bugtraq mailing list - 2006/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2006/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 8	² 9
³ 25	⁴ 36	⁵ 32	⁶ 3	⁷ 2	⁸	⁹ 18
¹⁰ 69	¹¹ 19	¹² 22	¹³ 36	¹⁴ 6	¹⁵ 33	¹⁶ 17
¹⁷ 26	¹⁸ 17	¹⁹ 39	²⁰ 23	²¹ 30	²² 12	²³ 12
²⁴ 36	²⁵ 27	²⁶ 30	²⁷ 12	²⁸ 18	²⁹ 11	³⁰ 2

Messages by day:

April 1 (8 messages)

Kazaa ("Ruiz, Rolando" <rolando_ruiz@...aviation.com>)
Mis-diagnosed XSS bugs hiding worse issues due to PHP feature ("Steven M. Christey" <coley@...re.org>)
Re: Kazaa (James_gmail-ij <ij3n0spam@...il.com>)
linksubmit <= All version Html Tag Injector in index.php (ali@...kerz.ir)
Re: recursive DNS servers DDoS as a growing DDoS problem (Gadi Evron <ge@...uxbox.org>)
SQuery <= 4.5 Remote File Inclusion Exploit (uid0@...loitercode.com)
Re: [Full-disclosure] Mis-diagnosed XSS bugs hiding worse issues due to PHP feature ("Siegfried" <admin@...e-h.fr>)
RE: recursive DNS servers DDoS as a growing DDoS problem (gboyce <gboyce@...belly.com>)

April 2 (9 messages)

FleXiBle Development Script Remote Command Exucetion And XSS Attacking (botan@...uxmail.org)
Re: Mis-diagnosed XSS bugs hiding worse issues due to PHP feature ("Siegfried" <admin@...e-h.fr>)
Re: Re: Re: phpBB 2.06 search.php SQL injection (theguywhocouldwipeyourphpBB@...kersworlddomination.com)
DoS-ing sysklogd? (Milen Rangelov <mrangelov@...bul.bg>)
PHPNuke-Clan 3.0.1 Remote File Inclusion Exploit (uid0@...loitercode.com)
GeSWall 2.2 – Free Intrusion Prevention System for Windows (GentleSecurity Team <gsw@...tlesecurity.com>)
Re: [HV-PAPER] Anti-Phishing Tips You Should Not Follow (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Paul Stepowski <p.stepowski@....edu.au>)
SiteMan <= All version SQL injection in admin_login.asp (ali@...kerz.ir)

April 3 (25 messages)

[USN-266-1] dia vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Phpwebgallery <= 1.4.1 SQL injection Vulnerability (t4h4@...uxmail.org)
Secunia Research: AN HTTPD Script Source Disclosure Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Re: Critical PHP bug - act ASAP if you are running web with sensitive data (Moriyoshi Koizumi <moriyoshi@...wakwak.com>)
Re: On product vulnerability history and vulnerability complexity (Crispin Cowan <crispin@...ell.com>)
[USN-267-1] mailman vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 1000-2] New Apache2::Request packages fix denial of service (joey@...odrom.org (Martin Schulze))
Another Internet Explorer Address Bar Spoofing Vulnerability (hainamluke@...oo.com)
Hosting Controller AccountActions.asp and saveuploadfiles.asp vulns (PoC) (paolo.difebbo@...il.com)
Flaw in commonly used bash random seed method (coderpunk <coderpunk@...il.com>)
Re: Mis-diagnosed XSS bugs hiding worse issues due to PHP feature (cxib@...urityreason.com)
RE: DoS-ing sysklogd? ("Justin Shore" <justin.shore@...bcs.com>)
VWar <= 1.5.0 R12 Remote File Inclusion Exploit (uid0@...loitercode.com)
Re: Critical PHP bug - act ASAP if you are runningweb with sen ("mailinglist mailinglist" <email-fulldisclosure@...mail.com>)
Multiple Vulnerabilities in LucidCMS (crasher@...oak.or.id)
Format string in Doomsday 1.8.6 (Luigi Auriemma <aluigi@...istici.org>)
MyBB 1.10 New CrossSiteScripting (o.y.6@...mail.com)
Re: Flaw in commonly used bash random seed method (Matthijs <thotter@...il.com>)
Re: On product vulnerability history and vulnerability complexity (Gadi Evron <ge@...uxbox.org>)
RE: recursive DNS servers DDoS as a growing DDoS problem ("Geo." <geoincidents@....net>)
Re: On product vulnerability history and vulnerability complexity ("Steven M. Christey" <coley@...us.mitre.org>)
SQL Injection in Softbiz Image Gallery (xx_hack_xx_2004@...mail.com)
Re: On product vulnerability history and vulnerability complexity (ArkanoiD <ark@...ex.net>)
Re: WebVulnCrawl searching excluded directories for hackable web servers ("Dennis Brown" <dennis.brown@...il.com>)
Re: Critical PHP bug - act ASAP if you are running web with sensitive data (Jasper Bryant-Greene <jasper@...um.co.nz>)

April 4 (36 messages)

Re: Cantv/Movilnet's Web SMS vulnerability. (raven <locrideweb@...ero.it>)
Re: Critical PHP bug - act ASAP if you are running web with sensitive data (Jasper Bryant-Greene <jasper@...um.co.nz>)
Re: On classifying attacks (john mullee <jmullee@...oo.com>)
Re: recursive DNS servers DDoS as a growing DDoS problem ("Geo." <geoincidents@....net>)
Re: On product vulnerability history and vulnerability complexity ("Forrest J. Cavalier III" <mibsoft@...software.com>)
PIRANA exploitation framework and SMTP content filter security (Jean-Sébastien Guay-Leroux <jean-sebastien@...y-leroux.com>)
Barracuda ZOO archiver security bug leads to remote compromise (Jean-Sébastien Guay-Leroux <jean-sebastien@...y-leroux.com>)
Barracuda LHA archiver security bug leads to remote compromise (Jean-Sébastien Guay-Leroux <jean-sebastien@...y-leroux.com>)
[ MDKSA-2006:064 ] - Updated MySQL packages fix logging bypass vulnerability (security@...driva.com)
[ MDKSA-2006:062 ] - Updated dia packages fix buffer overflow vulnerabilities (security@...driva.com)
Re: recursive DNS servers DDoS as a growing DDoS problem (Anton Ivanov <arivanov@...segv.cx>)
ReloadCMS <= 1.2.5stable Cross site scripting / remote command execution (rgod@...istici.org)
SYMSA-2006-002: McAfee WebShield SMTP Format String Vulnerability (CS_Advisories Mailbox <CS_Advisories_Mailbox@...antec.com>)
Bypassing ISA Server 2004 with IPv6 (Romain.Le.Guen@...ainl.com)
[ GLSA 200604-01 ] MediaWiki: Cross-site scripting vulnerability (Stefan Cornelius <dercorny@...too.org>)
Re: Critical PHP bug - act ASAP if you are running web with sensitive data ("John Bond" <john.r.bond@...il.com>)
[SEC-1 LTD] HP Colour LaserJet 2500 and 4600 Toolbox Directory Traversal Vulnerability ("Richard Horsman" <richardh@...-1.com>)
Re: Flaw in commonly used bash random seed method (Dave English <dave.english@...s.net>)
Re: Bypassing ISA Server 2004 with IPv6 (3APA3A <3APA3A@...URITY.NNOV.RU>)
RUXCON 2006 Call for Papers (cfp@...con.org.au)
SMART Technologies SynchronEyes Remote Denial of Services (dennis@...ktrace.de)
Re: recursive DNS servers DDoS as a growing DDoS problem (Anton Ivanov <arivanov@...segv.cx>)
Re: On product vulnerability history and vulnerability complexity (Gadi Evron <ge@...uxbox.org>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Anton Ivanov <arivanov@...segv.cx>)
RE: recursive DNS servers DDoS as a growing DDoS problem ("Geo." <geoincidents@....net>)
Re: On product vulnerability history and vulnerability complexity ("Steven M. Christey" <coley@...us.mitre.org>)
Re: On product vulnerability history and vulnerability complexity (Javor Ninov <drfrancky@...urax.org>)
RE: recursive DNS servers DDoS as a growing DDoS problem (Måns Nilsson <mansaxel@...et.se>)
Re: DoS-ing sysklogd? (Bernhard Fischer <bernhard.fischer@...stpoelten.ac.at>)
Re: DoS-ing sysklogd? (Christophe Garault <bugtraq@...ault.org>)
[security bulletin] HPSBPI2109 SSRT061141 rev.1 - HP Color LaserJet 2500 and 4600 Toolbox Running on Microsoft Windows Remote Unauthorized… (security-alert@...com)
[ GLSA 200604-02 ] Horde Application Framework: Remote code execution (Stefan Cornelius <dercorny@...too.org>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Tim <tim-security@...tinelchicken.org>)
[ GLSA 200604-03 ] FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module (Matthias Geerdsen <vorlon@...too.org>)
Buffer-overflow in Ultr@VNC 1.0.1 viewer and server (Luigi Auriemma <aluigi@...istici.org>)
RE: recursive DNS servers DDoS as a growing DDoS problem ("Thomas Guyot-Sionnest" <Thomas@...go.com>)

