX Security advisory - fixed in HylaFAX 4.2.4 (Aidan Van Dyk <aidan@...x.com>)
Re: Cisco PIX / CS ACS: Downloadable RADIUS ACLs vulnerability ("Eloy A. Paris" <elparis@...co.com>)
MDKSA-2005:239 - Updated printer-filters-utils packages fix local vulnerability (Mandriva Security Team <security@...driva.com>)
RE: WMF Exploit ("Discussion Lists" <discussions@...raphico.com>)
Re: WMF browser-ish exploit vectors (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Re: WTF?? (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Mapping and Remote manipulation of databases (Gandalf The White <gandalf@...ital.net>)
WMF: New Metasploit Framework Module (H D Moore <sflist@...italoffense.net>)
Re: WTF?? (anthony.aykut@...me4.com)
Re: WMF round-up, updates and de-mystification (InfoSecBOFH <infosecbofh@...il.com>)
Re: [funsec] WMF round-up, updates and de-mystification (InfoSecBOFH <infosecbofh@...il.com>)
Re: Re: WMF round-up, updates and de-mystification (InfoSecBOFH <infosecbofh@...il.com>)
Re: RE: WMF round-up, updates and de-mystification (InfoSecBOFH <infosecbofh@...il.com>)
Re: Re[2]: [funsec] WMF round-up, updates and de-mystification (InfoSecBOFH <infosecbofh@...il.com>)
Re: WMF browser-ish exploit vectors ("Dave Korn" <davek_throwaway@...mail.com>)
Open Letter on the Interpretation of "Vulnerability Statistics" ("Steven M. Christey" <coley@...re.org>)
Re: WMF Exploit (Joshua <joshua.broussard@...il.com>)
Re: Rockliffe Directory Transversal Vulnerability (Josh Zlatin <jzlatin@...at.cc>)
[USN-235-1] sudo vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-236-1] xpdf vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
RE: Download Accelerator Plus can be tricked to download malicious file ("NaPa" <napa@...uritynation.com>)
RE: Download Accelerator Plus can be tricked to download malicious file ("NaPa" <napa@...uritynation.com>)
MS Patch Release for WMF Issue (<Geoff.Shatz@...elps.com>)
Re: MS Patch Release for WMF Issue (Stan Bubrouski <stan.bubrouski@...il.com>)
Re: RE: Download Accelerator Plus can be tricked to download malicious file (Bipin Gautam <gautam.bipin@...il.com>)
iDefense Security Advisory 01.05.06: Blue Coat WinProxy Remote DoS Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 01.05.06: Blue Coat Systems WinProxy Host Header Stack Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.…)
iDefense Security Advisory 01.05.06: Blue Coat WinProxy Telnet DoS Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
what we REALLY learned from WMF (Gadi Evron <ge@...uxbox.org>)
WMF Exploit Patch Released (Matthew Schiros <schiros@...il.com>)

January 6 (53 messages)

MD:Pro - Malware Distribution Project (anthony.aykut@...me4.com)
[ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1 (eufrato@...il.com)
Re: WMF round-up, updates and de-mystification ("Anthony R. Nemmer" <intertwingled@...st.net>)
Mozilla Firefox image Buffer Overflow Vulnerability (zeus olimpusklan <zeus.olimpusklan@...il.com>)
so, who is going to bindiff the WMF patch first? Already done (Gadi Evron <ge@...uxbox.org>)
RE: Dumb IE6/XP denial of service found on the web (Mario Contestabile <marioc@...puter.org>)
Re: what we REALLY learned from WMF (Gadi Evron <ge@...uxbox.org>)
CyberShop User Login Sql Injection (night_warrior771@...mail.com)
Re: what we REALLY learned from WMF (Gadi Evron <ge@...uxbox.org>)
Re: what we REALLY learned from WMF ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
Re: what we REALLY learned from WMF (Gadi Evron <ge@...uxbox.org>)
RE: what we REALLY learned from WMF ("Adrian Marsden" <amarsden@...det.org>)
Re: what we REALLY learned from WMF ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
What is sbininitd port 65534 ??? (waltdnes@...tdnes.org)
Re: WMF round-up, updates and de-mystification (Scott Renna <srenna@...securitygroup.com>)
[eVuln] TinyPHPForum Multiple Vulnerabilities (alex@...ln.com)
Re: what we REALLY learned from WMF ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
HylaFAX Security advisory - fixed in HylaFAX 4.2.4 (Aidan Van Dyk <aidan@...x.com>)
Contact information for Symantec Vulnerability Management (secure@...antec.com)
RE: Download Accelerator Plus can be tricked to download malicious file ("NaPa" <napa@...uritynation.com>)
Uninformed Journal Release Announcement: Volume 3 (Uninformed <sflist@...italoffense.net>)
Re: Download Accelerator Plus can be tricked to download malicious file (visitbipin@...mail.com)
Interview: Ilfak Guilfanov (Matthew Murphy <mattmurphy@...rr.com>)
RE: what we REALLY learned from WMF ("Donald N Kenepp" <don@...eon-central.com>)
MS released a patch today - MS06-001 ("Duran, Jason IT0" <jason.duran@....sk.ca>)
RE: WMF browser-ish exploit vectors ("James C Slora Jr" <Jim.Slora@...a.com>)
[eVuln] ADNForum Multiple Vulnerabilities (alex@...ln.com)
Re: New from the MS Advisory (Damaged Industries <damaged@...aged.no-ip.com>)
[USN-237-1] nbd vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-238-1] Blender vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-238-2] Blender vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: [USN-237-1] nbd vulnerability (Florian Weimer <fw@...eb.enyo.de>)
Re: what we REALLY learned from WMF (Florian Weimer <fw@...eb.enyo.de>)
Re: what we REALLY learned from WMF (Gadi Evron <ge@...uxbox.org>)
[ GLSA 200601-03 ] HylaFAX: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
APPLE-SA-2006-01-05 AirPort firmware update (<noreply@...urityfocus.com>)
RE: what we REALLY learned from WMF ("Adrian Marsden" <amarsden@...det.org>)
RE: what we REALLY learned from WMF ("Adrian Marsden" <amarsden@...det.org>)
Re: what we REALLY learned from WMF (Matt.Carpenter@...icor.com)
Re: what we REALLY learned from WMF (Gavin Conway <gavin@...olutions.co.uk>)
[security bulletin] SSRT051074 rev.3 - HP-UX Running xterm Local Unauthorized Access (security-alert@...com)
Re: Re: what we REALLY learned from WMF (Devdas Bhagat <devdas@....homelinux.org>)
MD5s of Unofficial patches and other mistakes ("Forrest J. Cavalier III" <mibsoft@...software.com>)
[eVuln] TheWebForum Script Insertion and Authentication Bypass (alex@...ln.com)
Re: MS released a patch today - MS06-001 ("Anthony R. Nemmer" <intertwingled@...st.net>)
Re: what we REALLY learned from WMF ("Dave Korn" <davek_throwaway@...mail.com>)
SimpBook "message" Remote Cross-Site Scripting Vulnerability (zeus olimpusklan <zeus.olimpusklan@...il.com>)
MDKSA-2006:006 - Updated gpdf packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
Did MS pull an Ilfak? (MS patch bindiff results) (Gadi Evron <ge@...uxbox.org>)
MDKSA-2006:004 - Updated pdftohtml packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: Download Accelerator Plus can be tricked to download malicious file ("Dave Korn" <davek_throwaway@...mail.com>)
MDKSA-2006:007 - Updated apache2 packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: what we REALLY learned from WMF ("Thor (Hammer of God)" <thor@...merofgod.com>)

