bugtraq mailing list - 2006/02

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2006/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 22	² 22	³ 19	⁴ 17	⁵ 2
⁶ 18	⁷ 17	⁸ 22	⁹ 10	¹⁰ 12	¹¹ 25	¹² 2
¹³ 23	¹⁴ 24	¹⁵ 39	¹⁶ 31	¹⁷ 20	¹⁸ 32	¹⁹ 14
²⁰ 15	²¹ 32	²² 36	²³ 30	²⁴ 34	²⁵ 16	²⁶ 2
²⁷ 37	²⁸ 27

Messages by day:

February 1 (22 messages)

CME-24/BlackWorm email notifications + top-7 unreachable AS's (Gadi Evron <ge@...uxbox.org>)
Windows Access Control Demystified (sudhakar+bugtraq@...princeton.edu)
[eVuln] Calendarix SQL Injection & Authorization Bypass Vulnerabilities (alex@...ln.com)
Blackboard Authentication Error (jdo24@...nell.edu)
[eVuln] SZUserMgnt Authentication Bypass (alex@...ln.com)
ZRCSA-200601: SPIP - Multiple Vulnerabilities (research@...e-h.fr)
[SECURITY] [DSA 961-1] New pdfkit.framework packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 962-1] New pdftohtml packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[security bulletin] SSRT051007 rev.1 - HP Tru64 UNIX Running DNS BIND Remote Unauthorized Privileged Access (security-alert@...com)
Re: Workaround for unpatched Oracle PLSQL Gateway flaw (x@...om)
iDefense Security Advisory 02.01.06: Winamp m3u/pls .WMA Extension Buffer Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.01.06: Winamp m3u Parsing Stack Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
Verified evasion in Snort (a@...urityfocus.com, non@...urityfocus.com, poet@...urityfocus.com, in@...urityfocus.com (at), connu@...urityfocus.com, dot_@...uri…)
Database Manager Default pass (fireboynet@...mails.com)
Re: Blackboard Authentication Error (George <ggal-security@...curity.com>)
AshWebStudio AshNews Multiple Vulnerabilities (zeus olimpusklan <zeus.olimpusklan@...il.com>)
RE: Buffer Overflow /Font on mIRC ("Krpata, Tyler" <tkrpata@....com>)
Re: Verified evasion in Snort (Thierry Zoller <Thierry@...ler.lu>)
Re: MyCO multiple vulnerabilities (office@...ctweb.com)
Re: Verified evasion in Snort (mwatchinski@...rcefire.com)
FreeBSD Security Advisory FreeBSD-SA-06:08.sack (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Fcrontab - memory corruption on heap. (pi3ki31ny@...pl)

February 2 (22 messages)

Daffodil CRM - vulnerable to SQL-injection. (preben@...chcom.no)
[ MDKSA-2006:028 ] - Updated php packages fix XSS and response splitting vulnerabilities (security@...driva.com)
[SECURITY] [DSA 963-1] New mydns packages fix denial of service (joey@...odrom.org (Martin Schulze))
Black Hat USA CFP opens, Europe early bird reminder, Federal news (Jeff Moss <jmoss@...ckhat.com>)
Re: Buffer Overflow /Font on mIRC ("D.C. van Moolenbroek" <dc.van.moolenbroek@...llo.nl>)
Re: Blackboard Authentication Error (Johan A.van Zanten <johan@...anglers.com>)
SoftMaker Shop is vulnerable to XSS (preben@...chcom.no)
Re: Blackboard Authentication Error ("Joshua Ogle" <jdo24@...nell.edu>)
Re: Blackboard Authentication Error (security-alerts@...ckboard.com)
Bug for libs in php link directory 2.0 (Mario Oyorzabal Salgado <tuxsoul@...soul.com>)
The History of the Oracle PLSQL Gateway Flaw ("David Litchfield" <davidl@...software.com>)
More on the workaround for the unpatched Oracle PLSQL Gateway flaw ("David Litchfield" <davidl@...software.com>)
CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities ("Williams, James K" <James.Williams@...com>)
security contact @lycos.com ("Spiros Antonatos" <antonat@....forth.gr>)
[SLAB] NetBSD / OpenBSD kernfs_xread patch evasion (SecurityLab Research <SLAB_research@...uritylab.net>)
[ MDKSA-2006:030 ] - Updated poppler packages fixes heap-based buffer overflow vulnerability (security@...driva.com)
Re: More on the workaround for the unpatched Oracle PLSQL Gateway flaw ("Thor \(Hammer of God\)" <thor@...merofgod.com>)
Re: Re: More on the workaround for the unpatched Oracle PLSQL Gateway flaw (Frank Knobbe <frank@...bbe.us>)
Re: Re: Verified evasion in Snort (anonpoet@...onnu.isu.edu)
[ MDKSA-2006:031 ] - Updated kdegraphics packages fixes heap-based buffer overflow vulnerability (security@...driva.com)
[ MDKSA-2006:032 ] - Updated xpdf packages fixes heap-based buffer overflow vulnerability (security@...driva.com)
[ MDKSA-2006:029 ] - Updated libast packages fixes buffer overflow vulnerability (security@...driva.com)

February 3 (19 messages)

Re: New worm crawling trough blogs?! (Nick FitzGerald <nick@...us-l.demon.co.uk>)
[ MDKSA-2006:033 ] - Updated OpenOffice.org packages fix issue with disabled hyperlinks (security@...driva.com)
Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan. (Mert Sarıca <mert.sarica@...il.com>)
Re: Re: Verified evasion in Snort ("Dave Korn" <davek_throwaway@...mail.com>)
IronMail-5.0.1-Denial of-Service-Protection-Lets-Remote-Users-Deny-Service (mark@...il.com)
[KDE Security Advisory] kpdf/xpdf heap based buffer overflow (Dirk Mueller <mueller@....org>)
Re: Cross Site Cooking ("Yngve Nysaeter Pettersen" <yngve@...ra.com>)
Neomail Cross Site Scripting Vulnerability (simo@...x.org)
cPanel Multiple Cross Site Scripting Vulnerability (simo@...x.org)
[SECURITY] [DSA 964-1] New gnocatan packages fix denial of service (joey@...odrom.org (Martin Schulze))
Exchangepop3 rcpt buffer overflow vulnerability (<securma@...x.org>)
AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability (shell@...shell.net)
Blacklist defenses as a breeding ground for vulnerability variants ("Steven M. Christey" <coley@...re.org>)
Re: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to sc… (Henrik Krohns <hege@...4.myrootshell.co…)
Outblaze Cross Site Scripting Vulnerability (simo@...x.org)
Re: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to s… (Hugo van der Kooij <hvdkooij@...derkooi…)
Re: Winamp 5.12 - 0day exploit - code execution through playlist (bart sikkes <b.sikkes@...il.com>)
Re: AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability (Stan Bubrouski <stan.bubrouski@...il.com>)
[eVuln] MyQuiz Arbitrary Command Execution Vulnerability (alex@...ln.com)

February 4 (17 messages)