April 5 (32 messages)

Re: Flaw in commonly used bash random seed method (Matthijs <thotter@...il.com>)
Re: Another Internet Explorer Address Bar Spoofing Vulnerability (franz@...mail.com)
RE: recursive DNS servers DDoS as a growing DDoS problem ("Geo." <geoincidents@....net>)
ArabPortal 2.0.1 Stable [ 9 CrossSiteScripting & 1 SQL Injection ] MultBugz (o.y.6@...mail.com)
[FLSA-2006:152873] Updated xine package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:152896] Updated mod_python package fixes a security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Re: Flaw in commonly used bash random seed method (Matthijs <thotter@...il.com>)
[FLSA-2006:156139] Updated tcpdump packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:156290] Updated cyrus-imapd packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:170411] Updated imap packages fix security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:183571-1] Updated tar package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:183571-2] Updated tar package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:180159] Updated unzip package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:184074] Updated pine package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2006:184098] Updated libc-client packages fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[Updated] [FLSA-2006:186277] Updated sendmail packages fix security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
NOD32 local privilege escalation vulnerability (visitbipin@...mail.com)
Another way to spoof Internet Explorer Address Bar (hainamluke@...oo.com)
Re: recursive DNS servers DDoS as a growing DDoS problem (Marco Ivaldi <raptor@...eadbeef.info>)
Re: Limbo CMS code execution (gergero@...urityfocus.com)
Black Hat Call for Papers and Registration now open (Jeff Moss <jmoss@...ckhat.com>)
[Full-disclosure] PIRANA exploitation framework and SMTP contentfilter security (Jean-Sébastien Guay-Leroux <jean-sebastien@...y-leroux.com>)
[SECURITY] [DSA 1022-1] New storebackup packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Jim Pingle <jim@...isp.com>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Tim <tim-security@...tinelchicken.org>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Simon Boulet <simon@...talgeek.com>)
[ECHO_ADV_27$2006] AngelineCMS 0.8.1 Installpath Remote File Inclusion (eufrato@...il.com)
[ECHO_ADV_27$2006] AngelineCMS 0.8.1 Installpath Remote File Inclusion (eufrato@...il.com)
Re: Flaw in commonly used bash random seed method ("Dave Korn" <davek_throwaway@...mail.com>)
Re: Buffer-overflow in Ultr@VNC 1.0.1 viewer and server (jalvare7@...astur.es)
Re: Buffer-overflow in Ultr@VNC 1.0.1 viewer and server (Luigi Auriemma <aluigi@...istici.org>)
[ GLSA 200604-04 ] Kaffeine: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

April 6 (3 messages)

[ GLSA 200604-05 ] Doomsday: Format string vulnerability (Stefan Cornelius <dercorny@...too.org>)
Re: Critical PHP bug - act ASAP if you are running web with sensitive data (Moriyoshi Koizumi <moriyoshi@...wakwak.com>)
[USN-268-1] Kaffeine vulnerability (Martin Pitt <martin.pitt@...onical.com>)

April 7 (2 messages)

Re: Format string in Doomsday 1.8.6 (Alexey Dobriyan <adobriyan@...il.com>)
[ GLSA 200604-06 ] ClamAV: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

April 9 (18 messages)

Linux Kernel Local DoS vulnerability. (fingerout <fingerout@...il.com>)
Re: Bypassing ISA Server 2004 with IPv6 (Christine Kronberg <seeker@...lla.de>)
[SECURITY] [DSA 1024-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Cisco Security Advisory: Cisco 11500 Content Services Switch HTTP Request Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[ MDKSA-2006:066 ] - Updated FreeRADIUS packages fix off-by-one overflow vulnerabilty (security@...driva.com)
Autonomous LAN party File iNclusion (codexploder@...uxmail.org)
Xss In SaphpLesson3.0 (w3._@...mail.com)
[eVuln] Null news SQL Injection Vulnerability (alex@...ln.com)
Re: recursive DNS servers DDoS as a growing DDoS problem (Jim Pingle <jim@...isp.com>)
Sire 2.0 Nws Remote File inclusion & Arbitary Files Upload (simo64@...il.com)
[Kaffeine Security Advisory] Heap based buffer overflow in http_peek() (Dirk Mueller <mueller@....org>)
Black Hat Call for Papers and Registration now open (Jeff Moss <jmoss@...ckhat.com>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Gadi Evron <ge@...uxbox.org>)
Re: recursive DNS servers DDoS as a growing DDoS problem ("Geo." <geoincidents@....net>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Ross Wheeler <rossw@...ury.net.au>)
Re: FleXiBle Development Script Remote Command Exucetion And XSS Attacking ("Steven M. Christey" <coley@...re.org>)
[eVuln] phpNewsManager Multiple SQL Injections (alex@...ln.com)
Re: Bypassing ISA Server 2004 with IPv6 ("offtopic" <offtopic@...l.ru>)

April 10 (69 messages)