January 7 (12 messages)

[eVuln] Proyecto Domus 'email' XSS Vulnerability (alex@...ln.com)
Re: Dumb IE6/XP denial of service found on the web (Kim Christensen <kim.christensen@...il.com>)
MDKSA-2006:003 - Updated poppler packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
SysCP WebFTP local file inclusion vulnerability (Thomas Henlich <thomas@...lich.de>)
MDKSA-2006:005 - Updated xpdf packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
Re: Dumb IE6/XP denial of service found on the web (Francois Labreque <flabreq@...ibm.com>)
Re: Re: what we REALLY learned from WMF ("dudevanwinkle@...il.com" <dudevanwinkle@...il.com>)
Re: MD:Pro - Malware Distribution Project (Rembrandt <rembrandt@...erlin.de>)
RE: Windows PHP 4.x "0-day" buffer overflow (LE Backup <lucretias@...w.ca>)
[ GLSA 200601-04 ] VMware Workstation: Vulnerability in NAT networking (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: Interview: Ilfak Guilfanov (merlyn@...nehenge.com (Randal L. Schwartz))
[eVuln] NavBoard BBcode XSS Vulnerability (alex@...ln.com)

January 8 (2 messages)

Survey on Vuln Disclosure: Request for Participation (Richard Forno <rforno@...owarrior.org>)
Recon2006 - Call for papers (Hugo Fortier <hfortier@...on.cx>)

January 9 (12 messages)

[USN-239-1] libapache2-mod-auth-pgsql vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-236-2] xpdf vulnerabilities in kword, kpdf (Martin Pitt <martin.pitt@...onical.com>)
[USN-235-2] sudo vulnerability (Martin Pitt <martin.pitt@...onical.com>)
xorg server 6.8.2 and below on 64bit arch (serj@...na.net)
Microsoft Windows GRE WMF Format Multiple Memory Overrun Vulnerabilities (frankruder@...mail.com)
[UPDATE]Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities (frankruder@...mail.com)
[SECURITY] [DSA 929-1] New petris packages fix buffer overflow (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 931-1] New xpdf packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[eVuln] Venom Board SQL Injection Vulnerability (alex@...ln.com)
iDefense Security Advisory 01.09.06: Multiple Vendor mod_auth_pgsql Format String Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
NetBSD Security Advisory 2006-001: Kernfs kernel memory disclosure (NetBSD Security Officer <security-officer@...BSD.org>)

January 10 (40 messages)

Re: Did MS pull an Ilfak? (MS patch bindiff results) (Brett Glass <brett@...iat.org>)
AOL Multiple Cross Site Scripting Vulnerability (simo@...x.org)
MDKSA-2006:008 - Updated koffice packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
MDKSA-2006:004 - Updated pdftohtml packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
Html_Injection in vBulletin 3.5.2 (the_bekir@...sak.com)
AIM Multiple Cross Site Scripting Vulnerability (simo@...x.org)
Orjinweb E-commerce (serxwebun@...uxmail.org)
Php-Nuke Pool and News Module IMG Tag Cross Site (night_warrior771@...mail.com)
Re: Interview: Ilfak Guilfanov (Denis Jedig <seclists@...eticon.de>)
Xoops Pool Module IMG Tag Cross Site Scripting (night_warrior771@...mail.com)
[eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS) (alex@...ln.com)
[FLSA-2006:136323] Updated gettext package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:152803] Updated lesstif packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:152907] Updated htdig packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:152922] Updated ethereal packages fix security issues (fedora-legacy-announce@...hat.com)
[FLSA-2006:168375] Updated mozilla packages fix security issues (fedora-legacy-announce@...hat.com)
MDKSA-2006:009 - Updated apache2-mod_auth_pgsql packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
MDKSA-2006:005 - Updated xpdf packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
MDKSA-2006:006 - Updated gpdf packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
MDKSA-2006:008 - Updated koffice packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
NetBSD Security Advisory 2006-002: settimeofday() time wrap (NetBSD Security Officer <security-officer@...BSD.org>)
MDKSA-2006:003 - Updated poppler packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
[SECURITY] [DSA 932-1] New kpdf packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Research: Malware Action Detection and Protection ("Arman Nayyeri" <arman-n@...eaker.net>)
industry standards - current status [was: what we REALLY learned from WMF] (Gadi Evron <ge@...uxbox.org>)
iDefense Security Advisory 01.10.06: Sun Solaris uustat Buffer Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
[SECURITY] [DSA 933-1] New hylafax packages fix arbitrary command execution (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 934-1] New pound packages fix multiple vulnerabilities (Michael Stone <mstone@...cker.debian.org>)
Re: Html_Injection in vBulletin 3.5.2 ("Steven M. Christey" <coley@...re.org>)
[SECURITY] [DSA 930-2] New smstools packages fix format string vulnerability (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 935-1] New libapache2-mod-auth-pgsql packages fix arbitrary code execution (Michael Stone <mstone@...cker.debian.org>)
Multiple Vulnerabilities in Hummingbird Collaboration (luca.carettoni@...urenetwork.it)
[security bulletin] SSRT051058 rev.1 - HP-UX Secure Shell Remote Denial of Service (DoS) (security-alert@...com)
Re: Html_Injection in vBulletin 3.5.2 (info@...er.com)
[ GLSA 200601-05 ] mod_auth_pgsql: Multiple format string vulnerabilities (Stefan Cornelius <dercorny@...too.org>)
Re: Did MS pull an Ilfak? (MS patch bindiff results) (Joe Polk <listuser.jav@...il.com>)
[EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability ("Advisories" <Advisories@...e.com>)
Time modification flaw in BSD securelevels on NetBSD and Linux (RedTeam Pentesting <release@...team-pentesting.de>)
Malware - future trends ("Dancho Danchev" <dancho.danchev@...h.com>)
[ GLSA 200601-06 ] xine-lib, FFmpeg: Heap-based buffer overflow (Stefan Cornelius <dercorny@...too.org>)

January 11 (25 messages)