Re: Blackboard Authentication Error (jeremy@....net)
CyberShop Ultimate E-commerce Script Cross Site Scripting (B3g0k@...kermail.com)
Internet Explorer remotely exploitable vulnerability in JScript's document.write() method (porkythepig@...pi.pl)
LoudBlog <= 0.4 arbitrary remote inclusion (rgod@...istici.org)
sql injection in ASP Survey (mfoxhacker@...il.com)
[KAPDA::#26] - MyTopix Sql Injection & Path Disclosure (alireza hassani <trueend5@...oo.com>)
PluggedOut Blog SQL injection and XSS (h e <het_ebadi@...oo.com>)
VSR Advisory: IBM Tivoli Access Manager - Web Server Plug-in File Retrieval Vulnerability (VSR Advisories <advisories@...curity.com>)
Issues with security software: orbicule.com "Undercover" (Maximillian Dornseif <dornseif@...ormatik.uni-mannheim.de>)
Re: Workaround for unpatched Oracle PLSQL Gateway flaw ("ad@...poverflow.com" <ad@...poverflow.com>)
[eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities (alex@...ln.com)
ProtoVer LDAP vs CommuniGate Pro 5.0.7 (Evgeny Legerov <research@...g.net>)
Re: security contact @lycos.com (while@...ff-n-gwyn.com)
mwcollect Alliance Launch (Georg Wicherski <georg-wicherski@...el-house.net>)
cleartext passwords get into log files (innate@....de)
Re: Cross Site Cooking (Glynn Clements <glynn@...ements.plus.com>)
Re: AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability (Stan Bubrouski <stan.bubrouski@...il.com>)

February 5 (2 messages)

cPanel 10 mime/handle.html XSS Vulnerability (Shell <shell6@...il.com>)
[ GLSA 200602-01 ] GStreamer FFmpeg plugin: Heap-based buffer overflow (Stefan Cornelius <dercorny@...too.org>)

February 6 (18 messages)

What can a Remote Vulnerability Scanner do in Future? (Alice Bryson <abryson@...efocus.com>)
[xfocus-SD-060206]BCB compiler incorrect deal sizeof operator vulnerability (XFOCUS Security Team <security@...cus.org>)
Re: [KDE Security Advisory] kpdf/xpdf heap based buffer overflow (Dirk Mueller <mueller@....org>)
Easily exploitable Pseudo Random Number generator in phpbb version 2.0.19 and under. (chinchilla@...il.com)
[ Secuobs - Advisory ] Bluetooth : DoS on hcidump 1.29 + PoC (Research Infratech <research@...ratech.fr>)
DarkStarlings.com XSS Vulnerability (Will Boyce <mail@...lboyce.com>)
[ Secuobs - Advisory ] Bluetooth : DoS on Sony/Ericsson cell phones (Research Infratech <research@...ratech.fr>)
[ Secuobs - Tools release ] BSS (Bluetooth Stack Smasher) fuzzer (Research Infratech <research@...ratech.fr>)
[SECURITY] [DSA 965-1] New ipsec-tools packages fix denial of service (joey@...odrom.org (Martin Schulze))
Announcement: Domain Contamination By Amit Klein (contact@...appsec.org)
SECURITY.NNOV: The Bat! 2.x message headers spoofing (3APA3A <3APA3A@...URITY.NNOV.RU>)
[ GLSA 200602-02 ] ADOdb: PostgresSQL command injection (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200602-03 ] Apache: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
PeopleSoft (Oracle) PSCipher Encryption Weakness (info@...ssure.com)
CAIDA analysis on CME-24/BlackWorm (Gadi Evron <ge@...uxbox.org>)
Re: cleartext passwords get into log files (Ben Wheeler <b.wheeler@...c.ac.uk>)
cPanel 10 handle.html XSS Vulnerability (shell@...shell.net)
RE: cPanel Multiple Cross Site Scripting Vulnerability ("Hamish Stanaway" <koremeltdown@...mail.com>)

February 7 (17 messages)

Re: cleartext passwords get into log files (Damien Miller <djm@...drot.org>)
Re: [ Secuobs - Advisory ] Bluetooth : DoS on Sony/Ericsson cell phones (Stan Bubrouski <stan.bubrouski@...il.com>)
mailback script exploit (coderpunk <coderpunk@...il.com>)
Vulnerabilities in vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 - 2.1.4). (h.z@...ox.ru)
(OLD) Eudora WorldMail 3.0 Windows 2000 Remote System Exploit (markus magnus <winning_team555@...oo.de>)
RE: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to sc… ("Prashant Meswani" <prashant.meswani@uk…)
Re: CAIDA analysis on CME-24/BlackWorm (Nick FitzGerald <nick@...us-l.demon.co.uk>)
[ MDKSA-2006:034 ] - Updated openssh packages fix vulnerability (security@...driva.com)
Re: Cross Site Cooking (Tim Nelson <security@...alive.biz>)
Re: [xfocus-SD-060206]BCB compiler incorrect deal sizeof operator vulnerability (XFOCUS Security Team <security@...cus.org>)
Re: security contact @lycos.com (sheeponhigh <sheeponhigh@...il.com>)
crypt_blowfish 1.0 (Solar Designer <solar@...nwall.com>)
MyQuiz Arbitrary Command Execution Exploit (perl) (irc0d3r@...oo.com)
High Risk Vulnerability in Lexmark Printer Sharing Service ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Re: High Risk Vulnerability in Lexmark Printer Sharing Service ("KF (lists)" <kf_lists@...italmunition.com>)
Arbitrary code execution via OProfile (Luís Miguel Silva <lms@...up.pt>)
[ MDKSA-2006:035 ] - Updated php packages fix vulnerability (security@...driva.com)

February 8 (22 messages)

eyeOS <= 0.8.9 Remote Code Execution (GulfTech Security Research <security@...ftech.org>)
Re: Vulnerabilities in vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 - 2.1.4). (Paul Laudanski <zx@...tlecops.com>)
Re: Vulnerabilities in vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 - 2.1.4). (Paul Laudanski <zx@...tlecops.com>)
Re: Vulnerabilities in vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 - 2.1.4). (scott@...lletin.com)
[myimei]MyBB 1.0.2 XSS attack in search.php (addmimistrator@...il.com)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS libph PHOTON_PATH Buffer Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.co…)
[myimei]MyBB1.0.3~moderation.php~SqlInject while merging posts (addmimistrator@...il.com)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS phfont Race Condition Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS phgrafx Command Buffer Overflow ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS su Command Buffer Overflow ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.07.06: QNX RTOS 6.3.0 Local Denial of Service Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.07.06: QNX RTOS 6.3.0 rc.local Insecure File Permissions Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS passwd Command Buffer Overflow ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS crttrap Arbitrary Library Loading Vulnerability (vendor-disclosure <vendor-disclosure@...fense.com>)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS fontsleuth Command Format String Vulnerability (vendor-disclosure <vendor-disclosure@...fense.com>)
iDefense Security Advisory 02.07.06: QNX Neutrino RTOS libAp ABLPATH Buffer Overflow Vulnerability (vendor-disclosure <vendor-disclosure@...fense.com>)
Fwd: [Full-disclosure] What can a Remote Vulnerability Scanner do in Future? (Louis Wang <bill.louis@...il.com>)
[ MDKSA-2006:037 ] - Updated mozilla-firefox packages to address DoS vulnerability (security@...driva.com)
Re: [myimei]MyBB 1.0.2 XSS attack in search.php ("Steven M. Christey" <coley@...re.org>)
Re: Workaround for unpatched Oracle PLSQL Gateway flaw (a@...om)
Whomp Real Estate Manager XP 2005 Sql Injection (night_warrior771@...mail.com)
Re: Workaround for unpatched Oracle PLSQL Gateway flaw ("David Litchfield" <davidl@...software.com>)

February 9 (10 messages)

[eVuln] PHP iCalendar File Inclusion Vulnerability (alex@...ln.com)
Re: Re: EasyCMS vulnerable to XSS injection. (kim@...ycms.no)
WiredRed EPOP XSS Vulnerability (Adrian Castro <acastro@...uxquestions.net>)
[ MDKSA-2006:036 ] - Updated mozilla packages to address DoS vulnerability (security@...driva.com)
CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion (rgod@...istici.org)
ProtoVer SSL: GnuTLS (Evgeny Legerov <research@...g.net>)
[ MDKSA-2006:038 ] - Updated groff packages fix temporary file vulnerabilities (security@...driva.com)
John the Ripper 1.7; pam_passwdqc 1.0+; tcb 1.0; phpass 0.0 (Solar Designer <solar@...nwall.com>)
[SECURITY] [DSA 966-1] New adzapper packages fix denial of service (joey@...odrom.org (Martin Schulze))
[ECHO_ADV_27$2006] Indexu <= 5.0.1 Remote File Inclusion (eufrato@...il.com)