Welcome to XCon2006 in China! (xcon@...cus.org)
[SECURITY] [DSA 1031-1] New cacti packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 946-2] New sudo packages fix privilege escalation (joey@...odrom.org (Martin Schulze))
SQL Injection in Chipmunk Guestbook (dr.jr7@...mail.com)
google xss (almfnod@...ab.com)
[security bulletin] HPSBUX02108 SSRT061133 rev.3 - HP-UX running Sendmail, Remote Execution of Arbitrary Code (security-alert@...com)
RE: Another way to spoof Internet Explorer Address Bar ("Memisyazici, Aras" <amemisya@...edu>)
[ MDKSA-2006:068 ] - Updated mplayer packages fix integer overflow vulnerabilities (security@...driva.com)
Re: recursive DNS servers DDoS as a growing DDoS problem (Erwan David <Erwan.David@...sted-logic.fr>)
Re: Re: Another Internet Explorer Address Bar Spoofing Vulnerability (pc.tech2@...cast.net)
[KAPDA::#38] - MyBB 1.1.0~functions_post.php~XSS Attack (addmimistrator@...il.com)
[eVuln] VSNS Lemon Multiple Vulnerabilities (alex@...ln.com)
PHPMyChat 0.15.0dev "SYS enter" remote commands xctn (not properly patched from previous versions) (rgod@...istici.org)
[ MDKSA-2006:065 ] - Updated kaffeine packages fix remote buffer overflow vulnerability (security@...driva.com)
Matt Wright Guestbook Xss Script İnjection (liz0@...mail.com)
[eVuln] vCounter - sourceworkshop SQL Injection Vulnerability (alex@...ln.com)
LayerOne 2006 - Finalized Speaker Line-Up Announced ("Layer One" <layeronecfp@...il.com>)
PHPMyChat <= 0.14.5 remote commands execution (rgod@...istici.org)
Re: Re: Bypassing ISA Server 2004 with IPv6 (Romain.Le-Guen@....fr)
Re: SQL injection in Invision Power Board v2.1.5 (optix_prorat100@...oo.com)
[SECURITY] [DSA 1028-1] New libimager-perl packages fix denial of service (joey@...odrom.org (Martin Schulze))
[ECHO_ADV_28$2006] Clever Copy <= 3.0 Connect.inc Critical Information Disclosure (eufrato@...il.com)
[ MDKSA-2006:067 ] - Updated clamav packages fix vulnerabilities (security@...driva.com)
MAXDEV CMS Multiple vulnerabilities (king_purba@...oo.co.uk)
[SECURITY] [DSA 1018-2] New Linux kernel 2.4.27 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: recursive DNS servers DDoS as a growing DDoS problem (Anton Ivanov <arivanov@...segv.cx>)
[eVuln] newsletter - sourceworkshop SQL Injection Vulnerability (alex@...ln.com)
Shadowed Portal Cross Site Scripting (liz0@...mail.com)
[SECURITY] [DSA 1027-1] New mailman packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: Another Internet Explorer Address Bar Spoofing Vulnerability (sh0rtie <this.is@...il.com>)
Re: Flaw in commonly used bash random seed method (Steve VanDevender <stevev@...adecimal.uoregon.edu>)
XSS Bug in Cherokee Webserver (rubengarrote@...miniun.com)
[SECURITY] [DSA 1029-1] New libphp-adodb packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Google Reader "preview" and "lens" script improper feed validation ("Debasis Mohanty" <debasis@...kingspirits.com>)
Virtual War File İnclusion (liz0@...mail.com)
Cisco Security Advisory: Cisco Optical Networking System 15000 series and Cisco Transport Controller Vulnerabilities (Cisco Systems Product Security Incident Re…)
[SECURITY] [DSA 1030-1] New moodle packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Multiple vulnerability in jupiter CMS (king_purba@...oo.co.uk)
[SECURITY] [DSA 1026-1] New sash packages fix potential arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1023-1] New kaffeine packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: Bios Information Leakage (darmawan_salihun@...dents.itb.ac.id)
[security bulletin] HPSBUX02110 SSRT061110 rev.1 - HP-UX Running wu-ftpd Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBUX02111 SSRT061132 rev.1 - HP-UX su(1) Local Unauthorized Access (security-alert@...com)
[SECURITY] [DSA 1025-1] New dia packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
RE: recursive DNS servers DDoS as a growing DDoS problem ("Geo." <geoincidents@....net>)
IE6 Crash (tel@...rdtech.org)
[Overflow.pl] Clam AntiVirus Win32-UPX Heap Overflow (not default configuration) (Damian Put <pucik@...rflow.pl>)
Re: IE6 Crash (H D Moore <sflist@...italoffense.net>)
XMB Forum 1.9.5-Final XSS (r0xes.ratm@...il.com)
Oracle read-only user can insert/update/delete data via specially crafted views (ak@...-database-security.com)
Re[2]: Bypassing ISA Server 2004 with IPv6 (3APA3A <3APA3A@...URITY.NNOV.RU>)
TUGZip Archive Extraction Directory traversal (h e <het_ebadi@...oo.com>)
Vulnerabilities in SPIP (crasher@...oak.or.id)
PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection (rgod@...istici.org)
phpinfo() Cross Site Scripting PHP 5.1.2 and 4.4.2 (cxib@...urityreason.com)
function *() php/apache Crash PHP 4.4.2 and 5.1.2 (cxib@...urityreason.com)
tempnam() open_basedir bypass PHP 4.4.2 and 5.1.2 (cxib@...urityreason.com)
copy() Safe Mode Bypass PHP 4.4.2 and 5.1.2 (cxib@...urityreason.com)
MyBB 1.10 'newthread.php' < CrossSiteScripting > (o.y.6@...mail.com)
Myspace.com - Intricate Script Injection (silentproducts@...il.com)
Re: Bypassing ISA Server 2004 with IPv6 ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: google xss ("Andy Meyers" <andy.meyers@...hmail.com>)
Re: Bypassing ISA Server 2004 with IPv6 ("Thor (Hammer of God)" <thor@...merofgod.com>)
Vegadns blind sql injection and cross site scripting (king_purba@...oo.co.uk)
PHPList <= 2.10.2 remote commands execution (rgod@...istici.org)
[eVuln] phpNewsManager Multiple SQL Injections (alex@...ln.com)
Jbook Cross Site Scripting (root__@...uxmail.org)
phpMyForum Cross Site Scripting & CRLF injection (root__@...uxmail.org)
PHPWebGallery Multiple Cross Site Scripting Vulnerabilities (root__@...uxmail.org)

April 11 (19 messages)

Dokeos 1.6.4 SQL Injection Vulnerability ("Alvaro Olavarria" <aolavarria@...ure.cl>)
JetPhoto Multiple Cross-Site Scripting Vulnerabilitie ("0o_zeus_o0 elitemexico.org" <zeus.olimpusklan@...il.com>)
Realplayer .SWF Multiple Remote Memory Corruption Vulnerabilities (Sowhat <smaillist@...il.com>)
[USN-269-1] xscreensaver vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: PHPList <= 2.10.2 remote commands execution (secfoc@...can.co.uk)
Re: function *() php/apache Crash PHP 4.4.2 and 5.1.2 (Michal Zalewski <lcamtuf@...ne.ids.pl>)
IMF 2006 - Submission Deadline Extension (Oliver Goebel <Goebel@...T.Uni-Stuttgart.DE>)
Confixx 3.1.2 <= Cross Site Scripting Vuln (sn4k3.23@...il.com)
INDEXU <= 5.0.1 (theme_path)and (base_path) Remote File Inclusion Exploit (selfar2002@...mail.com)
[ MDKSA-2006:069 ] - Updated openvpn packages fix vulnerability (security@...driva.com)
Multiple vulnerabilities in Blur6ex (crasher@...oak.or.id)
phpListPro <= 2.0 - Remote File Include Vulnerability (admin@...orsecurity.de)
[eVuln] [V]Book Multiple Vulnerabilities (alex@...ln.com)
ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerability (zdi-disclosures@...m.com)
Manila <= 9.5 - XSS Vulnerabilities (d4igoro@...il.com)
Confixx 3.1.2 <= SQL Injection (sn4k3.23@...il.com)
IBM (ptt@...nternet.com)
Tritanium Bulletin Board 1.2.3 - XSS (d4igoro@...il.com)
[eVuln] VNews Multiple Vulnerabilities (alex@...ln.com)

April 12 (22 messages)