[FLSA-2006:167803] Updated mysql packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Digital Armaments Security Advisory 01.09.2006: Apache auth_ldap module Multiple Format Strings Vulnerability (info@...italarmaments.com)
New PEAR / Apache2Triad Exploit (jd2k2000@...mail.com)
[eVuln] Foxrum BBCode XSS Vulnerabilty (alex@...ln.com)
Re: Dumb IE6/XP denial of service found on the web (rebornrebel@...mail.co.uk)
PayPal Phishing Site Exploits Google XSS Vulnerability (Paul Laudanski <zx@...tlecops.com>)
Re: PayPal Phishing Site Exploits Google XSS Vulnerability (Stelian Ene <stelian.ene@...adtech.com>)
Microsoft Exchange Critical Vulnerability ("NGSSoftware Insight Security Research" <mark@...software.com>)
Microsoft Outlook Critical Vulnerability ("NGSSoftware Insight Security Research" <mark@...software.com>)
[CIRT.DK] Apple QuickTime 7.0.3 and earlier - JPG/PICT Buffer Overflow ("CIRT.DK Advisory" <advisory@...t.dk>)
Re: iDefense Security Advisory 12.22.05: Linux Kernel Socket Buffer Memory Exhaustion DoS Vulnerability (Paul Starzetz <paul@...rzetz.de>)
Re: [CIRT.DK] Apple QuickTime 7.0.3 and earlier - JPG/PICT Buffer Overflow (virus@...og.org)
[USN-240-1] bogofilter vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[EEYEB-20051220] Apple QuickTime QTIF Stack Overflow ("Advisories" <Advisories@...e.com>)
[EEYEB-20051117B] Apple iTunes (QuickTime.qts) Heap Overflow ("Advisories" <Advisories@...e.com>)
[EEYEB-20051117A] Apple QuickTime STSD Atom Heap Overflow ("Advisories" <Advisories@...e.com>)
[EEYEB-20051031] Apple QuickTime Malformed GIF Heap Overflow ("Advisories" <Advisories@...e.com>)
Updated Advisories - Incorrect CVE Information ("Advisories" <Advisories@...e.com>)
Cisco Security Advisory: Default Administrative Password in Cisco Security Monitoring, Analysis and Response System (CS-… (Cisco Systems Product Security Incident…)
[RHSA-2006:0157-01] Low: struts security update for Red Hat Application Server (bugzilla@...hat.com)
RE: Did MS pull an Ilfak? (MS patch bindiff results) ("Greg Wroblewski" <Greg.Wroblewski@...rosoft.com>)
PostgreSQL security releases 8.0.6 and 8.1.2 (PostgreSQL Security <secuity@...tgresql.org>)
FreeBSD Security Advisory FreeBSD-SA-06:01.texindex [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
SUSE Security Announcement: xpdf,kpdf,gpdf,kword (SUSE-SA:2006:001) (Ludwig Nussel <ludwig.nussel@...e.de>)
eStara Softphone SIP stack Buffer Overflow Vulnerability (zwell@...u.com)

January 12 (28 messages)

Re: Did MS pull an Ilfak? (MS patch bindiff results) (Denis Jedig <seclists@...eticon.de>)
Advisory:XSS vulnerability on WebWiz Forums <= 6.34 (search_form.asp) (nukedx@...edx.com)
[eVuln] MyPhPim Arbitrary File Upload (alex@...ln.com)
FreeBSD Security Advisory FreeBSD-SA-06:01.texindex (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
MDKSA-2006:010 - Updated cups packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
Advisory: XSS attack on Superonline.com email service. (nukedx@...edx.com)
BSD Securelevels: Circumventing protection of files flagged immutable (RedTeam Pentesting <release@...team-pentesting.de>)
Re: PayPal Phishing Site Exploits Google XSS Vulnerability (Paul Laudanski <zx@...tlecops.com>)
[USN-241-1] Apache vulnerabilities (Adam Conrad <adconrad@...ntu.com>)
Session data pollution vulnerabilities in web applications (Alla Bezroutchko <alla@...nit.be>)
Re: Session data pollution vulnerabilities in web applications (Frank Knobbe <frank@...bbe.us>)
Re: Session data pollution vulnerabilities in web applications ("mailinglist mailinglist" <email-fulldisclosure@...mail.com>)
Advisory 01/2006: PHP ext/session HTTP Response Splitting Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Advisory 02/2006: PHP ext/mysqli Format String Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Re: Re: what we REALLY learned from WMF (wac <waldoalvarez00@...il.com>)
Re: Session data pollution vulnerabilities inweb applications ("Dave Korn" <davek_throwaway@...mail.com>)
H-Sphere Security Vulnerability ("M.Neset KABAKLI" <neset@...iza.com>)
Cisco Security Advisory: Access Point Memory Exhaustion from ARP Attacks (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SECURITY] [DSA 938-1] New koffice packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
EUSecWest papers and CanSecWest CFP (Dragos Ruiu <dr@....net>)
Re: Re: Session data pollution vulnerabilities inweb applications (Frank Knobbe <frank@...bbe.us>)
ZDI-06-001: Clam AntiVirus UPX Unpacking Code Execution Vulnerability (zdi-disclosures@...m.com)
[SECURITY] [DSA 903-2] New unzip packages fix unauthorised permissions modification (joey@...odrom.org (Martin Schulze))
Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability (nukedx@...edx.com)
FogBugz Cross Site Scripting Vulnerability ("M.Neset KABAKLI" <neset@...iza.com>)
[SECURITY] [DSA 937-1] New tetex-bin packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Cisco, haven't we learned anything? (technician reset) (Gadi Evron <ge@...uxbox.org>)
Multiple PHP Toolkit for PayPal Vulnerabilities ("uinC Team" <vuln@...c.ru>)

January 13 (29 messages)