February 10 (12 messages)

[security bulletin] SSRT051007 rev.2 - HP Tru64 UNIX Running DNS BIND4/BIND8 with Forwarders: Remote Unauthorized Privileged Access (security-alert@...com)
Fwd: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan. (Mert SARICA <mert.sarica@...il.com>)
Re: security contact @lycos.com (Greg Rubin <grrubin@...il.com>)
ProtoVer Sample LDAP testsuite release (Evgeny Legerov <research@...g.net>)
Secunia Research: Lotus Notes ZIP File Handling Buffer Overflow (Secunia Research <vuln@...unia.com>)
Re: CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion (noreply@...gonflycms.org)
Re: John the Ripper 1.7; pam_passwdqc 1.0+; tcb 1.0; phpass 0.0 (Solar Designer <solar@...nwall.com>)
Secunia Research: Lotus Notes TAR Reader File Extraction Buffer Overflow (Secunia Research <vuln@...unia.com>)
CPAINT AJAX Library Cross Site Scripting (GulfTech Security Research <security@...ftech.org>)
iDEFENSE Security Advisory 02.10.06: IBM Lotus Domino Server LDAP DoS Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
ARIN Security Contact (Terminal Entry <Security@...dro.net>)
[ Secuobs - Advisory ] Bluetooth : DoS on Nokia cell phones (Infratech Research <research@...ratech.fr>)

February 11 (25 messages)

[eVuln] Unknown Domain Shoutbox multiple XSS & SQL Injection Vulnerabilities (alex@...ln.com)
Re: mailback script exploit (erik@...touch.com)
LayerOne 2006 - Event Update and Announcement (Layer One <layeronecfp@...il.com>)
RE: John the Ripper 1.7; pam_passwdqc 1.0+; tcb 1.0; phpass 0.0 ("Amin Tora" <atora@...US.com>)
Secunia Research: Lotus Notes UUE File Handling Buffer Overflow (Secunia Research <vuln@...unia.com>)
[SECURITY] [DSA 967-1] New elog packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[security bulletin] SSRT051102 rev.1 - HP HTTP Server Running on Windows, Forced Use of Weaker Security Protocol (security-alert@...com)
Secunia Research: IBM Lotus Domino iNotes Client Script Insertion Vulnerabilities (Secunia Research <vuln@...unia.com>)
TSLSA-2006-0006 - multi (Trustix Security Advisor <tsl@...stix.org>)
runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor package (rgod@...istici.org)
Secunia Research: Lotus Notes HTML Speed Reader Link Buffer Overflows (Secunia Research <vuln@...unia.com>)
[eVuln] GuestBookHost Authentication Bypass (alex@...ln.com)
FarsiNews 2.5 Multiple Vulnerabilities (h e <het_ebadi@...oo.com>)
Secunia Research: Lotus Notes Multiple Archive Handling Directory Traversal (Secunia Research <vuln@...unia.com>)
SUSE Security Announcement: binutils,kdelibs3,kdegraphics3,koffice,dia,lyx (SUSE-SA:2006:007) (Ludwig Nussel <ludwig.nussel@...e.de>)
[USN-247-1] Heimdal vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[security bulletin] SSRT061108 rev.2 - HP Systems Insight Manager Remote Unauthorized Access - Directory Traversal (security-alert@...com)
Corrupt Word file may cause buffer overflow in the Blackberry Attachment Service (lukew@...bcs.com)
Linpha <= 1.0 multiple arbitrary local inclusion (rgod@...istici.org)
HiveMail <= 1.3 Multiple Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
RR Donnelley & Sons - Security Contact (Terminal Entry <Security@...dro.net>)
[eVuln] phpht Topsites Multiple Vulnerabilities (alex@...ln.com)
[eVuln] phphg Guestbook Multiple Vulnerabilities (alex@...ln.com)
RS-2006-1: Multiple flaws in VHCS 2.x (Roman Medina-Heigl Hernandez <roman@...labs.com>)
imageVue16.1 upload vulnerability (zjieb@...mail.com)

February 12 (2 messages)

[ GLSA 200602-04 ] Xpdf, Poppler: Heap overflow (Thierry Carrez <koon@...too.org>)
[ GLSA 200602-05 ] KPdf: Heap based overflow (Thierry Carrez <koon@...too.org>)

February 13 (23 messages)

Re: What can a Remote Vulnerability Scanner do in Future? (Tim Nelson <security@...alive.biz>)
Comment Spam: new trends, failing counter-measures and why it's a big deal (Gadi Evron <ge@...uxbox.org>)
Re: Comment Spam: new trends, failing counter-measures and why it's a big deal (Michael Silk <michaelslists@...il.com>)
Bypass Fortinet anti-virus using FTP (Mathieu Dessus <mdessus@...il.com>)
URL filter bypass in Fortinet (Mathieu Dessus <mdessus@...il.com>)
Latest wu-ftpd exploit :-s (Mark Heiligen <mark.heiligen@....at>)
Internet Explorer drag&drop 0day (Gadi Evron <ge@...uxbox.org>)
Re: Internet Explorer drag&drop 0day (Thierry Zoller <Thierry@...ler.lu>)
Re: Internet Explorer drag&drop 0day (Gadi Evron <ge@...uxbox.org>)
DocMGR <= 0.54.2 arbitrary remote inclusion (rgod@...istici.org)
DB_eSession deleteSession() SQL injection (GulfTech Security Research <security@...ftech.org>)
[eVuln] phphd Multiple Vulnerabilities (alex@...ln.com)
[eVuln] Clever Copy 'Referer' & 'X-Forwarded-For' XSS Vulnerabilities (alex@...ln.com)
Re: Zen-Cart <= 1.2.6d blind SQL injection / remote commands execution: (please-use-the-support-forum@...-cart.com)
[eVuln] phpstatus Authentication Bypass (alex@...ln.com)
Invision Power Board Army System Mod <= 2.1 SQL Injection Exploit (unsecure@...teme.com)
Everyone's loginName variable Cross Site Scripting Vulnerability (simo@...x.org)
[SECURITY] [DSA 968-1] New noweb packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))
[ GLSA 200602-06 ] ImageMagick: Format string vulnerability (Thierry Carrez <koon@...too.org>)
Folder Guard password protection bypass (ShadowBeast@...erdevelop.com)
Siteframe Beaumont 5.0.1a <== Cross-Site Scripting Vulnerability (federico.alice@...cali.it)
[SECURITY] [DSA 969-1] New scponly packages fix potential root vulnerability (joey@...odrom.org (Martin Schulze))
XSS vulnerability in guestbook-php-script (Micha Borrmann <borrmann@...s.de>)

February 14 (24 messages)