Re: google xss ("Jim Ley" <jim@...bering.com>)
Re: Re: PHPList <= 2.10.2 remote commands execution (rg.viza@...il.com)
[SRC-Telindus advisory] - HP System Management Homepage Remote Unauthorized Access (SRC Telindus <research@....telindus.com>)
AzDGVote File inclusion (selfar2002@...mail.com)
Re: Bypassing ISA Server 2004 with IPv6 (noreply@...ainl.com)
[ MDKSA-2006:071 ] - Updated xscreensaver packages fix clear-text password vulnerability (security@...driva.com)
[ MDKSA-2006:070 ] - Updated openvpn packages fix vulnerability (security@...driva.com)
Old issue- MS NT PPTP/RAS DoS (SanjayR <sanjayr@...oto.com>)
Autogallery Multiple Cross-Site Scripting Vulnerabilitie ("0o_zeus_o0 elitemexico.org" <zeus.olimpusklan@...il.com>)
IT Underground, London 2006 - call for papers (<it_underground@...eta.pl>)
Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability (Sowhat <smaillist@...il.com>)
Re: google xss (pagvac <unknown.pentester@...il.com>)
SAXoPRESS - directory traversal (securiteam@...asec.no)
2nd European Conference on Computer Network Defense (EC2ND) ("Blyth A J C (Comp)" <ajcblyth@...m.ac.uk>)
Re: Buffer-overflow in Ultr@VNC 1.0.1 viewer POC (phaas@...spin.com)
[SECURITY] [DSA 1032-1] New zope-cmfplone packages fix unprivileged data manipulation (Moritz Muehlenhoff <jmm@...ian.org>)
[eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities (alex@...ln.com)
Re: function *() php/apache Crash PHP 4.4.2 and 5.1.2 ("Steven M. Christey" <coley@...re.org>)
Simplog <=0.9.2 multiple vulnerabilities (rgod@...istici.org)
[SECURITY] [DSA 1033-1] New horde3 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Exploiting out of memory crashes and null pointers [was: Re: function *() php/apache Crash PHP 4.4.2 and 5.1.2] (86400s@...im.net)
Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting ("Esteban Martinez Fayo" <secemf@...oo.com.ar>)

April 13 (36 messages)

[USN-270-1] xpdf vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
SEC Consult SA-20060314 :: Opera Browser CSS Attribute Integer Wrap / Buffer Overflow (Bernhard Mueller <research@...-consult.com>)
[security bulletin] HPSBUX02108 SSRT061133 rev.6 - HP-UX running Sendmail, Remote Execution of Arbitrary Code (security-alert@...com)
Clansys Multiple Xss Vulnerabilities (Soothackers@...il.com)
Re: phpWebsite <= SQL Injection (friend.php) & (article.php) (shaun@...isdesign.co.uk)
PatroNet CMS Xss Vuln (Soothackers@...il.com)
Windows Help Heap Overflow (c0ntexb@...il.com)
SimpleBBS v1.1(posts.php) remote command execution (stormhacker@...mail.com)
[BuHa-Security] DoS Vulnerability in Firefox 1.5.0.1 (bugtraq@...ph3us.org)
ZDI-06-008: Novell GroupWise Messenger Accept-Language Buffer Overflow (zdi-disclosures@...m.com)
[eVuln] qliteNews SQL Injection Vulnerability (alex@...ln.com)
[BuHa-Security] Stack Based Buffer Overflow Vulnerability in Amaya 9.4 (bugtraq@...ph3us.org)
[BuHa-Security] Stack Based Buffer Overflow Vulnerability in Amaya 9.4 #2 (bugtraq@...ph3us.org)
Remote File Inclusion in VBulletin ImpEx (dr.jr7@...mail.com)
Re: SEC Consult SA-20060314 :: Opera Browser CSS Attribute Integer Wrap / Buffer Overflow (Thierry Zoller <Thierry@...ler.lu>)
[BuHa-Security] Multiple Vulnerabilities in MS IE 6.0 SP2 (bugtraq@...ph3us.org)
phpWebSite 0.10.? (topics.php) Remote SQL Injection Exploit (selfar2002@...mail.com)
Re: Multiple vulnerabilities in Blur6ex ("Steven M. Christey" <coley@...re.org>)
RevoBoard [email] tag XSS (r0xes.ratm@...il.com)
Microsoft DNS resolver: deliberately sabotaged hosts-file lookup ("Dave Korn" <davek_throwaway@...mail.com>)
Re: google xss ("Vladimir Levijev" <vladimir.levijev@...il.com>)
Re: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup ("Brandon S. Allbery KF8NH" <allbery@....cmu.edu>)
Recon 2006: speaker lineup announcement (Recon <hfortier@...on.cx>)
Re: Confixx 3.1.2 <= SQL Injection (iovdin@...oft.com)
MyBB 1.10 New XSS ' member.php ' (o.y.6@...mail.com)
Re: function *() php/apache Crash PHP 4.4.2 and 5.1.2 (Michal Zalewski <lcamtuf@...ne.ids.pl>)
QuickBlogger v1.4 Cross-Site Scripting (botan@...uxmail.org)
RE: IBM ("Michael Scheidell" <scheidell@...nap.net>)
Re: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup ("Stan Bubrouski" <stan.bubrouski@...il.com>)
Re: Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Dave Korn" <davek_throwaway@...mail.com>)
phpMyAdmin 2.7.0-pl1 (kr4ch@....de)
Re: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup (A.L.M.Buxey@...ro.ac.uk)
Re: Jupiter CMS <= 1.1.5 multiple XSS attack vectors. (anonss@...naa.com)
MyBB 1.10 New CrossSiteScripting ' member.php ' (o.y.6@...mail.com)
SaphpLesson 2.0 (forumid) Remote SQL Injection Exploit (selfar2002@...mail.com)
Secunia Research: Adobe Document Server for Reader Extensions Multiple Vulnerabilities (Secunia Research <vuln-remove@...unia.com>)

April 14 (6 messages)

Re: IBM (stend@...ibm.com)
TalentSoft Web+Shop Path Disclosure (revnic@...il.com)
Re: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup (dumdidumdideldey <user05@...erwelt.de>)
Re: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup (Joachim Schipper <j.schipper@...h.uu.nl>)
Re: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup ("J.A. Terranson" <measl@....org>)
[ GLSA 200604-07 ] Cacti: Multiple vulnerabilities in included ADOdb (Thierry Carrez <koon@...too.org>)

April 15 (33 messages)