Interspire TrackPoint NX XSS Vulnerability ("M.Neset KABAKLI" <neset@...iza.com>)
Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password change exploit (nukedx@...edx.com)
[eVuln] TankLogger SQL Injection Vulnerability (alex@...ln.com)
Fortinet Advisory - Apple QuickTime Player StripOffsets Improper Memory Access (secresearch@...tinet.com)
[eVuln] ACal Authentication Bypass & PHP Code Insertion (alex@...ln.com)
Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability (nukedx@...edx.com)
Fortinet Advisory - Apple QuickTime Player ImageWidth Denial of Service Vulnerability (secresearch@...tinet.com)
[eVuln] Wordcircle Authentication Bypass (alex@...ln.com)
[eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities (alex@...ln.com)
Fortinet Advisory - Apple QuickTime Player StripByteCounts Buffer Overflow Vulnerability ("Fortinet Research" <vulnmonitor@...tinet.com>)
Fortinet Advisory - Apple QuickTime Player StripOffsets Improper Memory Acces ("Fortinet Research" <vulnmonitor@...tinet.com>)
Fortinet Advisory: Apple Quick Time Player ImageWidth Denial of Service Vulnerability ("Fortinet Research" <vulnmonitor@...tinet.com>)
Fortinet Security Advisory: "Apple QuickTime Player Improper Memory Access Vulnerability" ("Fortinet Research" <vulnmonitor@...tinet.com>)
Fortinet Advisory: "Apple QuickTime Player ImageWidth Integer Overflow Vulnerability" ("Fortinet Research" <vulnmonitor@...tinet.com>)
Fortinet Advisory: Apple QuickTime Player Color Map Entry Size Buffer Overflow ("Fortinet Research" <vulnmonitor@...tinet.com>)
Fortinet Advisory - Apple QuickTime Player StripByteCounts Buffer Overflow Vulnerability (secresearch@...tinet.com)
RE: Fortinet Advisory - Apple QuickTime Player StripByteCounts Buffer Overflow Vulnerability ("Paul" <pvnick@...il.com>)
Re: industry standards - current status [was: what we REALLY learned from WMF] ("D. Hazelton" <dhazelton@...er.net>)
[ GLSA 200601-07 ] ClamAV: Remote execution of arbitrary code (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200601-08 ] Blender: Heap-based buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200601-09 ] Wine: Windows Metafile SETABORTPROC vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: Fortinet Advisory - Apple QuickTime Player StripOffsets Improper Memory Access (virus@...og.org)
RE: Fortinet Advisory - Apple QuickTime PlayerStripByteCounts Buffer Overflow Vulnerability ("Tom Ferris" <tommy@...urity-protocols.com>)
[SECURITY] [DSA 939-1] New fetchmail packages fix denial of service (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 940-1] New gpdf packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
SUSE Security Announcement: novell-nrm remote heap overflow (SUSE-SA:2006:002) (Marcus Meissner <meissner@...e.de>)
MDKSA-2006:012 - Updated kdegraphics packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
iDefense Security Advisory 01.13.06: Novell SUSE Linux Enterprise Server Remote Manager Heap Overflow ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com…)
Re: [ GLSA 200601-09 ] Wine: Windows Metafile SETABORTPROC vulnerability (Austin Murkland <amurkland@...ydion.com>)

January 14 (13 messages)

mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation (xwings@...urityfocus.com, at@...urityfocus.com, mysec@...urit…)
FreeBSD Security Advisory FreeBSD-SA-06:03.cpio (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
MDKSA-2006:011 - Updated tetex packages fix several vulnerabilities (Mandriva Security Team <xsecurity@...driva.com>)
Serial Line Sniffer 0.4.4 Buffer Overflow (Sintigan@...llcoders.com)
FreeBSD Security Advisory FreeBSD-SA-06:04.ipfw (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities (alex@...ln.com)
Helm XSS Vulnerability ("M.Neset KABAKLI" <neset@...iza.com>)
ezDatabase 2.0 and below (none@...e.com)
FullPath disclosure in Xaraya 1.0.1 (king_purba@...oo.co.uk)
[KAPDA::#21] - HomeFtp v1.1 Denial of Service (cvh@...urityfocus.com, "[a]"@securityfocus.com, kapda.ir@...urityfocus.com)
MyBB 1.0.2 SQL injection in usercp.php (addmimistrator@...il.com)
Hacking With The Google Search Engine (Paul Laudanski <zx@...tlecops.com>)
[NMRC Advisory] Microsoft Windows Wireless Exposure on Laptops (Advisories <advisories@...c.org>)

January 15 (9 messages)

FreeBSD Security Advisory FreeBSD-SA-06:02.ee (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 936-1] New libextractor packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability (Josh Zlatin <josh@...at.cc>)
WMF vulnerability was a deliberate backdoor? ("Brooks, Shane" <SBrooks@...ngelake.com>)
MyBB 1.0.2 SQL injection (addmimistrator@...il.com)
DCP Portal Cross-Site Scripting Vulnerability (night_warrior771@...mail.com)
AlstraSoft Template Seller Pro Cross-Site Scripting Vulnerability (night_warrior771@...mail.com)
[eVuln] Light Weight Calendar PHP Code Execution (alex@...ln.com)
Re: MSN Messenger Password Decrypter for WinXP/2003 (kuku@...u.com)

January 16 (23 messages)

Linksys VPN Router (BEFVP41) DoS Vulnerability (paul14075@...il.com)
DIMVA 2006 Call for Papers (thomas@...e.de (Thomas Biege))
TSLSA-2006-0002 - multi (Trustix Security Advisor <tsl@...stix.org>)
TSL-2006-0001 - postgresql (Trustix Security Advisor <tsl@...stix.org>)
DDSN CMS Admin Panel SQL Injection Vulnerability (khc@...mail.org)
[ISecAuditors Advisories] Arbitrary remote file creation in 123flashchat server (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Visual Studio Remote Code Execution (priest@...estmaster.org)
MDKSA-2006:013 - Updated kolab packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Virata-EmWeb DSL modems ("Dinos" <krasn@...balnetworks.gr>)
[USN-242-1] mailman vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-243-1] tuxpaint vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200601-10 ] Sun and Blackdown Java: Applet privilege escalation (Thierry Carrez <koon@...too.org>)
DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal' ("KF (lists)" <kf_lists@...italmunition.com>)
[SECURITY] [DSA 943-1] New Perl packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
RE: Session data pollution vulnerabilities in web applications ("Keenan Smith" <kc_smith@...rk.net>)
Re: [USN-237-1] nbd vulnerability ("Florian Weimer" <fw@...eb.enyo.de>)
Apache Geronimo 1.0 - CSS and persistent HTML-Injection vulnerabilities (oliver karow <oliver.karow@....de>)
Directory traversal in phpXplorer (Oriol Torrent <oriol.torrent@...il.com>)
[SECURITY] [DSA 941-1] New tuxpaint packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))
WehnTrust - When you have to trust Wehntrust (Thierry Zoller <Thierry@...ler.lu>)
[eVuln] Bit 5 Blog JavaScript Insertion Vulnerability (alex@...ln.com)
RE: WMF vulnerability was a deliberate backdoor? ("Alex Eckelberry" <AlexE@...belt-software.com>)
CounterPath eyeBeam Handing SIP header Vulnerabilities (zwell@...u.com)

January 17 (43 messages)