Re: Folder Guard password protection bypass (Stan Bubrouski <stan.bubrouski@...il.com>)
New winamp m3u/pls .WMA & .M3U Extension overflows (b0fnet@...oo.com)
EGS Enterprise Groupware System 1.0 rc4 remote commands execution & FlySpray 0.9.7 remote commands execution (rgod@...istici.org)
Advisory: Internet Explorer Drag and Drop Redeux [CVE-2005-3240] (fwd) (Matthew Murphy <mattmurphy@...rr.com>)
Advisory: Internet Explorer Drag and Drop Redeux [CVE-2005-3240] (fwd) (Matthew Murphy <mattmurphy@...rr.com>)
Re: Latest wu-ftpd exploit :-s (John Smith <vun.list@...il.com>)
On the "0-day" term ("Steven M. Christey" <coley@...re.org>)
Re: Internet Explorer drag&drop 0day (Markus <full-disclosure@...dman.za.net>)
Re: On the "0-day" term (Jason Coombs <jasonc@...ence.org>)
Re: Latest wu-ftpd exploit :-s (Marco Monicelli <marco.monicelli@...cegaglia.com>)
Re: On the "0-day" term (Gadi Evron <ge@...uxbox.org>)
eStara SIP softphone several message-processing vulnerabilities (zwell@...u.com)
[ MDKSA-2006:039 ] - Updated gnutls packages fix libtasn1 out-of-bounds access vulnerabilities (security@...driva.com)
[SECURITY] [DSA 970-1] New kronolith packages fix cross-site scripting (joey@...odrom.org (Martin Schulze))
iDefense Labs Quarterly Hacking Challenge ("labs-no-reply@...fense.com" <labs-no-reply@...fense.com>)
[SECURITY] [DSA 971-1] New xpdf packages fix denial of service (joey@...odrom.org (Martin Schulze))
iDefense Security Advisory 02.14.06: Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability ("labs-no-reply@...fense.com" <labs-no-reply@...fense.…)
SQL injection in PHP Classifieds 6.20 (audun.larsen@...nsult.no)
[waraxe-2006-SA#044] - XSS in phpNuke 7.8 and older versions (come2waraxe@...oo.com)
dotproject <= 2.0.1 remote code execution (r.verton@...il.com)
XSS bugs and SQL injection in sNews (Alexander Hristov <joffer@...il.com>)
memory leak in IE? ("David Cross" <davidcross@...t-N-Track.com>)
MyBB 1.03 Multible xss and sql injections (s2b@...mail.com)
[EEYEB-20051017] Windows Media Player BMP Heap Overflow ("eEye Advisories" <Advisories@...e.com>)

February 15 (39 messages)

[ GLSA 200602-07 ] Sun JDK/JRE: Applet privilege escalation (Stefan Cornelius <dercorny@...too.org>)
False positive signature verification in GnuPG (Werner Koch <wk@...pg.org>)
[Announce] False positive signature verification in GnuPG (Werner Koch <wk@...pg.org>)
[Announce] False positive signature verification in GnuPG (Werner Koch <wk@...pg.org>)
[Announce] False positive signature verification in GnuPG (Werner Koch <wk@...pg.org>)
[Announce] False positive signature verification in GnuPG (Werner Koch <wk@...pg.org>)
[USN-248-1] unzip vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-249-1] xpdf/poppler/kpdf vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-250-1] Linux kernel vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ Secuobs - Advisory ] Another kind of DoS on Nokia cell phones (Infratech Research <research@...ratech.fr>)
Kadu Remote Denial Of Service Fun (Piotr Bania <bania.piotr@...il.com>)
[USN-248-2] unzip regression fix (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 975-1] New nfs-user-server packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
PostgreSQL security releases 8.1.3, 8.0.7, 7.4.12, 7.3.14 (PostgreSQL Security <security@...tgresql.org>)
[SECURITY] [DSA 976-1] New libast packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Cisco Security Advisory: TACACS+ Authentication Bypass in Cisco Anomaly Detection and Mitigation Products (Cisco Systems Product Security Incident Response Team…)
[myimei]WordPress2.0.0~autorswebsite~XSS attack (addmimistrator@...il.com)
[BuHa-Security] Multiple Vulnerabilities in Mantis 1.00rc4 (bugtraq@...ph3us.org)
CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAP BC (Leandro Meiners <lmeiners@...sec.com>)
Vulnerabilites in new laws on computer hacking (self-destruction@...best.com)
CYBSEC - Security Pre-Advisory: Phishing Vector in SAP BC (Leandro Meiners <lmeiners@...sec.com>)
Re: Re: Vulnerabilities in vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 - 2.1.4). (sudd3n_death@...mail.com)
Re: Invision Power Board Army System Mod <= 2.1 SQL Injection Exploit (Cristian Stoica <security@...cms.biz>)
Re: Latest wu-ftpd exploit :-s ("Ragnar Paulson" <ragnar@...ware.com>)
Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution (info@...italarmaments.com)
Mirabiliz ICQ 2002/2003/ LITE 4.0/4.1 LONG (DIRECTORY + FILENAME) EXPLOIT (edubp2002@...mail.com)
XMB Forums Multiple Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
Re: John the Ripper 1.7; pam_passwdqc 1.0+; tcb 1.0; phpass 0.0 (Rainer Duffner <rainer@...ra-secure.de>)
[security bulletin] SSRT061108 rev.3 - HP Systems Insight Manager Remote Unauthorized Access via Directory Traversal (security-alert@...com)
[eVuln] My Blog BBCode XSS Vulnerabilities (alex@...ln.com)
[SECURITY] [DSA 974-1] New gpdf packages fix denial of service (joey@...odrom.org (Martin Schulze))
[eVuln] 2200net Calendar system SQL Injection and Authentication Bypass Vulnerabilities (alex@...ln.com)
Re: John the Ripper 1.7; pam_passwdqc 1.0+; tcb 1.0; phpass 0.0 ("Aaron" <microchp@...rochp.org>)
Openwall GNU/*/Linux (Owl) 2.0 release (Solar Designer <solar@...nwall.com>)
MyBB1.0.3~managegroup.php~Multiple SqlInjection & XSS (addmimistrator@...il.com)
[security bulletin] SSRT051045 rev.2 - HP-UX Running DNS BIND4/BIND8 as Forwarders: Remote Unauthorized Privileged Access (security-alert@...com)
honeyd security advisory: remote detection (Niels Provos <provos@...i.umich.edu>)
[eVuln] M. Blom HTML::BBCode perl module XSS Vulnerabilities (alex@...ln.com)
Re: What can a Remote Vulnerability Scanner do in Future? ("Aaron" <microchp@...rochp.org>)

February 16 (31 messages)

Re: dotproject <= 2.0.1 remote code execution (Adam Donnison <adam@...i.com.au>)
[myimei]MyBB 1.0.3~private.php~multiple SqlInjection (addmimistrator@...il.com)
[SECURITY] [DSA 973-1] New OTRS packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Re: Everyone's loginName variable Cross Site Scripting Vulnerability (btn@...ryone.net)
[SECURITY] [DSA 972-1] New pdfkit.framework packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: Internet Explorer drag&drop 0day (Markus <full-disclosure@...dman.za.net>)
Security advisory: Windows IME Vulnerability (MS06-009) ("Ryan Lee" <ryan.lee@...nstyle.com>)
[myimei]MyBB1.0.3~managegroup.php~Multiple SqlInjection & XSS (addmimistrator@...il.com)
Winamp .m3u fun again ;) (Sowhat <smaillist@...il.com>)
Re: Internet Explorer drag&drop 0day (Markus <full-disclosure@...dman.za.net>)
First WMF mass mailer ItW (phishing Trojan) (Gadi Evron <ge@...uxbox.org>)
Windows Media Player BMP Heap Overflow (MS06-005) (atmaca@...mail.com)
Re: Vulnerabilites in new laws on computer hacking (Paul Schmehl <pauls@...allas.edu>)
Critical SQL Injection PHPNuke <= 7.8 - Your_Account module ("SecurityReason - sp3x" <sp3x@...urityreason.com>)
Re: MyBB 1.03 Multible xss and sql injections (security@...board.com)
What is the state of vulnerability research? ("Steven M. Christey" <coley@...re.org>)
[SECURITY] [DSA 977-1] New heimdal packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Re: Vulnerabilites in new laws on computer hacking (Radoslav Dejanović <radoslav.dejanovic@...us.hr>)
[USN-251-1] libtasn vulnerability (Martin Pitt <martin.pitt@...onical.com>)
RE: Vulnerabilites in new laws on computer hacking ("Marcus J. Ranum" <mjr@...um.com>)
D-Link DWL-G700AP httpd DoS (innate@....de)
Critical SQL Injection PHPNuke <= 7.8 - Your_Account module (sp3x@...urityreason.com)
[eVuln] PHP Event Calendar XSS & User's Data Corruption Vulnerabilities (alex@...ln.com)
Password disclosure and remote access in Netcool/NeuSecure Security information management platform ("D.Snezhkov" <dsnezhkov@...il.com>)
Siteframe Beaumont 5.0.2 <== User Comment Cross-Site Scripting Vulnerability (federico.alice@...cali.it)
[ GLSA 200602-08 ] libtasn1, GNU TLS: Security flaw in DER decoding (Thierry Carrez <koon@...too.org>)
Winamp .m3u fun again ;) (Sowhat <smaillist@...il.com>)
[ GLSA 200602-09 ] BomberClone: Remote execution of arbitrary code (Thierry Carrez <koon@...too.org>)
PHPKIT >= 1.6.1r2 arbitrary local/remote inclusion (unproperly patched in previous versions) (rgod@...istici.org)
RE: Vulnerabilites in new laws on computer hacking ("Craig Wright" <cwright@...syd.com.au>)
Soldier of Fortune II format string through PunkBuster 1.180 (Luigi Auriemma <aluigi@...istici.org>)