Re: RE: IBM (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[eVuln] RedCMS Multiple XSS and SQL Injection Vulnerabilities (alex@...ln.com)
Camino Browser HTML Parsing Null Pointer Dereference Denial of Service Vulnerability (izimask@...hackademy.net)
PowerClan 1.14 - SQL Injection (d4igoro@...il.com)
Re: Simplog <=0.9.2 multiple vulnerabilities (Jeremy Ashcraft <jashcraft@...ate.com>)
[eVuln] aWebNews Multiple XSS and SQL Injection Vulnerabilities (alex@...ln.com)
Vulnerabilities in lifetype (crasher@...oak.or.id)
ZDI-06-010: Mozilla Firefox CSS Letter-Spacing Heap Overflow Vulnerability (zdi-disclosures@...m.com)
Vulnerabilities in Papoo (crasher@...oak.or.id)
Vulnerabilities in MODx (crasher@...oak.or.id)
Farsinews Cross-Site Scripting & Path disclosure vulnerability (aminrayden@...oo.com)
osCommerce "extras/" information/source code disclosure (rgod@...istici.org)
Re: phpMyAdmin 2.7.0-pl1 (Kevin Waterson <kevin@...ania.net>)
Encyclopedia <= 3.0 (login.php) CrossSite Scripting - XSS (n0m3rcy@...mail.org)
phpBB Admin command execution (noch22@...il.com)
Serendipity Blog vuln (moep <moep2mail@...l.ru>)
[SECURITY] [DSA 1034-1] New horde2 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
phpBB template file code execution (noch22@...il.com)
Re: Re: function *() php/apache Crash PHP 4.4.2 and 5.1.2 (sp3x@...urityreason.com)
Avast Linux Home Edition (vulnerability on a temporary folder creation) ("Julien L." <jlanthea@...mail.com>)
Firefox 1.5.0.1 Password Manager Arbtirary User Browsing History Disclosure (franz@...mail.com)
Re: phpWebSite 0.10.? (topics.php) Remote SQL Injection Exploit (Kevin Wilcox <kevin@....appstate.edu>)
Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability (tranceformer@...msonguard.net)
PAJAX Remote Code Injection and File Inclusion Vulnerability (RedTeam Pentesting <release@...team-pentesting.de>)
Xss In ar-blog v 5.2 (W3._@...mail.com)
RE: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Derek Soeder" <dsoeder@...e.com>)
planetSearch+ - XSS Vulnerabilities (d4igoro@...il.com)
Re: [ECHO_ADV_27$2006] Indexu <= 5.0.1 Remote File Inclusion (robert@...rstorm.com)
Re: SAXoPRESS - directory traversal aka Saxotech Online (securiteam@...asec.no)
Re: Sql Injection in Confixx 3.06 & 3.08 & 3.?? ? (iovdin@...oft.com)
a Yahoo Vulnerability (r57shell@...il.com)
Re[2]: Bypassing ISA Server 2004 with IPv6 (Christine Kronberg <seeker@...lla.de>)
Dokeos 1.6.4 SQL Injection Vulnerability ("Alvaro Olavarria" <aolavarria@...ure.cl>)

April 16 (17 messages)

manila.userland cross site scriptable (Aaron Kaplan <aaron@...res.org>)
Re: QuickBlogger v1.4 Cross-Site Scripting ("Steven M. Christey" <coley@...re.org>)
[KAPDA]MyBB1.1.0~global.php~ParameterExtracting (addmimistrator@...il.com)
[KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack (addmimistrator@...il.com)
Re: Firefox 1.5.0.1 Password Manager Arbtirary User Browsing History Disclosure ("Eliah Kagan" <degeneracypressure@...il.com>)
[eVuln] aWebBB Multiple XSS and SQL Injection Vulnerabilities (alex@...ln.com)
[SECURITY] [DSA 1035-1] New fcheck packages fix insecure temporary file creation (Moritz Muehlenhoff <jmm@...ian.org>)
Re[3]: Bypassing ISA Server 2004 with IPv6 (3APA3A <3APA3A@...URITY.NNOV.RU>)
PHP Album <= 0.3.2.3 remote commnads execution (rgod@...istici.org)
RE: osCommerce "extras/" information/source code disclosure ("Michael Scheidell" <scheidell@...nap.net>)
Tiny Web Gallery <= 1.4 XSS (qex@...mail.org)
PhpGuestbook <= 1.0 XSS (qex@...mail.org)
FlexBB <= 0.5.7 BETA XSS (qex@...mail.org)
Boardsolution <= 1.12 XSS (qex@...mail.org)
phpFaber TopSites Script Cross-Site Scripting (botan@...uxmail.org)
Snipe Gallery <= 3.1.4 Multiple XSS (qex@...mail.org)
Re: Vulnerabilities in MOD (Victor Brilon <victor@...torland.com>)

April 17 (26 messages)

Reminder: HITBSecConf2006 CFP is closing in 2 weeks (Praburaajan <prabu@...kinthebox.org>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Thor (Hammer of God)" <thor@...merofgod.com>)
DbbS<=2.0-alpha Multiple Vulnerabilities (yamcho@...l.it)
Re: [KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack (Dariusz Kolasinski <ofi@...l.net.pl>)
Xss In bMachine 2٫7 (W3._@...mail.com)
FlexBB v0.5.5 BETA [SQL Inj] [XSS] [Login bypass] (kr4ch@....de)
Calendarix "yearcal.php" XSS Attacking (botan@...uxmail.org)
Re: Snipe Gallery <= 3.1.4 Multiple XSS (nobody@...here.com)
MyEvent Remote File Execution And XSS Attacking (botan@...uxmail.org)
BetaBoard Cross Site Scripting vulnerability (easy.mask@...il.com)
ZDI-06-009: Mozilla Firefox Tag Parsing Code Execution Vulnerability (zdi-disclosures@...m.com)
PhpWebFTP 3.2 Login Script (arko.dhar@...il.com)
[SECURITY] [DSA 1036-1] New bsdgames packages fix local privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
- PHPGraphy <= 0.9.11 "editwelcome" unauthorized access / cross site scripting - (rgod@...istici.org)
ShoutBOOK <= 1.1 XSS (qex@...mail.org)
Neuron Blog <= 1.1 XSS (qex@...mail.org)
[ GLSA 200604-08 ] libapreq2: Denial of Service vulnerability (Thierry Carrez <koon@...too.org>)
[eVuln] CzarNews XSS and Multiple SQL Injection Vulnerabilities (alex@...ln.com)
Tiny PHP forum - vulns (hessam@...samx.net)
AnimeGenesis <= XSS (qex@...mail.org)
[Argeniss] Alert - Yahoo! Webmail XSS (Cesar <cesarc56@...oo.com>)
FlexBB 0.5.5 Bypass Exploit (o.y.6@...mail.com)
Neon Responder (Dos,Exploit) (Stefan Lochbihler <steve01@...llo.at>)
Re: [Argeniss] Alert - Yahoo! Webmail XSS ("Morning Wood" <se_cur_ity@...mail.com>)
gcc 4.1 bug miscompiles pointer range checks, may place you at risk (Felix von Leitner <felix-bugtraq@...e.de>)
[eVuln] Wire Plastik wpBlog SQL Injection Vulnerability (alex@...ln.com)

April 18 (17 messages)

[SA-03] Example of Grsecurity protection avoid. (adam@...khat.org)
Re: [Argeniss] Alert - Yahoo! Webmail XSS ("Morning Wood" <se_cur_ity@...mail.com>)
Re: [Argeniss] Alert - Yahoo! Webmail XSS ("Dave \"No, not that one\" Korn" <davek_throwaway@...mail.com>)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk ("Forrest J. Cavalier III" <mibsoft@...software.com>)
RE: gcc 4.1 bug miscompiles pointer range checks, may place you at risk ("Michael Wojcik" <Michael.Wojcik@...rofocus.com>)
Linpha 1.1.0 - XSS Vulnerabilities (d4igoro@...il.com)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk (Alexander Klimov <alserkli@...ox.ru>)
Remote Xine Format String Vulnerability (c0ntexb@...il.com)
Another flaw in Firefox 1.5.0.2: to open files from remote (miky@...il.com)
Re: - PHPGraphy <= 0.9.11 "editwelcome" unauthorized access / cross site scripting - (JiM / aEGIS <jim@...is-corp.org>)
blur6ex Local File Inclusion and SQL injection . (h e <het_ebadi@...oo.com>)
axoverzicht.cgi <= XSS (qex@...mail.org)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup (Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk (jat-public01@...t.org)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk (Florian Weimer <fw@...eb.enyo.de>)
[ MDKSA-2006:072 ] - Updated kernel packages fix multiple vulnerabilities (security@...driva.com)
phpLister v. 0.4.1 XSS Attacking (botan@...uxmail.org)

April 19 (39 messages)