Homeftp r1.0.7 Denial of Service (cvh@...urityfocus.com, a@...urityfocus.com, kapda.ir@...urityfocus.com)
Re: WMF vulnerability was a deliberate backdoor? (Denis Jedig <seclists@...eticon.de>)
Sun Java Update Scheduler gets placed in autostart without absolute path quotes ("Paul" <pvnick@...il.com>)
Re: WMF vulnerability was a deliberate backdoor? (Steve Friedl <steve@...xwiz.net>)
iWar 0.07 PSTN auditing tool released... (Da Beave <beave@...dy.vistech.net>)
Reverse Proxy Cross Site Scripting ("Shalom Carmel" <shalom@...era.com>)
Re: [Full-disclosure] WehnTrust - When you have to trust Wehntrust (H D Moore <sflist@...italoffense.net>)
Re: MyBB 1.0.2 SQL injection in usercp.php (o.y.6@...mail.com)
[eVuln] Benders Calendar SQL Injection (alex@...ln.com)
Re: WMF vulnerability was a deliberate backdoor? (Mike Ely <me@...pehat.com>)
[eVuln] Bit 5 Blog SQL Injection & Authentication Bypass Vulnerability (alex@...ln.com)
Veritas NetBackup "Volume Manager Daemon" Module Stack Overflow - Exploit (patrickthomassen@...il.com)
Microsoft knew about the WMF flaw for years ("Richard M. Smith" <rms@...puterbytesman.com>)
Re: Linksys VPN Router (BEFVP41) DoS Vulnerability (paul14075@...il.com)
ERRATA: [ GLSA 200601-09 ] Wine: Windows Metafile SETABORTPROC vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: MSN Messenger Password Decrypter for WinXP/2003 (James_gmail-ij <ij3n0spam@...il.com>)
Re: [DCC SPAM] Hacking With The Google Search Engine (Lance James <bugtraq@...urescience.net>)
PunBB BBCode URL Tag Script Injection Vulnerability (night_warrior771@...mail.com)
RE: Hacking With The Google Search Engine ("Matt Fisher" <mfisher@...dynamics.com>)
Re: Hacking With The Google Search Engine (Jean-Jacques Halans <halans@...il.com>)
Digital Armaments Security Advisory 01.16.2006: CMU SNMP utilities snmptrad Format String Vulnerability (info@...italarmaments.com)
Announcement: The Web Application Firewall Evaluation Criteria v1 Released (contact@...appsec.org)
Re: WehnTrust - When you have to trust Wehntrust ("Dave Korn" <davek_throwaway@...mail.com>)
MDKSA-2006:014 - Updated wine packages fix WMF vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2006:015 - Updated hylafax packages fix eval injection vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2006:016 - Updated clamav packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Microsoft(R) Internet Explorer 5 & 6 Remote Denial of Service (DoS) using IMG & XML elements (inge.henriksen@...leansoft.com)
IndonesiaHack Advisory HTML injection in PHP Fusebox (king_purba@...oo.co.uk)
Reverse Engineering WMF Exploit Code (Gadi Evron <ge@...uxbox.org>)
Re: Reverse Proxy Cross Site Scripting ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
XSS in WBNews < = v1.1.0 (dragonjar@...il.com)
Re: WehnTrust - When you have to trust Wehntrust ("Dave Korn" <davek_throwaway@...mail.com>)
[SECURITY] [DSA 942-1] New albatross packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[eVuln] BlogPHP Authentication Bypass (alex@...ln.com)
[eVuln] microBlog BBCode XSS Vulnerability (alex@...ln.com)
Re: Microsoft knew about the WMF flaw for years (Gadi Evron <ge@...uxbox.org>)
Secunia Research: Mozilla Thunderbird Attachment Spoofing Vulnerability (Secunia Research <vuln@...unia.com>)
PowerPortal Cross-Site Scripting Vulnerability (night_warrior771@...mail.com)
[SECURITY] [DSA 944-1] New mantis packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Re: Veritas NetBackup "Volume Manager Daemon" Module Stack Overflow - Exploit ("Dave Korn" <davek_throwaway@...mail.com>)
[ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess() (Thierry Zoller <Thierry@...ler.lu>)
[SECURITY] [DSA 945-1] New antiword packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))
Re: Fullpath disclosure in roundcube webmail (roundcube@...il.com)

January 18 (29 messages)

White Album Sql İnjection biyosecurity.be (liz0@...mail.com)
iDefense Security Advisory 01.17.06: Cisco Systems IOS 11 Web Service CDP Status Page Code Injection Vulnerability ("labs-no-reply@...fense.com" <labs-no-repl…)
iDefense Security Advisory 01.17.06: EMC Legato Networker nsrd.exe Heap Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 01.17.06: EMC Legato Networker nsrexecd.exe Heap Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 01.17.06: EMC Legato Networker nsrd.exe DoS Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
Re: Hacking With The Google Search Engine (Ryan McGeehan <lists@...billygoatcurse.com>)
[HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1 (zinho@...kerscenter.com)
[eVuln] CaLogic Calendars Multiple XSS Vulnerabilities (alex@...ln.com)
[eVuln] microBlog SQL Injection Vulnerability (alex@...ln.com)
[USN-244-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Google's Blogger.com classic HTTP response splitting vulnerability (Meder Kydyraliev <meder@....nu>)
Cerberus FTP Server 2.32 Denial of Service (cvh@...urityfocus.com, a@...urityfocus.com, kapda.ir@...urityfocus.com)
Attacking Automatic Wireless Network Selection ("Dino A. Dai Zovi" <ddz@...asano.com>)
Oracle DBMS Access Control Bypass in Login (shulman@...erva.com)
Oracle Database 10g Rel. 2 - Event 10053 logs TDE wallet password in cleartext (ak@...-database-security.com)
Oracle Reports - Read parts of files via desname (fixed after 874 days) (ak@...-database-security.com)
Oracle Reports - Overwrite any application server file via desname (fixed after 889 days) (ak@...-database-security.com)
Oracle Critical Patch Update - January 2006 ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle Reports - Read parts of files via customize(fixed after 875 days) (ak@...-database-security.com)
Oracle Database 10g Rel. 2- Transparent Data Encryption plaintext masterkey in SGA (ak@...-database-security.com)
Phpclanwebsite BBCode IMG Tag XSS Vulnerability (night_warrior771@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.com)
Re: Linksys VPN Router (BEFVP41) DoS Vulnerability (paul14075@...il.com)
Re: PunBB BBCode URL Tag Script Injection Vulnerability (Rickard Andersson <security@...bb.org>)
[eVuln] Flog Information Disclosure Vulnerability (alex@...ln.com)
[eVuln] aoblogger Multiple Vulnerabilities (alex@...ln.com)
Cisco Security Advisory: IOS Stack Group Bidding Protocol Crafted Packet DoS (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: Directory traversal in phpXplorer (Stan Bubrouski <stan.bubrouski@...il.com>)
WEP-Client-Communication-Dumbdown (WCCD) Vulnerability (<Michael.Wade@...guson.com>)
Fortinet Advisory: BitComet URI Buffer Overflow Vulnerability ("Fortinet Research" <vulnmonitor@...tinet.com>)

January 19 (13 messages)

[eVuln] geoBlog SQL Injection Vulnerability (alex@...ln.com)
Cisco Security Advisory: Cisco Call Manager Denial of Service (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
XMB Forum HTML Code Injection (night_warrior771@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.com)
ICQ Cross Site Scripting Vulnerability (simo@...x.org)
Re: MSN Messenger Password Decrypter for WinXP/2003 ("frank boldewin" <frank.boldewin@....de>)
MyBB Signature HTML Code Injection (night_warrior771@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.com)
HITBSecConf2005 Videos Released ! (Praburaajan <prabu@...kinthebox.org>)
HITBSecConf2005 Videos Released (Praburaajan <prabu@...kinthebox.org>)
Re: [DCC SPAM] Hacking With The Google Search Engine (Paul Laudanski <zx@...tlecops.com>)
IRM 015: File system path disclosure on TYPO3 Web Content Manager ("Advisories" <advisories@...plc.com>)
Land Down Under Signature HTML Code Injection (night_warrior771@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.com)
[eVuln] WebspotBlogging Authentication Bypass Vulnerability (alex@...ln.com)
[KDE Security Advisory] kjs encodeuri/decodeuri heap overflow (Dirk Mueller <mueller@....org>)