February 17 (20 messages)

Re: Vulnerabilites in new laws on computer hacking (Glynn Clements <glynn@...ements.plus.com>)
Re: Re: Vulnerabilities in vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 - 2.1.4). (Paul Laudanski <zx@...tlecops.com>)
[USN-252-1] gnupg vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-253-1] heimdal vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[eVuln] Scriptme products BBCode 'url' XSS Vulnerability (alex@...ln.com)
Re: Siteframe Beaumont 5.0.2 <== User Comment Cross-Site Scripting Vulnerability (federico.alice@...cali.it)
SNORT Incorrect fragmented packet reassembly (siouxsie@...heogen.ru)
False positive signature verification in GnuPG (Werner Koch <wk@...pg.org>)
RUNCMS 1.3a SQL injection (h e <het_ebadi@...oo.com>)
Bugs/Security issues with PatchLink's Update Server ("Brian Boner" <BBoner@...financial.com>)
Internet Explorer Phishing mouseover issue (gandalf@...ital.net)
[SECURITY] [DSA 979-1] New pdfkit.framework packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Re: memory leak in IE? (bcrawfordjr@...il.com)
[security bulletin] SSRT051023 rev.6 - HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Privileged Access (security-alert@...com)
Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution (Bharat Mediratta <bharat@...alto.com>)
Re: First WMF mass mailer ItW (phishing Trojan) (Lance James <bugtraq@...urescience.net>)
Re: dotproject <= 2.0.1 remote code execution (Adam Donnison <adam@...i.com.au>)
[SECURITY] [DSA 978-1] New GnuPG packages fix invalid success return (joey@...odrom.org (Martin Schulze))
[eVuln] PHP/MYSQL Timesheet Multiple SQL Injection Vulnerabilities (alex@...ln.com)
[eVuln] SmE GB Host Authentication Bypass Vulnerability (alex@...ln.com)

February 18 (32 messages)

[OpenPKG-SA-2006.001] OpenPKG Security Advisory (gnupg) (OpenPKG <openpkg@...npkg.org>)
Sending exact replicas of Distributed.net's worked OGR project files could increase individual's stats. (spoilt.jesus@...il.com)
Uniden UIP1868P (VoIP phone/gateway) default easy-to-guess password vulnerability (pagvac <unknown.pentester@...il.com>)
[eVuln] CALimba Authentication Bypass Vulnerability (alex@...ln.com)
Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines. (porkythepig@...pi.pl)
BCS Asia 2006 - Call for Papers (Jim Geovedi <jim@...vedi.com>)
Java script exploit (gandalf@...ital.net)
[ MDKSA-2006:040 ] - Updated kernel packages fix multiple vulnerabilities (security@...driva.com)
[ GLSA 200602-10 ] GnuPG: Incorrect signature verification (Thierry Carrez <koon@...too.org>)
RE: Latest wu-ftpd exploit :-s ("Ronald van der Westen" <rvdwesten@...il.com>)
Re: Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines. (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: Java script exploit (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: Java script exploit (Jose Nazario <jose@...key.org>)
Re: Java script exploit (Jose Nazario <jose@...key.org>)
Re: dotproject <= 2.0.1 remote code execution ("milw0rm Inc." <milw0rm@...il.com>)
[ MDKSA-2006:041 ] - Updated bluez-hcidump packages fix buffer overflow vulnerability (security@...driva.com)
[ MDKSA-2006:042 ] - Updated libtiff packages fix vulnerability (security@...driva.com)
[ MDKSA-2006:043 ] - Updated gnupg packages fix signature file verification vulnerability (security@...driva.com)
Re: Internet Explorer Phishing mouseover issue (Paul Szabo <psz@...hs.usyd.edu.au>)
Coppermine Photo Gallery <=1.4.3 remote code execution (rgod@...istici.org)
e107 CMS 0.7.2 Chatbox plugin XSS vulnerability (ssteam.pl@...il.com)
Tasarim Rehberi Index.PHP Remote Command Exucetion (botan@...uxmail.org)
[OpenPKG-SA-2006.002] OpenPKG Security Advisory (sudo) (OpenPKG <openpkg@...npkg.org>)
[OpenPKG-SA-2006.003] OpenPKG Security Advisory (openssh) (OpenPKG <openpkg@...npkg.org>)
RCblog exploit [fun] (hessam@...samx.net)
ADOdb Library Cross Site Scripting (GulfTech Security Research <security@...ftech.org>)
[waraxe-2006-SA#045] - Bypassing CAPTCHA in phpNuke 6.x-7.9 (come2waraxe@...oo.com)
SLQ Injection vulnerability in WPCeasy (murfie@...il.com)
[FLSA-2006:152809] Updated squid package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:168935] Updated openssh packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:175406] Updated Apache httpd packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
new linux malware (Gadi Evron <ge@...uxbox.org>)

February 19 (14 messages)

[operational update] Looking behind the smoke screen of the Internet (Gadi Evron <ge@...uxbox.org>)
The New Face of Phishing (Gadi Evron <ge@...uxbox.org>)
Malware that breaks SSL via Pharming {Emerging Threat} (Lance James <bugtraq@...urescience.net>)
Re: Vulnerabilites in new laws on computer hacking ("Jon Gucinski" <Jgucinski@...westbank.com>)
Vulnerability in WinRAR - Phishing based (preben@...chcom.no)
Re: Vulnerabilites in new laws on computer hacking (Max Ashton <maxashton@....cc>)
Re: Vulnerabilites in new laws on computer hacking (Sysmin Sys73m47ic <sysmin.systematic@...il.com>)
RE: Vulnerabilites in new laws on computer hacking (Anthony Cicalla <Anthony.Cicalla@...kServ.com>)
Re: Vulnerabilites in new laws on computer hacking (dave <fla.linux@...il.com>)
Re: Vulnerabilites in new laws on computer hacking (Seth Breidbart <sethb@...ix.com>)
Re: Vulnerabilites in new laws on computer hacking (ArkanoiD <ark@...ex.net>)
Re: Vulnerabilites in new laws on computer hacking (Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>)
Re: Internet Explorer remotely exploitable vulnerability in JScript's document.write() method (temp@...opahost.com)
update on the linux worm (Gadi Evron <ge@...uxbox.org>)