[KAPDA::#41] - Mambo/Joomla rss component vulnerability (alireza hassani <trueend5@...oo.com>)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk (Michael Chamberlain <michael@...mberlain.net.au>)
Multiple critical and high risk issues in Oracle's database server ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[Symantec Security Advisory] LiveUpdate for Macintosh Local Privilege Escalation (Secure@...antec.com)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk (Gabor Gombas <gombasg@...aki.hu>)
Re: GMail, Google Groups XSS Vulnerability (Steven Rakick <stevenrakick@...oo.com>)
CuteNews 1.4.1 <= Cross Site Scripting (sn4k3.23@...il.com)
SQL Injection in package SYS.DBMS_LOGMNR_SESSION (ak@...-database-security.com)
FreeBSD Security Advisory FreeBSD-SA-06:14.fpu (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[MajorSecurity]ActualAnalyzer - Remote File Include Vulnerability (admin@...orsecurity.de)
Oracle 10g 10.2.0.2.0 DBA exploit ("putosoft softputo" <hasecorp@...mail.com>)
[USN-271-1] Firefox vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
XSS Vulnerability in Guest-book script powered by Community Architect (susam.pal@...il.com)
Cisco Security Advisory: Cisco IOS XR MPLS Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: Path Disclosure and Arbitrary File Read Vulnerability in SLAB5000 (office@...bmedia.com)
Re: [KAPDA::#41] - Mambo/Joomla rss component vulnerability (rey.gigataras@...mla.org)
[security bulletin] HPSBUX02108 SSRT061133 rev.7 - HP-UX running Sendmail, Remote Execution of Arbitrary Code (security-alert@...com)
Re: Multiple vulnerabilities in Linux based Cisco products (Ilker Temir <itemir@...co.com>)
Multiple vulnerabilities in Linux based Cisco products ("assurance.com.au" <advisories+cisco200604@...urance.com.au>)
RE: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup (Mario Contestabile <marioc@...puter.org>)
RechnungsZentrale V2 - SQL injection and Remote PHP inclusion vulnerabilities (info@....org)
ThWboard <= 3 Beta 2.84 SQL Injection (Qex@...mail.org)
Cisco Security Advisory: Multiple Vulnerabilities in the WLSE Appliance (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: phpBB Admin command execution (dave.de@...l.net)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup (Paul Wouters <paul@...net.nl>)
ASPSitem <= 1.83 Remote SQL Injection Vulnerability ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
redirection vuln crawlers breed & security through obscurity (Ivan Sergio Borgonovo <mail@...thatworks.it>)
Shbablek Mail Vulnerablitiy - Cross-Site Scripting (n0m3rcy@...mail.org)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup (robsekeris@...mail.com)
WWWThread RC 3 MultBugs (o.y.6@...mail.com)
Re: RE: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup (john@...nsdomain.org)
ContentBoxx Login.php Cross-Site Scripting (botan@...uxmail.org)
Fortinet28 box does not resist has small synflood! (<testx444@...hmail.com>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup (no.spam@...house)
Re: Multiple Vulnerabilities in LucidCMS (zachofalltrades@...rceforge.net)
Tlen.PL e-mail XSS vulnerability. (koper@...s.pl)
RE: redirection vuln crawlers breed & security through obscurity ("Evans, Arian" <Arian.Evans@...hnetsecurity.com>)
Re: RE: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup (somebody@....ca)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk (Nate Eldredge <nge@...hmc.edu>)

April 20 (23 messages)

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Geo." <geoincidents@....net>)
Re: Re[2]: Bypassing ISA Server 2004 with IPv6 ("Thor (Hammer of God)" <thor@...merofgod.com>)
EasyGallery Cross-Site Scripting (botan@...uxmail.org)
Confixx SQL Injection exploit (confixx_exploit.pl) (defa <defa@...temli.org>)
Re[3]: Bypassing ISA Server 2004 with IPv6 (Christine Kronberg <seeker@...lla.de>)
[eVuln] MD News Authentication Bypass and SQL Injection Vulnerabilities (alex@...ln.com)
Re: Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotaged hosts-file lookup (somerandomaddress99@...linator.com)
[Argeniss] Oracle Database 10gR1 Buffer overflow in VERIFY_LOG procedure (Cesar <cesarc56@...oo.com>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotaged hosts-file lookup ("Jamie Riden" <jamesr@...ope.com>)
Re: Re[2]: Bypassing ISA Server 2004 with IPv6 (Christine Kronberg <seeker@...lla.de>)
SQL Injection in incredibleindia.org (susam_pal@...oo.co.in)
[eVuln] N.T. Version 1.1.0 XSS and PHP Code Insertion Vulnerabilities (alex@...ln.com)
PCPIN Chat <= 5.0.4 "login/language" remote cmmnds xctn (rgod@...istici.org)
Strengthen OpenSSH security? (Brett Glass <brett@...iat.org>)
ASPSitem <= 1.83 Remote SQL Injection Vulnerability ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
RE: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup (Nick FitzGerald <nick@...us-l.demon.co.uk>)
[eVuln] MWGuest XSS Vulnerability (alex@...ln.com)
PHPSurveyor <= 0.995 'save.php/surveyid' remote cmmnds xctn (rgod@...istici.org)
ThWboard 3 Beta 2.84 Cross Site Scripting (CrAzY.CrAcKeR@...mail.com)
axoverzicht.cgi<==Remote File Inclusion (CrAzY.CrAcKeR@...mail.com)
Re: CuteNews 1.4.1 <= Cross Site Scripting ("Steven M. Christey" <coley@...re.org>)
[security bulletin] HPSBTU02095 SSRT051007 rev.3 - HP Tru64 UNIX Running DNS BIND4/BIND8 as Forwarders: Remote Unauthorized Privileged Acc… (security-alert@...com)
[security bulletin] HPSBST02112 SSRT061129 rev.1 - HP StorageWorks Secure Path for Windows Remote Denial of Service (DoS) (security-alert@...com)

April 21 (30 messages)

Ad-Aware Revisited (Roy.Batty@...eaker.net)
Allied Telesyn Switch UDP Data Flood Management Denial Of Service Vulnerability (kim@...deal.no)
RE: (addendum) redirection vuln crawlers breed & security through obscurity ("Evans, Arian" <Arian.Evans@...hnetsecurity.com>)
Re: Strengthen OpenSSH security? (Mike Hoskins <mhoskins@...pen.com>)
Re: Strengthen OpenSSH security? (Carson Gaspar <carson@...tos.org>)
Re: Strengthen OpenSSH security? (Kd <kilrathi@...il.com>)
Re: Re[3]: Bypassing ISA Server 2004 with IPv6 ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: Strengthen OpenSSH security? (MaddHatter <maddhatt+bugtraq@....pdx.edu>)
Re: Strengthen OpenSSH security? (Damien Miller <djm@...drot.org>)
Re: Re[3]: Bypassing ISA Server 2004 with IPv6 ("offtopic" <offtopic@...l.ru>)
4images <= 1.7 XSS (qex@...mail.org)
Websense Filter Bypass (qex@...mail.org)
Re: Strengthen OpenSSH security? (<c0redump@...ers.org.uk>)
Mini-NUKE v2.3<<--- SQL Injection (CrAzY.CrAcKeR@...mail.com)
[SecuriWeb 2006.1] directory traversal in Asterisk@...e and ARI (François Harvey <fharvey@...uriweb.net>)
[ GLSA 200604-09 ] Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200604-10 ] zgv, xzgv: Heap overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
BK Forum <<--V.4.0 SQL Injection (CrAzY.CrAcKeR@...mail.com)
Re: Strengthen OpenSSH security? (Theo de Raadt <deraadt@....openbsd.org>)
[eVuln] MWNewsletter SQL Injection and XSS Vulnerabilities (alex@...ln.com)
r57shell.php <= 1.3 XSS (qex@...mail.org)
bloggage Remote SQL Injection (omnipresent@...il.it)
[SECURITY] [DSA 1037-1] New zgv packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
RE: [BULK] - Websense Filter Bypass ("Hubbard, Dan" <dhubbard@...sense.com>)
Re: Mini-NUKE v2.3<<--- SQL Injection (nukedx@...edx.com)
Scry Gallery Directory Traversal & Full Path Disclosure Vulnerabilites (simo64@...il.com)
Rapid7 Advisory R7-0021: Symantec Scan Engine Authentication Fundamental Design Error (advisory@...id7.com)
Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key (advisory@...id7.com)
Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure Vulnerability (advisory@...id7.com)
Rapid7 Advisory R7-0019: Directory traversal vulnerability in SolarWinds TFTP Server for Windows (advisory@...id7.com)