January 20 (25 messages)

Cisco Security Advisory: Cisco Call Manager Privilege Escalation (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: Re: MSN Messenger Password Decrypter for WinXP/2003 (null@...-pwd-recovery.com)
CAID 33756 - DM Deployment Common Component Vulnerabilities ("Williams, James K" <James.Williams@...com>)
-2- [XSS] in ar-blog v 5.2 (s3ude@...mail.com)
Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager (Michael Shigorin <mike@...n.org.ua>)
Phpclanwebsite BBCode IMG Tag XSS Vulnerability (night_warrior771@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.com)
[security bulletin] SSRT5971 rev.1 - HP-UX Running ftpd Remote Denial of Service (DoS) (security-alert@...com)
Re: Directory traversal in phpXplorer (Stan Bubrouski <stan.bubrouski@...il.com>)
Critical security advisory #006 tftpd32 Format string (admin@...tical.lt)
MDKSA-2006:017 - Updated mod_auth_ldap packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
FreeBSD Security Advisory FreeBSD-SA-06:05.80211 (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Change passwd 3.1 (SquirrelMail plugin ) ("rod hedor" <rodhedor@...mail.com>)
Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT (ak@...-database-security.com)
Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT_INT (ak@...-database-security.com)
Re: Microsoft knew about the WMF flaw for years ("Steven M. Christey" <coley@...re.org>)
[USN-245-1] KDE library vulnerability (Martin Pitt <martin.pitt@...onical.com>)
phpXplorer file inclusion biyosecurity.be (liz0@...mail.com)
MDKSA-2006:018 - Updated kernel packages fix several vulnerabilities (Mandriva Security Team <security@...driva.com>)
DMA[2006-0115a] - 'AmbiCom Bluetooth Object Push Overflow' ("KF (lists)" <kf_lists@...italmunition.com>)
Claroline 1.7.2, sso identification vulnerability (karmaguedon@...mail.com)
BlogPHP config.php SQL injection login bypass (addmimistrator@...il.com)
BlogPHP config.php SQL injection login bypass (addmimistrator@...il.com)
Re: Digital Armaments Security Advisory 01.16.2006: CMU SNMP utilities snmptrad Format String Vulnerability (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 948-1] New kdelibs packages fix buffer overflow (Michael Stone <mstone@...cker.debian.org>)
SUSE Security Announcement: kdelibs3 (SUSE-SA:2006:003) (Ludwig Nussel <ludwig.nussel@...e.de>)

January 21 (8 messages)

MySQL 5.0 information leak? (Bernd Wurst <bernd@...rst.org>)
[SECURITY] [DSA 947-1] New ClamAV packages fix heap overflow (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 946-1] New sudo packages fix privilege escalation (joey@...odrom.org (Martin Schulze))
[eVuln] RCBlog Directory Traversal & Sensitive Information Disclosure (alex@...ln.com)
[eVuln] eggblog Multiple SQL Injection & XSS Vulnerabilities (alex@...ln.com)
[eVuln] SaralBlog XSS & Multiple SQL Injection Vulnerabilities (alex@...ln.com)
Re: WMF vulnerability was a deliberate backdoor? (Gadi Evron <ge@...uxbox.org>)
MyBB 1.0.2 Sniffing table perfix bug in search.php (addmimistrator@...il.com)

January 22 (8 messages)

MyBB Signature HTML Code Injection (n@...urityfocus.com)
Re: Digital Armaments Security Advisory 01.16.2006: CMU SNMP utilities snmptrad Format String Vulnerability (Stan Bubrouski <stan.bubrouski@...il.com>)
MDKSA-2006:019 - Updated kdelibs packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Tumbleweed EMF 6.x Processing Issues (jcary2543@...oo.com)
RE: MySQL 5.0 information leak? ("Burton Strauss" <Security@...llNetSolutions.com>)
BlogPHP config.php SQL injection login bypassed (addmimistrator@...il.com)
[ GLSA 200601-11 ] KDE kjs: URI heap overflow vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[SECURITY] [DSA 949-1] New crawl packages fix potential group games execution (joey@...odrom.org (Martin Schulze))

January 23 (4 messages)

CodeCon program announced, early registration deadline nearing (Len Sassaman <rabbi@...itum.com>)
Re: MySQL 5.0 information leak? (Stephen Frost <sfrost@...wman.net>)
iDefense Security Advisory 01.23.06: Computer Associates iTechnology iGateway Service Content-Length Buffer Overflow V… ("labs-no-reply@...fense.com" <labs-no-r…)
LibAST 0.7 Release Fixes Security Vulnerability (Michael Jennings <mej@...rm.org>)

January 24 (11 messages)

Urgent Alert: Possible BlackWorm DDay February 3rd (Snort signatures included) (Gadi Evron <ge@...uxbox.org>)
[USN-246-1] imagemagick vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
BlackWorm technical information (Gadi Evron <ge@...uxbox.org>)
BlackWorm naming confusing [CME entry now available] (Gadi Evron <ge@...uxbox.org>)
Re: BlackWorm naming confusing [CME entry now available] (b.hines@...cast.net)
RE: [Full-disclosure] BlackWorm naming confusing [CME entry nowavailable] (Eric Sites <erics@...belt-software.com>)
Re: Urgent Alert: Possible BlackWorm DDay February 3rd (Snort signatures included) (Dude VanWinkle <dudevanwinkle@...il.com>)
What A Click! [Internet Explorer] ("mikx" <mikx@...x.de>)
Re: Urgent Alert: Possible BlackWorm DDay February3rd (Snort signatures included) ("Exibar" <exibar@...lair.com>)
Re: Urgent Alert: Possible BlackWorm DDay February3rd (Snort signatures included) (mjcarter@...g.co.nz)
Re: Urgent Alert: Possible BlackWorm DDay February3rd (Snort signatures included) ("Exibar" <exibar@...lair.com>)

January 25 (21 messages)