February 20 (15 messages)

[OpenPKG-SA-2006.005] OpenPKG Security Advisory (tin) (OpenPKG <openpkg@...npkg.org>)
[OpenPKG-SA-2006.004] OpenPKG Security Advisory (postgresql) (OpenPKG <openpkg@...npkg.org>)
[eVuln] Magic Calendar Lite Authentication Bypass (alex@...ln.com)
More info: gBook Multiple Unspecified Cross-Site Scripting Vulnerabilities (mkproductions@...rs.sourceforge.net)
Guestbox XSS/an admin bypass (innate@....de)
Secunia Research: NJStar Word Processor Font Name Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Re: First WMF mass mailer ItW (phishing Trojan) (Lance James <bugtraq@...urescience.net>)
[TZO-062006] Safe'nVulnerable (Thierry Zoller <Thierry@...ler.lu>)
[eVuln] Time Tracking Software Multiple Vulnerabilities (alex@...ln.com)
Geeklog Remote Code Execution (GulfTech Security Research <security@...ftech.org>)
Re: Vulnerability in WinRAR - Phishing based (Andreas Beck <becka-list-bugtraq@...atec.de>)
[waraxe-2006-SA#046] - Critical sql injection in phpNuke 7.5-7.8 (come2waraxe@...oo.com)
Re: new linux malware (Gadi Evron <ge@...uxbox.org>)
[ GLSA 200602-11 ] OpenSSH, Dropbear: Insecure use of system() call (Thierry Carrez <koon@...too.org>)
Quarantine your infected users spreading malware (Gadi Evron <ge@...uxbox.org>)

February 21 (32 messages)

Re: new linux malware (Marco Monicelli <marco.monicelli@...cegaglia.com>)
Re: update on the linux worm ("Stephen J. Smoogen" <smooge@...il.com>)
Advisory: MiniNuke CMS System all versions (pages.asp) SQL Injection vulnerability (nukedx@...edx.com)
MiniNuke CMS System all versions (pages.asp) SQL Injection (nukedx@...edx.com)
Not completely fixed? (was: False positive signature verification in GnuPG) (Marcus Meissner <meissner@...e.de>)
Re: Quarantine your infected users spreading malware (Simon Richter <Simon.Richter@...yros.de>)
Re: Not completely fixed? (Werner Koch <wk@...pg.org>)
[USN-256-1] bluez-hcidump vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-254-1] noweb vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-255-1] openssh vulnerability (Martin Pitt <martin.pitt@...onical.com>)
SUSE Security Announcement: gpg,liby2util signature checking problems (SUSE-SA:2006:009) (Marcus Meissner <meissner@...e.de>)
[BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4 (mkanat@...zilla.org)
Re: Not completely fixed? (Werner Koch <wk@...pg.org>)
[AJECT] TrueNorth IA eMailserver 5.3.4 buffer overflow vulnerability (João Antunes <jantunes@...fc.ul.pt>)
Re: Invision Power Board Army System Mod <= 2.1 SQL Injection Exploit (Crispin Cowan <crispin@...ell.com>)
grab cookie information with Melange Chat Server 1.10 (Nexus <nexus.logik@...il.com>)
[BuHa-Security] DoS Vulnerability in Firefox <= 1.0.7 (bugtraq@...ph3us.org)
how to crash apache/php in cpanel (Ed Wiget <ewiget@...studios.com>)
Whitepaper by Amit Klein: "HTTP Response Smuggling" ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
[ GLSA 200602-12 ] GPdf: Heap overflows in included Xpdf code (Thierry Carrez <koon@...too.org>)
Re: new linux malware (Christine Kronberg <Christine_Kronberg@...ua.de>)
[eVuln] Magic News Lite PHP Code Execution & Unauthorized Data Modification (alex@...ln.com)
MiniNuke CMS System all versions (pages.asp) SQL Injection (nukedx@...edx.com)
[eVuln] Magic Downloads Unauthorized Data Modification (alex@...ln.com)
Mozila Thunderbird 1.5 Address Book DoS (Javor Ninov <drfrancky@...urax.org>)
Re: Not completely fixed? ("Werner Koch" <wk@...pg.org>)
[myimei]CuteNews1.4.1~ Add Comment For Protected UserNames~ XSS Attack (addmimistrator@...il.com)
Re: Invision Power Board Army System Mod <= 2.1 SQL Injection Exploit ("Angelos D. Keromytis" <angelos@...columbia.edu>)
[ MDKSA-2006:044 ] - Updated kernel packages fix multiple vulnerabilities (security@...driva.com)
[eVuln] BirthSys SQL Injection Vulnerability (alex@...ln.com)
PunBB 1.2.10 Multiple DoS Vulnerabilities (k4p0k4p0@...mail.com)
Re: [waraxe-2006-SA#046] - Critical sql injection in phpNuke 7.5-7.8 (sp3x@...urityreason.com)

February 22 (36 messages)

Not completely fixed? (was: False positive signature verification in GnuPG) (Marcus Meissner <meissner@...e.de>)
Re: First WMF mass mailer ItW (phishing Trojan) - think singularities (Lance James <bugtraq@...urescience.net>)
RE: First WMF mass mailer ItW (phishing Trojan) - think singularities ("Ken Kousky" <kkousky@...inc.com>)
Re: Vulnerabilites in new laws on computer hacking (ArkanoiD <ark@...ex.net>)
RE: Vulnerabilites in new laws on computer hacking (Bigby Findrake <bigby@...emeron.org>)
Re: Vulnerabilites in new laws on computer hacking (ArkanoiD <ark@...ex.ru>)
RE: Vulnerabilites in new laws on computer hacking ("Craig Wright" <cwright@...syd.com.au>)
Amazon phishing scam on Yahoo servers (Paul Laudanski <zx@...tlecops.com>)
Re: Vulnerabilites in new laws on computer hacking (Crispin Cowan <crispin@...ell.com>)
RE: Vulnerabilites in new laws on computer hacking ("Benson, Sean M" <BensonS@...te.gov>)
H&R Block contact (Fixer <fixer@....net>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Christine Kronberg <Christine_Kronberg@...ua.de>)
RE: Vulnerabilites in new laws on computer hacking ("Craig Wright" <cwright@...syd.com.au>)
PEAR LiveUser File Access Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
Re: Vulnerabilites in new laws on computer hacking (Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>)
RE: Vulnerabilites in new laws on computer hacking ("Craig Wright" <cwright@...syd.com.au>)
Re: Java script exploit (Andreas Beck <becka-list-bugtraq@...atec.de>)
Re: Vulnerabilites in new laws on computer hacking (FocusHacks <focushacks@...il.com>)
Invision Power Board 2.1.4 Multiple Vulnerabilities (paisterist.nst@...il.com)
PHP as a secure language? PHP worms? [was: Re: new linux malware] (Gadi Evron <ge@...uxbox.org>)
Re: Quarantine your infected users spreading malware (Radoslav Dejanović <radoslav.dejanovic@...us.hr>)
The Domain Name Service as an IDS (Gadi Evron <ge@...uxbox.org>)
Re: Quarantine your infected users spreading malware (Bob Beck <beck@...h.cns.ualberta.ca>)
IpSwitch WhatsUp Professional 2006 DoS (Josh Zlatin <jzlatin@...at.cc>)
IRM 017: Multiple Vulnerabilities in Infovista Portal SE ("Advisories" <advisories@...plc.com>)
[ MDKSA-2006:046 ] - Updated tar packages fix vulnerability (security@...driva.com)
Re: Vulnerabilites in new laws on computer hacking (Radoslav Dejanović <radoslav.dejanovic@...us.hr>)
[KAPDA::#27] - Runcms 1.x Cross_Site_Scripting vulnerability (roozbeh_afrasiabi@...oo.com)
Mozilla Thunderbird : Remote Code Execution & Denial of Service (Renaud Lifchitz <r.lifchitz@...dream.com>)
[SECURITY] [DSA 980-1] New tutos packages fix multiple vulnerabilities (Michael Stone <mstone@...cker.debian.org>)
[KAPDA::#29]Noah's classifieds multiple vulnerabilities (alireza hassani <trueend5@...oo.com>)
InqTana Through the eyes of Dr. Frankenstein. ("KF (lists)" <kf_lists@...italmunition.com>)
Multiple Injection Vulnerabilities in PHP PEAR::Auth Module (Matt Van Gundy <matt@...kinahstudios.com>)
[INetCop Security Advisory] Global Hauri Virobot cookie exploit ("dong-hun you" <xploit@...kermail.com>)
South River WebDrive Buffer Overflow Vulnerability (Adrian Castro <acastro@...uxquestions.net>)
Re: Multiple Injection Vulnerabilities in PHP PEAR::Auth Module (Matt Van Gundy <matt@...kinahstudios.com>)