April 22 (12 messages)

[Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities (secure@...antec.com)
dForum <= 1.5 Multiple Remote File Inclusion Vulnerabilities. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
vBulletin <= 3.5.4 with MKPortal 1.1 Remote SQL Injection Vulnerability. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Advisory: CoreNews <= 2.0.1 Multiple Remote Vulnerabilities. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
[SECURITY] [DSA 1038-1] New xzgv packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
VWar <= ver 1.21 Remote Code Execution Exploit (ali@...kerz.ir)
dForum <= 1.5 Multiple Remote File Inclusion Vulnerabilities. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
vBulletin <= 3.5.4 with MKPortal 1.1 Remote SQL Injection Vulnerability. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Advisory: CoreNews <= 2.0.1 Multiple Remote Vulnerabilities. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
[ GLSA 200604-11 ] Crossfire server: Denial of Service and potential arbitrary code execution (Thierry Carrez <koon@...too.org>)

April 23 (12 messages)

MSIE (mshtml.dll) OBJECT tag vulnerability (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Advisory: My Gaming Ladder Combo System <= 7.0 Remote File Inclusion Vulnerability. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Buffer-overflow and crash in Fenice OMS 1.10 (Luigi Auriemma <aluigi@...istici.org>)
Denial of service bugs in OpenTTD 0.4.7 (Luigi Auriemma <aluigi@...istici.org>)
Format string bug in Skulltag 0.96f (Luigi Auriemma <aluigi@...istici.org>)
[ GLSA 200604-12 ] Mozilla Firefox: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
[ GLSA 200604-13 ] fbida: Insecure temporary file creation (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200604-14 ] Dia: Arbitrary code execution through XFig import (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("John Biederstedt" <john@...nsdomain.org>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Thor (Hammer of God)" <thor@...merofgod.com>)

April 24 (36 messages)

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Geo." <geoincidents@....net>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("John Biederstedt" <john@...nsdomain.org>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: Strengthen OpenSSH security? ("Bob Goodman" <goodman@....hush.com>)
FlexBB 0.5.5 Exploit [ function/showprofile.php ] Remote SQL Injection (o.y.6@...mail.com)
Re: redirection vuln crawlers breed & security through obscurity (Thomas Hochstein <ml@...alagon.inka.de>)
Yahoo! Mail XSS Vulnerability ("Cheng Peng Su" <applesoup@...il.com>)
RE: Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities. ("Ashcraft, Jeremy" <jashcraft@...ate.com>)
Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Newslist about security conference ("newslist@...urity-briefings.com" <newslist@...urity-briefings.com>)
[USN-272-1] cyrus-sasl2 vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-273-1] Ruby vulnerability (Martin Pitt <martin.pitt@...onical.com>)
NSFOCUS SA2006-03 : IBM AIX rm_mlcache_file Local Race Condition Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
NSFOCUS SA2006-02 : IBM AIX mklvcopy Local Privilege Escalation Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
[SECURITY] [DSA 1040-1] New gdm packages fix local root exploit (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1039-1] New blender packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Scry Gallery XSS Vulnerability (arko.dhar@...il.com)
[eVuln] RateIt SQL Injection Vulnerability (alex@...ln.com)
FileLodge Bolt (showonlineusers.php) Cross-Site Scripting Vulnerbility (n0m3rcy@...mail.org)
XSS Bug in OpenGear Server Website (Aditya@...aeye.Org)
BK Forum <= 4.0 Remote SQL Injection (n0m3rcy@...mail.org)
[MajorSecurity] TotalCalendar 2.30 - Remote File Include Vulnerability (admin@...orsecurity.de)
RIblog Remote SQL Injection Exploit (omnipresent@...il.it)
Re: evoBlog Remote Name tag Script injection (daniel@...-dev.com)
Multiple PHP4/PHP5 vulnerabilities ("infocus" <infocus@...igo.hr>)
Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
=?iso-8859-1?q?Apple Mac OS X Safari 2.0.3 Vulnerability?= (" " <security@...shdot.ch>)
Firefox Remote Code Execution and DoS 1.5.0.2 (chris@...ices.org)
[MajorSecurity] phpMyAgenda 3.0 Final - Remote File Include Vulnerability (admin@...orsecurity.de)
VWar Path Disclosure (arko.dhar@...il.com)
vbulletin<--3.0.x SQL Injection (CrAzY.CrAcKeR@...mail.com)
Advisory: My Gaming Ladder Combo System <= 7.0 Remote File Inclusion Vulnerability. ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS (ntwak0@...ehack.com)
RE: [BULK] - Websense Filter Bypass ("John E. Fleming" <John@...cassets.com>)
Quick 'n Easy FTP Server pro/lite Logging unicode stack overflow ("Kaveh Razavi" <c0d3r@...team.com>)

April 25 (27 messages)

Re: Apple Mac OS X Safari 2.0.3 Vulnerability (Colin Keigher <colinkeigher@...us.net>)
Re: vbulletin<--3.0.x SQL Injection (scott@...lletin.com)
[ MDKSA-2006:074 ] - Updated php packages address multiple vulnerabilities. (security@...driva.com)
[ MDKSA-2006:073 ] - Updated cyrus-sasl packages addresses vulnerability (security@...driva.com)
photokorn 1.53 , 1.542 << Sql (Dr-Jr7@...mail.com)
NextAge Shopping Cart Software XSS (AminRayden@...oo.com)
[ MDKSA-2006:075 ] - Updated mozilla-firefox packages fix numerous vulnerabilities (security@...driva.com)
PhpWebFtp Cross Site Scripting Vulnerability (arko.dhar@...il.com)
[SECURITY] [DSA 1041-1] New abc2ps packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
NASL 'Split' function Buffer overflow Vulnerability ("OS2A BTO" <os2a.bto@...il.com>)
Re: ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS (fabio <ctrlaltca@...ero.it>)
Re: ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS (Andreas Beck <becka-list-bugtraq@...atec.de>)
Invision Vulnerabilities, including remote code execution (spam@...1er.co.uk)
Re: Apple Mac OS X Safari 2.0.3 Vulnerability (Tom Ferris <tommy@...urity-protocols.com>)
Re: NASL 'Split' function Buffer overflow Vulnerability (Renaud Deraison <deraison@...sus.org>)
[SECURITY] [DSA 1042-1] New Cyrus SASL packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: NASL 'Split' function Buffer overflow Vulnerability (Renaud Deraison <deraison@...sus.org>)
Fenice - Open Media Streaming Server remote BOF exploit ("Kaveh Razavi" <c0d3r@...team.com>)
Returned post for bugtraq@...urityfocus.com (bugtraq-owner@...urityfocus.com)
PowerPoint Phishing Trojan (Lance James <bugtraq@...urescience.net>)
Returned post for bugtraq@...urityfocus.com (bugtraq-owner@...urityfocus.com)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotaged hosts-file lookup (Duncan Simpson <dps@...pson.demon.co.uk>)
Multiple vulnerabilities in IP3 Networks 'NetAccess' NA75 appliance ("Moonen, Ralph" <Moonen.Ralph@...g.nl>)
RE: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup ("Sean Scott" <sscott@...itivenetworks.net>)
Re: Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability. (nukedx@...edx.com)
Multiple browsers Windows mailto protocol Office 2003 file attachment exploit (inge.henriksen@...leansoft.com)