[FLSA-2006:152845] Updated perl packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
High Risk Vulnerability in Red Hat Directory Server and Red Hat Certificate Server ("NGSSoftware Insight Security Research" <nisr@...software.com>)
fetchmail security announcement fetchmail-SA-2006-01 (CVE-2006-0321) (ma+bt@...e-technik.uni-dortmund.de)
[eVuln] e-moBLOG SQL Injection Vulnerability (alex@...ln.com)
[eVuln] Note-A-Day Weblog Sensitive Information Disclosure (alex@...ln.com)
Re: Announcement: The Web Application Firewall Evaluation Criteria v1 Released (Gadi Evron <ge@...uxbox.org>)
ANN: New release of CORE FORCE free endpoint security package (Core FORCE team <force@...ce.coresecurity.com>)
Call For Paper - SyScan'06 Singapore ("organiser@...can.org" <organiser@...can.org>)
Re: Announcement: The Web Application Firewall Evaluation Criteria v1 Released (ArkanoiD <ark@...ex.net>)
Re: BlackWorm naming confusing [CME entry now available] (greybrimstone@....com)
HYSA-2006-001 phpBB 2.0.19 search.php and profile.php DOS Vulnerability (h4cky0u <h4cky0u.org@...il.com>)
[SECURITY] [DSA 954-1] New wine packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 955-1] New mailman packages fix denial of service (Michael Stone <mstone@...cker.debian.org>)
Technical Note by Amit Klein: "XST Strikes Back" ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
Workaround for unpatched Oracle PLSQL Gateway flaw ("David Litchfield" <davidl@...software.com>)
[eVuln] CheesyBlog XSS Vulnerability (alex@...ln.com)
HYSA-2006-001 phpBB 2.0.19 search.php and profile.php DOS Vulnerability (h4cky0u.org@...il.com)
[SECURITY] [DSA 947-2] New clamav packages fix heap overflow (Michael Stone <mstone@...cker.debian.org>)
FreeBSD Security Advisory FreeBSD-SA-06:07.pf (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Updated ipsec-tools packages fix vulnerability (security@...driva.com)
[eVuln] ExpressionEngine 'Referer' XSS Vulnerability (alex@...ln.com)

January 26 (34 messages)

BlackWorm: 2 million infected? ISP notifications. (Gadi Evron <ge@...uxbox.org>)
Rosiello Security - Eterm-LibAST Advisory (angelo@...iello.org)
FreeBSD Security Advisory FreeBSD-SA-06:06.kmem (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: Tumbleweed EMF 6.x Processing Issues (support@...bleweed.com)
[security bulletin] SSRT061099 rev.1 - HP-UX Local Increased Privilege (security-alert@...com)
[eVuln] miniBloggie Authentication Bypass (alex@...ln.com)
[SECURITY] [DSA 953-1] New flyspray packages fix cross-site scripting (joey@...odrom.org (Martin Schulze))
[KAPDA::#25] - MyBB 1.x Cross_Site_Scripting (roozbeh_afrasiabi@...oo.com)
Newsphp Multiple SQL Injection Vulnerabilities (s3ude@...urityfocus.com, hotmail.com@...urityfocus.com (at))
[eVuln] Text Rider Sensitive Information Disclosure (alex@...ln.com)
[ GLSA 200601-12 ] Trac: Cross-site scripting vulnerability (Stefan Cornelius <dercorny@...too.org>)
Re: IndonesiaHack Advisory HTML injection in PHP Fusebox (brian428@...oo.com)
MyBB 1.0.2 XSS attack in search.php redirection (addmimistrator@...il.com)
Updated mozilla-thunderbird packages fix vulnerability (security@...driva.com)
Re: [OSVDB Mods] iNETstore E Commerce Solution - Cross Site Scripting ("iNETstore Support" <support@...tstore.com>)
[SECURITY] [DSA 956-1] New lsh-utils packages fix local vulnerabilities (joey@...odrom.org (Martin Schulze))
[security bulletin] SSRT061104 rev.1 - HP Oracle for OpenView (OfO) Critical Patch Update January 2006 (security-alert@...com)
SUSE Security Announcement: phpMyAdmin (SUSE-SA:2006:004) (Ludwig Nussel <ludwig.nussel@...e.de>)
HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities (h4cky0u.org@...il.com)
SUSE Security Announcement: nfs-server/rpc.mountd remote code execution (SUSE-SA:2006:005) (Marcus Meissner <meissner@...e.de>)
SamiFTPd buffer overflow (admin@...tical.lt)
Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[HSC] Multiple transversal bug in vis (spher3@...kerscenter.com)
[ISecAuditors Advisories] Arbitrary flash code remote execution in 123flashchat (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[eVuln] AndoNET Blog SQL Injection Vulnerability (alex@...ln.com)
[ GLSA 200601-13 ] Gallery: Cross-site scripting vulnerability (Stefan Cornelius <dercorny@...too.org>)
Windows mem leakage (endrazine@...ltheplug.org)
[eVuln] "my little homepage" products [link] BBCode XSS Vulnerability (alex@...ln.com)
[SECURITY] [DSA 957-1] New ImageMagick packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
Re: MySQL 5.0 information leak? (Lance James <bugtraq@...urescience.net>)
Buffer Overflow /Font on mIRC (Crowdat Kurobudetsu <crowdat@...il.com>)
[Argeniss] Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT} (Cesar <cesarc56@...oo.com>)
[SECURITY] [DSA 950-1] New CUPS packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: MySQL 5.0 information leak? (Johan De Meersman <jdm@...ramail.com>)

January 27 (18 messages)

[ MDKSA-2006:022 ] - Updated perl-Convert-UUlib packages fix vulnerability (security@...driva.com)
[ Rosiello Security ] Eterm-LibAST Advisory (angelo@...iello.org)
BitComet URI Proof of Concept (nick58@...il.com)
Re: [security] What A Click! [Internet Explorer] (yossarian <yossarian@...net.nl>)
RE: MySQL 5.0 information leak? ("Burton Strauss" <Security@...llNetSolutions.com>)
BlackWorm: statistics and numbers (Gadi Evron <ge@...uxbox.org>)
[SECURITY] [DSA 952-1] New libapache-auth-ldap packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
RE: [funsec] BlackWorm: statistics and numbers ("Gary Funck" <gary@...repid.com>)
Re: Urgent Alert: Possible BlackWorm DDay February 3rd (Snort signatures included) (Holger van Lengerich <bugtraq@...pam.snakeoil.de>)
hello (code.shell@...oo.com)
[ MDKSA-2006:023 ] - Updated perl-Net_SSLeay packages fix vulnerability (security@...driva.com)
[SECURITY] [DSA 958-1] New drupal packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[ MDKSA-2006:025 ] - Updated net-snmp packages fix vulnerabilities (security@...driva.com)
CAID 33778 - CA iGateway Content-Length Buffer Overflow Vulnerability [v1.1] ("Williams, James K" <James.Williams@...com>)
Shareaza P2P Remote Vulnerability (Ryan Smith <whatstheaddress@...il.com>)
[ MDKSA-2006:024 ] - Updated ImageMagick packages fix vulnerabilities (security@...driva.com)
Re: [security] What A Click! [Internet Explorer] (Lance James <lancej@...urescience.net>)
Re: [security] What A Click! [Internet Explorer] (yossarian <yossarian@...net.nl>)

January 28 (9 messages)