February 23 (30 messages)

Re: Multiple Injection Vulnerabilities in PHP PEAR::Auth Module ("Benjamin R. Ginter" <bginter@...vtech.net>)
RE: Vulnerabilites in new laws on computer hacking ("Craig Wright" <cwright@...syd.com.au>)
[ MDKSA-2006:045 ] - Updated MySQL packages fix temporary file vulnerability (security@...driva.com)
[USN-257-1] tar vulnerability (Martin Pitt <martin.pitt@...onical.com>)
DEF CON 14 is now in effect! The Call for Papers is open. (The Dark Tangent <dtangent@...con.org>)
Re: Internet Explorer Phishing mouseover issue ("Steven M. Christey" <coley@...re.org>)
[ MDKSA-2006:047 ] - Updated metamail packages fix vulnerability (security@...driva.com)
zoo contains exploitable buffer overflows (Jean-Sébastien Guay-Leroux <jean-sebastien@...y-leroux.com>)
NSFOCUS SA2006-01 : Winamp m3u File Processing Buffer Overflow Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
NOCC Webmail <= 1.0 multiple vulnerabilities (rgod@...istici.org)
Secunia Research: Visnetic AntiVirus Plug-in for MailServer Privilege Escalation (Secunia Research <remove-vuln@...unia.com>)
[eVuln] Teca Diary PE SQL Injection Vulnerability (alex@...ln.com)
Secunia Research: WinACE ARJ Archive Handling Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
ZDI-06-002: Adobe Macromedia ShockWave Code Execution (zdi-disclosures@...m.com)
Re: new linux malware ("Jamie Riden" <jamie.riden@...il.com>)
Re: Amazon phishing scam on Yahoo servers (Steve Friedl <steve@...xwiz.net>)
Re: H&R Block contact ("Rory A. Savage" <rsavage@...ox.net>)
Re: H&R Block contact (Fixer <fixer@....net>)
RE: Amazon phishing scam on Yahoo servers ("Geoff Vass" <geoff@...zow.com.au>)
Re: Amazon phishing scam on Yahoo servers (Paul Laudanski <zx@...tlecops.com>)
RE: Amazon phishing scam on Yahoo servers (Paul Laudanski <zx@...tlecops.com>)
Re: How hackers cause damage... was Vulnerabilites in new laws on computer hacking (Jason Coombs <jasonc@...ence.org>)
Event Speaker (Pete Herzog <pete@...com.org>)
HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injection (h4cky0u.org@...il.com)
Re: Re: How hackers cause damage... was Vulnerabilites in new laws on computer hacking (Simon Smith <simon@...soft.com>)
NSA Group Security Advisory NSAG-№197-23.02.2006 Vulnerability CubeCart 3.0.0 – 3.0.6 (NSA Group <vulnerability@...g.ru>)
NSA Group Security Advisory NSAG-№196-23.02.2006 Vulnerability FCKeditor 2.2 (NSA Group <vulnerability@...g.ru>)
NSA Group Security Advisory NSAG-№198-23.02.2006 Vulnerability The Bat v. 3.60.07 (NSA Group <vulnerability@...g.ru>)
NSA Group Security Advisory NSAG-№195-23.02.2006 Vulnerability FCKeditor 2.0 FC (NSA Group <vulnerability@...g.ru>)
Re: How hackers cause damage... was Vulnerabilites in new laws on computer hacking (Jason Coombs <jasonc@...ence.org>)

February 24 (34 messages)

RE: Amazon phishing scam on Yahoo servers (Alex Eckelberry <AlexE@...belt-software.com>)
Administrivia: New Bugtraq moderator (David Ahmad <da@...urityfocus.com>)
[FLSA-2006:162750] Updated sudo packages fix security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:180036-1] Updated mozilla packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:180036-2] Updated firefox package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
RE: How hackers cause damage... was Vulnerabilites in new laws on computer hacking ("Craig Wright" <cwright@...syd.com.au>)
Re: Quarantine your infected users spreading malware ("499nag" <499nag@...net.pt>)
announcement: reporting and mitigating botnets (Gadi Evron <ge@...uxbox.org>)
Vulnerability in Crypt::CBC Perl module, versions <= 2.16 (Lincoln Stein <lstein@...l.edu>)
NSA Group Security Advisory NSAG-№198-23.02.2006 Vulnerability ArGoSoft Mail Server Pro (NSA Group <vulnerability@...g.ru>)
NSA Group Security Advisory NSAG-№200-24.02.2006 Vulnerability ArGoSoft Mail Server Pro IMAP (NSA Group <vulnerability@...g.ru>)
[eVuln] Guestex Shell Command Execution Vulnerability (alex@...ln.com)
Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal (h e <het_ebadi@...oo.com>)
WinAce Archiver v2.6 Directory traversal (h e <het_ebadi@...oo.com>)
StuffIt and ZipMagic Family of products Directory traversal (h e <het_ebadi@...oo.com>)
SpeedCommander 11.0 & ZipStar 5.1 & Squeez 5.1 Directory traversal (h e <het_ebadi@...oo.com>)
Advisory: CilemNews System <= 1.1 Remote SQL Injection Vulnerability (nukedx@...edx.com)
Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0) multiple XSS vulnerabilities (nukedx@...edx.com)
Advisory: MyPHPNuke <= 1.8.8 multiple XSS vulnerabilities (nukedx@...edx.com)
SuSE Security Announcement: heimdal (SUSE-SA:2006:010) (Thomas Biege <thomas@...e.de>)
IRM 018: Winamp 5.13 m3u Playlist Buffer Overflow ("Advisories" <advisories@...plc.com>)
Re: Vulnerabilites in new laws on computer hacking (Casper.Dik@....COM)
Re: Vulnerabilites in new laws on computer hacking ("Davi Anabuki" <anabuki@...il.com>)
Re: Vulnerabilites in new laws on computer hacking (Casper.Dik@....COM)
SSH bypassing in Phishing (Gadi Evron <ge@...uxbox.org>)
Re: Quarantine your infected users spreading malware ("Marcus Aurelius" <aur.marcus@...il.com>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] (Kevin Waterson <kevin@...ania.net>)
iDefense Security Advisory 02.24.06: SCO Unixware Setuid ptrace Local Privilege Escalation Vulnerability (labs-no-reply <labs-no-reply@...fense.com>)
TSLSA-2006-0008 - multi (Trustix Security Advisor <tsl@...stix.org>)
TSLSA-2006-0010 - multi (Trustix Security Advisor <tsl@...stix.org>)
Re: Vulnerabilites in new laws on computer hacking (Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>)
Mambo Multiple Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
[eVuln] Guestex XSS Vulnerability (alex@...ln.com)
RE: Vulnerabilites in new laws on computer hacking (dave <fla.linux@...il.com>)