April 26 (30 messages)

Instant Photo Gallery <= Multiple XSS (qex@...mail.org)
Re: Apple Mac OS X Safari 2.0.3 Vulnerability ("Billy Bues" <bwbues@...il.com>)
Instant Photo Gallery <= Multiple XSS (qex@...mail.org)
DCForumLite V 3.0<--XSS/SQL Injection (Breeeeh@...mail.com)
ZDI-06-011: Mozilla Firefox Table Rebuilding Code Execution Vulnerability (zdi-disclosures@...m.com)
Recent Oracle exploit is _actually_ an 0day with no patch ("David Litchfield" <davidl@...software.com>)
Recent Oracle exploit is _actually_ an 0day with no patch ("David Litchfield" <davidl@...software.com>)
[ MDKSA-2006:076 ] - Updated mozilla packages fix numerous vulnerabilities (security@...driva.com)
[ MDKSA-2006:077 ] - Updated ethereal packages fix numerous vulnerabilities (security@...driva.com)
[ MDKSA-2006:078 ] - Updated mozilla-thunderbird packages fix numerous vulnerabilities (security@...driva.com)
[ MDKSA-2006:079 ] - Updated ruby packages fix vulnerability (security@...driva.com)
Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SECURITY] [DSA 1044-1] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[ GLSA 200604-15 ] xine-ui: Format string vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200604-16 ] xine-lib: Buffer overflow vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
MySmartBB<---v 1.1.x SQL Injection/XSS (BoNy-m@...mail.com)
DevBB <= 1.0.0 XSS (qex@...mail.com)
[SECURITY] [DSA 1044-1] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Secunia Research: SpeedProject Products ACE Archive Handling Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1043-1] New abcmidi packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[eVuln] warforge.NEWS SQL Injection and Multiple XSS Vulnerabilities (alex@...ln.com)
SQL Injection On DUportal (outlaw@...a-security.net)
Open Bulletin Board < Multiple Vulnerability (qex@...mail.org)
XXS Attack On FarsiNews (outlaw@...a-security.net)
Local XXS Attack On CuteNews (outlaw@...a-security.net)
[EEYEB-20060227] Juniper Networks SSL-VPN Client Buffer Overflow ("eEye Advisories" <Advisories@...e.com>)
Re: Apple Mac OS X Safari 2.0.3 Vulnerability (jens@....com)
Re: XV multiple buffer overflows (update) (kvea@....gov)
Re: Invision Vulnerabilities, including remote code execution ("Steven M. Christey" <coley@...re.org>)
Re: Apple Mac OS X Safari 2.0.3 Vulnerability (Aaron Phillips <Aaron@...tech-computers.com>)

April 27 (12 messages)

[ GLSA 200604-17 ] Ethereal: Multiple vulnerabilities in protocol dissectors (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[USN-274-1] MySQL vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Invision Vulnerabilities, including remote code execution (mattmecham@...il.com)
MyBB 1.1.1 Local SQL Injections (o.y.6@...mail.com)
=?iso-8859-1?q??= ("Yannick von Arx" <security@...shdot.ch>)
Land Down Under 802 and below version Path Disclosure Vulnerability (Advisory@...a-Security.net)
[security bulletin] HPSBUX02108 SSRT061133 rev.9 - HP-UX running Sendmail, Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBUX02075 SSRT051074 rev.4 - HP-UX Running xterm Local Unauthorized Access (security-alert@...com)
Re: Instant Photo Gallery <= Multiple XSS (security curmudgeon <jericho@...rition.org>)
[security bulletin] HPSBMA02113 SSRT061148 rev.1 - HP Oracle for OpenView (OfO) Critical Patch Update April 2006 (security-alert@...com)
SQL injection exploit IPB <= 2.1.4 (satanchild123@...mail.com)
[USN-275-1] Mozilla vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)

April 28 (18 messages)

Re: Instant Photo Gallery <= Multiple XSS ("Steven M. Christey" <coley@...re.org>)
WinISO/UltraISO/MagicISO/PowerISO Directory Traversal Vulnerability (Sowhat <smaillist@...il.com>)
[SECURITY] [DSA 1045-1] New OpenVPN packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1046-1] New Mozilla packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
BL4's SMTP server BufferOverflow Vulnerable (the_day@...o.or.id)
Re: Recent Oracle exploit is _actually_ an 0day with no patch ("Steven M. Christey" <coley@...re.org>)
Secunia Research: Servant Salamander unacev2.dll Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[ECHO_ADV_31$2006] Sws Web Server 0.1.7 Strcpy() & Syslog() Format String Vulnerability (the_day@...o.or.id)
Cireos Portal Cross Site Scripting (outlaw@...a-security.net)
[Argeniss] Alert - Yahoo! Mail XSS vulnerability (Cesar <cesarc56@...oo.com>)
[ GLSA 200604-18 ] Mozilla Suite: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
Re: Recent Oracle exploit is _actually_ an 0day with no patch (Cesar <cesarc56@...oo.com>)
[Kurdish Security #3] CoolMenus Event Remote File Include Vulnerability (For PHP) (botan@...uxmail.org)
[Kurdish Security #2] Artmedic Event Remote File Include Vulnerability (botan@...uxmail.org)
RE: Recent Oracle exploit is _actually_ an 0day with no patch ("Kornbrust, Alexander" <ak@...-database-security.com>)
Neomail.pl Local Cross Site Scripting (outlaw@...a-security.net)
Re: Recent Oracle exploit is _actually_ an 0day with no patch ("David Litchfield" <davidl@...software.com>)
[Kurdish Secure Advisory #1] I-RATER Platinum "Admin/configsettings.tpl.php" Remote File Include Vulnerability (botan@...uxmail.org)

April 29 (11 messages)

Re: VWar Path Disclosure (spic@...ns.net)
RE: Invision Vulnerabilities, including remote code execution ("Mike Weller" <mike@...1er.co.uk>)
Re: Apple Mac OS X Safari 2.0.3 Vulnerability (Ian MacPhedran <Ian_MacPhedran@...r.USask.Ca>)
Re: Recent Oracle exploit is _actually_ an 0day with no patch ("David Litchfield" <davidl@...software.com>)
Re: phpMyForum Cross Site Scripting & CRLF injection (chris@...myforum.de)
Invision Power Board 2.1.5 POC (Javier Olascoaga <jolascoaga@....es>)
poll.pl<--remote commands execution exploit (CrAzY.CrAcKeR@...mail.com)
W-Agora 4.20 XSS (r0xes.ratm@...il.com)
XSS Attack On DirectAdmin Hosting Managment (outlaw@...a-security.net)
TopList <= 1.3.8 (PHPBB Hack) Remote File Inclusion Vulnerability (mfoxhacker@...il.com)
TextFileBB 1.0.16 Multiple XSS (r0xes.ratm@...il.com)

April 30 (2 messages)

Re: NASL 'Split' function Buffer overflow Vulnerability (Tim Brown <timb@...nvas.org>)
RE: Poll: Emerging Threats ("H Alsaleh" <haggar12@...mail.com>)

630 messages

Powered by blists - more mailing lists