Re: Urgent Alert: Possible BlackWorm DDay February 3rd (Snort signatures included) (Dude VanWinkle <dudevanwinkle@...il.com>)
Re: What A Click! [Internet Explorer] (Robert Kim Wireless Internet Advisor <evdo.hsdpa@...il.com>)
Azbb v1.1.00 Cross-Site Scripting (roozbeh_afrasiabi@...oo.com)
Multiple vulnerabilities in CommuniGate Pro Server (Evgeny Legerov <research@...g.net>)
The WorldsEnd.NET - Free Ping Script, written in PHP (2 vulns) (cvh@...da.ir)
gnome evolution mail client inline text file DoS issue (Mike Davis <phar@...nedcoder.org>)
Re: Urgent Alert: Possible BlackWorm DDay February 3rd (Snort signatures included) (Charles Cala <charles_cala@...oo.com>)
Ege Internet Web Desing Remote Command Exucetion (botan@...uxmail.org)
[CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting (roozbeh_afrasiabi@...oo.com)

January 29 (7 messages)

Cross Site Cooking (Michal Zalewski <lcamtuf@...ne.ids.pl>)
[eVuln] Pixelpost Photoblog XSS Vulnerability (alex@...ln.com)
[ GLSA 200601-14 ] LibAST: Privilege escalation (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: BlackWorm naming confusing [CME entry now available] (Jose Nazario <jose@...key.org>)
Re: BlackWorm naming confusing [CME entry now available] (Gadi Evron <ge@...uxbox.org>)
[ GLSA 200601-15 ] Paros: Default administrator password (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
CAID 33778 - CA iGateway Content-Length Buffer Overflow Vulnerability ("Williams, James K" <James.Williams@...com>)

January 30 (28 messages)

[SECURITY] [DSA 951-1] New trac packages fix SQL injection and cross-site scripting (joey@...odrom.org (Martin Schulze))
Re: [ GLSA 200601-15 ] Paros: Default administrator password (Yvan Boily <yboily@...il.com>)
RE: Cross Site Cooking (Michal Zalewski <lcamtuf@...ne.ids.pl>)
zbattle.net (c_lispfedora@...oo.com)
Re: MySQL 5.0 information leak? (Duncan Simpson <dps@...pson.demon.co.uk>)
Re: Re: IndonesiaHack Advisory HTML injection in PHP Fusebox (pr1nce_empire@...oo.com)
UebiMiau Webmail System Security Vulnerability ("M.Neset KABAKLI" <neset@...iza.com>)
ashnews Cross-Site Scripting Vulnerability (zeus olimpusklan <zeus.olimpusklan@...il.com>)
TSLSA-2006-0004 - multi (Trustix Security Advisor <tsl@...stix.org>)
EasyCMS vulnerable to XSS injection. (preben@...chcom.no)
[SECURITY] [DSA 951-2] New trac packages fix SQL injection and cross-site scripting (joey@...odrom.org (Martin Schulze))
MyBB 1.2 usercp2.php [ $url ] CrossSiteScripting ( XSS ) (o.y.6@...mail.com, @securityfocus.com, D3vil-0x1@...urityfocus.com)
[xpl#2] MiniNuke 1.8.2 - change member's passwrod < Perl > (hessam@...hal667.com)
Winamp 5.12 - 0day exploit - code execution through playlist (Process <processtree@...tonfire.org>)
Arescom NetDSL-1000 DoS atack source (framirez@...ri.fr)
sPaiz-Nuke Cross-Site Scripting Vulnerability (night_warrior771@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.com)
Nuked-klaN Cross-Site Scripting Vulnerability (night_warrior771@...urityfocus.com, "[at]"@securityfocus.com, hotmail.com@...urityfocus.com)
Re: Airscanner Mobile Security Advisory: Remote Hard Reset Data Wipe and DoS of Pocket Controller v5.0 (#AS05080401) (orambaldini@...i.net)
CME-24 (BlackWorm) Users' FAQ (Gadi Evron <ge@...uxbox.org>)
XSS flaw in MG2 Image Gallery (v.0.5.1) (preben@...chcom.no)
MyBB 1.2 Local File Incusion (o.y.6@...mail.com, @securityfocus.com, D3vil-0x1@...urityfocus.com)
Re: CME-24 (BlackWorm) Users' FAQ (Gadi Evron <ge@...uxbox.org>)
Re: Arescom NetDSL-1000 DoS atack source (Pim van Riezen <pi@...science.nl>)
[SECURITY] [DSA 959-1] New unalz packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[ GLSA 200601-16 ] MyDNS: Denial of Service (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Etomite CMS "Backdoored" (Luca@...urityfocus.com, Ercoli@...urityfocus.com, "[at]"@securityfocus.com, SeeWeb.Com@...urityfocus.com)
[ GLSA 200601-17 ] Xpdf, Poppler, GPdf, libextractor, pdftohtml: Heap overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ MDKSA-2006:026 ] - Updated bzip2 packages fix bzgrep vulnerabilities (security@...driva.com)

January 31 (21 messages)

Re: Winamp 5.12 - 0day exploit - code execution through playlist (Chris Wysopal <weld@...nwatch.org>)
New worm crawling trough blogs?! (blog.worm@...il.com)
[ MDKSA-2006:027 ] - Updated gzip packages fix zgrep vulnerabilities (security@...driva.com)
Re: ashnews Cross-Site Scripting Vulnerability (Dan B UK <dan-fd@...ox.org>)
Etomite followup information (security curmudgeon <jericho@...rition.org>)
Re: ashnews Cross-Site Scripting Vulnerability ("George A. Theall" <theall@...aware.com>)
Proof of concept for CommuniGate Pro Server vulnerability (Evgeny Legerov <research@...g.net>)
Re: ashnews Cross-Site Scripting Vulnerability (DanB-FD <dan-fd@...ox.org>)
BrowserCRM vulnerable for XSS (preben@...chcom.no)
Re: ashnews Cross-Site Scripting Vulnerability (DanB-FD <dan-fd@...ox.org>)
Cerberus Helpdesk vulnerable to XSS (preben@...chcom.no)
Re: Re: Winamp 5.12 - 0day exploit - code execution through playlist (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: EasyCMS vulnerable to XSS injection. (kim@...ycms.no)
DISIT - OPEN SOURCE DISASSEMBLER ENGINE (Piotr Bania <bania.piotr@...il.com>)
MyCO multiple vulnerabilities (revnic@...il.com)
[SECURITY] [DSA 957-2] New ImageMagick packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
FarsiNews 2.1 PHP Remote File Inclusion (h e <het_ebadi@...oo.com>)
[SECURITY] [DSA 960-1] New libmail-audit-perl packages fix insecure temporary file use (joey@...odrom.org (Martin Schulze))
Nmap 4.00 Released (Fyodor <fyodor@...ecure.org>)
Xmame 0.102 local vulnerability proof-of-concept (Rafael San Miguel Carrasco <smcsoc@...oo.es>)
[SECURITY] [DSA 960-2] New libmail-audit-perl packages fix insecure temporary file use (joey@...odrom.org (Martin Schulze))

618 messages

Powered by blists - more mailing lists