February 25 (16 messages)

fwd: SuSE Security Announcement: heimdal (SUSE-SA:2006:011) (Dave McKinney <dm@...urityfocus.com>)
[FLSA-2006:138098] Updated nfs-utils package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:158543] Updated gaim package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:176731] Updated perl packages fix security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Advisory: Pentacle In-Out Board <= 6.03 (login.asp) Authencation ByPass Vulnerability (nukedx@...edx.com)
Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.asp newsid) Remote SQL Injection Vulnerability (nukedx@...edx.com)
Advisory: ICQmail.com & Mail2World.com (ms_inbox.asp Current_folder) XSS vulnerability (nukedx@...edx.com)
Advisory: eZ publish <= 3.7.3 (imagecatalogue module) XSS vulnerability (nukedx@...edx.com)
[ MDKSA-2005:048 ] - Updated mplayer packages fix integer overflow vulnerabilities (security@...driva.com)
NSA Group Security Advisory NSAG-№201-25.02.2006 Vulnerability SPiD v1.3.1 (NSA Group <vulnerability@...g.ru>)
NSA Group Security Advisory NSAG-№202-25.02.2006 Vulnerability WEBSITE GENERATOR 3.3 (NSA Group <vulnerability@...g.ru>)
Re: [funsec] SSH bypassing in Phishing (Florian Weimer <fw@...eb.enyo.de>)
ArGoSoft FTP server remote heap overflow (Jerome Athias <jerome.athias@...e.fr>)
[waraxe-2006-SA#047] - Evading sql-injection filters in phpNuke 7.8 (come2waraxe@...oo.com)
PwsPHP Injection SQL on Index.php (papipsycho@...mail.com)
SQL Injection in DCI-Taskeen (xx_hack_xx_2004@...mail.com)

February 26 (2 messages)

[ GLSA 200602-13 ] GraphicsMagick: Format string vulnerability (Thierry Carrez <koon@...too.org>)
[ GLSA 200602-14 ] noweb: Insecure temporary file creation (Thierry Carrez <koon@...too.org>)

February 27 (37 messages)

Re: Amazon phishing scam on Yahoo servers (Vincent Archer <archer@...ug.org>)
Re: DarkStarlings.com XSS Vulnerability (webmaster@...kstarlings.com)
Re: Amazon phishing scam on Yahoo servers (Stefan Kelm <stefan.kelm@...orvo.de>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] ("Thomas M. Payerle" <payerle@...sics.umd.edu>)
RE: Vulnerabilites in new laws on computer hacking ("Craig Wright" <cwright@...syd.com.au>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] ("Jamie Riden" <jamie.riden@...il.com>)
Re: H&R Block contact ("Stan Bubrouski" <stan.bubrouski@...il.com>)
Re: Amazon phishing scam on Yahoo servers (Elizabeth Zwicky <zwicky@...atcircle.com>)
WebEx (Terminal Entry <Security@...dro.net>)
Re: Vulnerabilites in new laws on computer hacking (Jure Koren <jure@...bix.org>)
Re: WebEx (A-d-F <adf@...e511.com>)
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] ("Matthew Schiros" <schiros@...il.com>)
Research paper on covert channels (matthijs@...t.biz)
Re: Quarantine your infected users spreading malware (Dana Hudes <dhudes@...es.org>)
[USN-258-1] PostgreSQL vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Archive_Zip (Zip file management class) Directory traversal (h e <het_ebadi@...oo.com>)
Norton Monitoring Systems funny problems ("Alexander Hristov" <joffer@...il.com>)
Re: PwsPHP Injection SQL on Index.php (zeta_2_@...mail.com)
Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusion (kingofska@...il.com)
Thomson SpeedTouch 500 modems vulnerable to XSS (preben@...chcom.no)
[eVuln] Quirex Arbitrary File Disclosure Vulnerability (alex@...ln.com)
Mail Transport System Professional--Open Relay Hole (Craig Morrison <craig@...hpalace.org>)
phpRPC Library Remote Code Execution (GulfTech Security Research <security@...ftech.org>)
[SECURITY] [DSA 982-1] New gpdf packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
2 SQL Injection in Fantastic News (S3ude@...mail.com)
CGI Calendar XSS Vulnerability (revnic@...il.com)
Re: [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities (tachyon@...hyondecay.net)
Secunia Research: ArGoSoft Mail Server Pro viewheaders Script Insertion (Secunia Research <remove-vuln@...unia.com>)
Knowledgebases Remote Command Exucetion (botan@...uxmail.org)
[ISecAuditors Advisories] IMAP/SMTP Injection in SquirrelMail (ISecAuditors Security Advisories <advisories@...cauditors.com>)
2 SQL Injection in d3jeeb (S3ude@...mail.com)
directory traversal in DirectContact 0.3b (Donato Ferrante <fdonato@...istici.org>)
PixelArtKingdom TopSites Remote Command Exucetion (botan@...uxmail.org)
Re: Bypass Fortinet anti-virus using FTP (VulnWatch@...tinet.com)
[eVuln] PerlBlog Multiple Vulnerabilities (alex@...ln.com)
[ MDKSA-2006:049 ] - Updated squirrelmail packages fix vulnerabilities (security@...driva.com)
NETGEAR WGT624 Wireless DSL router default user name/password vulnerability (info@...mintell.com)

February 28 (27 messages)

NETGEAR WGT624 Wireless DSL Firewall/Router vulnerability (info@...mintel.com)
[FLSA-2006:157366] Updated PostgreSQL packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:175818] Updated udev packages fix a security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:177326] Updated mod_auth_pgsql package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:177694] Updated auth_ldap package fixes security issue (fedora-legacy-announce@...hat.com)
[FLSA-2006:181014] Updated gnutls packages fix a security issue (fedora-legacy-announce@...hat.com)
Re: URL filter bypass in Fortinet (VulnWatch@...tinet.com)
recursive DNS servers DDoS as a growing DDoS problem (Gadi Evron <ge@...uxbox.org>)
Fedex Kinkos Smart Card Authentication Bypass (Lance James <bugtraq@...urescience.net>)
[ MDKSA-2005:050 ] - Updated unzip packages fix vulnerabilities (security@...driva.com)
[SECURITY] [DSA 983-1] New pdftohtml packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
WordPress 2.0.1 Multiple Vulnerabilities (k4p0k4p0@...mail.com)
Sourceforge XSS (liz0@...mail.com)
Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability (James Garrison <jhg@...ensgroup.com>)
FarsiNews 2.5Pro Exploit (hessamx@...samx.net)
EJ3 TOPo - Cross Site Scripting Vulnerability (mail@...usemreyilmaz.com)
MyBB 1.3 NewSQL Injection (o.y.6@...mail.com)
QwikiWiki v1.4 XSS Vulnerability (drdeath_2006@...uxmail.org)
Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities (Renaud Lifchitz <r.lifchitz@...dream.com>)
(PHP) imap functions bypass safemode and open_basedir restrictions (ced.clerget@...e.fr)
(PHP) mb_send_mail security bypass (ced.clerget@...e.fr)
[security bulletin] SSRT061118 rev.1 - HP System Management Homepage (SMH) Running on Windows: Remote Unauthorized Access (security-alert@...com)
Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability (Adam Chesnutt <icetre@...italfreezer.net>)
Virex on-access scanning unreliable (hahn@...h.hu-berlin.de)
Re: Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities (Daniel Veditz <dveditz@...zio.com>)
Re: Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities (Daniel Veditz <dveditz@...zio.com>)
Re: Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities (Renaud Lifchitz <r.lifchitz@...dream.com>)

600 messages

Powered by blists - more mailing lists