bugtraq mailing list - 2006/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2006/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 15	² 2
³ 22	⁴ 11	⁵ 12	⁶ 17	⁷ 12	⁸ 16	⁹ 6
¹⁰ 31	¹¹ 21	¹² 22	¹³ 33	¹⁴ 11	¹⁵ 39	¹⁶ 10
¹⁷ 12	¹⁸ 44	¹⁹ 33	²⁰ 8	²¹ 14	²² 43	²³
²⁴ 25	²⁵ 12	²⁶ 30	²⁷ 22	²⁸ 27	²⁹ 18	³⁰
³¹ 23

Messages by day:

July 1 (15 messages)

NewsPHP 2006 PRO XSS SQL injection Vulnerability (securityconnection@...il.com)
News <= 5.2 XSS, SQL Injection, Full Path Disclosure (gmdarkfig@...il.com)
phpBB 2.0.21 Full Path Disclosure (xzerox@...uxmail.org)
Re: PHP security (or the lack thereof) (Kevin Waterson <kevin@...ania.net>)
Re: Browser bugs hit IE, Firefox today (SANS) (Alex Potter <alex@...consulting.co.uk>)
Re: Msie 7.0 beta Crash (mike@...il.com)
[security bulletin] HPSBUX02128 SSRT5996 - rev.1 HP-UX mkdir(1) Local Unauthorized Access (security-alert@...com)
[security bulletin] HPSBUX02103 SSRT5953 rev.3 - HP-UX passwd(1) Local Denial of Service (DoS) (security-alert@...com)
Buddy Zone Version 1.0.1 - XSS (luny@...fucktard.com)
mAds v1.0 (lunY@...fucktard.com)
phpMyAdmin : Cross-Site Scripting Vulnerability ("bug@...uritynews.ir" <bug@...uritynews.ir>)
DEF CON 14: Speakers Selected and more. (The Dark Tangent <dtangent@...con.org>)
OPERA Web Browser 9 Denial OF Service (y3dips@...o.or.id)
Internet Crna Gora SQL Injection (Breeeeh@...mail.com)
SmS Script SQL Injection (Breeeeh@...mail.com)

July 2 (2 messages)

Sql injection in Diesel joke site script ("black code" <black-cod3@...mail.com>)
SturGeoN Upload v1 Remote Command Execution Exploit (gmdarkfig@...il.com)

July 3 (22 messages)

Whitepaper: IT (in)security implementation in a real world example (Denis Jedig <seclists@...eticon.de>)
Php-Fusion (Xss) With Avatar Upload (zeberus_@...mail.com)
Glossaire<<--v1.7 Remote File Include (CrAzY.CrAcKeR@...mail.com)
call for papers - IT Underground, Italy 2006 (<it_underground@...eta.pl>)
[MajorSecurity #19] AutoRank <= 5.01 - Multiple XSS and cookie disclosure (admin@...orsecurity.de)
[ GLSA 200607-01 ] mpg123: Heap overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
WordPress 2.0.3 SQL Error and Full Path Disclosure (xzerox@...uxmail.org)
plume-cms v1.0.4 Multiple Remote File include (KARKOR23@...mail.com)
Pearl Products Multiple Remote File Inclusion (xzerox@...uxmail.org)
free QBoard v1.1 Multiple Remote File include (KARKOR23@...mail.com)
Re: [Full Disclosure] [Kil13r-SA-20060701-2] MoniWiki 1.1.1 Cross-Site Scripting Vulnerability (mac68k@...il.com)
Multiple vulnerabilities in TK8 Safe v.3.0.5 (clappymonkey@...il.com)
popup Vacation Rentals[calendar_year.php] SQL Injection (BoNy-m@...mail.com)
QTOFileManager 1.0 (securityconnection@...il.com)
Invision Power Board v1.3 Final SQL Injection (Breeeeh@...mail.com)
Contact for nhl.com ("C. Hamby" <fixer@....net>)
Excel 2000/XP/2003 Style 0day POC (nanika@...oot.org)
5 php scripts remote database password disclosure (gmdarkfig@...il.com)
Call For Papers - No cON Name 2006 Edition Spain (deese@...zialk.net)
ZoneAlarm Insufficient protection of registry key 'VETFDDNT\Enum' Vulnerability (David Matousek <david@...ousec.com>)
TBE 4.0 XSS (securityconnection@...il.com)
imgsvr dos exploit by n00b (co296@....com)

July 4 (11 messages)

[scip_Advisory 2351] Kyberna AG ky2help various form fields SQL Injection (Marc Ruef <maru@...p.ch>)
[scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting (Marc Ruef <maru@...p.ch>)
[scip_Advisory 2352] F5 FirePass 4100 prior 6.x multiple Cross Site Scripting (Marc Ruef <maru@...p.ch>)
Re: Browser bugs hit IE, Firefox today (SANS) (Thor Larholm <thor@...ypath.com>)
galleria <= 1.0 Remote File Inclusion Vulnerability (ineal@...il.com)
Re: WordPress 2.0.3 SQL Error and Full Path Disclosure (James Davis <jamesd@...t.ja.net>)
file include exploits in randshop v1.2 ("black code" <black-cod3@...mail.com>)
PhpWebGallery Cross Site Scripting Vulnerability (iss4m.h@...il.com)
Re: file include exploits in randshop v1.2 (Rainer Duffner <rainer@...ra-secure.de>)
Re: WordPress 2.0.3 SQL Error and Full Path Disclosure (Jaroslaw Sajko <sloik@...areal.net>)
Re: flock d0s exploit remote. beta 1 (v0.7) (.myke lyons <Myke.Lyons@...ww.com>)

July 5 (12 messages)

Cross Site Scripting in Google (RSnake <rsnake@...cking.com>)
Touch arbitrary file execute vulnerability ("Alex Park" <saintlinu@...il.com>)
Re: [WEB SECURITY] Cross Site Scripting in Google (RSnake <rsnake@...cking.com>)
Invision Power Board "v1.X & 2.X" SQL Injection (CrAzY.CrAcKeR@...mail.com)
Re: Browser bugs hit IE, Firefox today (SANS) (Paul Szabo <psz@...hs.usyd.edu.au>)
Shopping Cart V0.9 (luny@...fu**ktard.com)
Windows Explorer URL File format overflow (nanika@...oot.org)
sNews 1.3 XSS SQL (securityconnection@...il.com)
BLOG:CMS 4.1.0 SQL injection File Include Vulnerability (securityconnection@...il.com)
Re: PHP security (or the lack thereof) (Dan Falconer <dan@...upport.com>)
[ MDKSA-2006:116 ] - Updated kernel packages fixes multiple vulnerabilities (security@...driva.com)
vBulletin 3.5.4 (install_path) Exploit (CarcaBotx@...oo.com)

July 6 (17 messages)

TigerTom Scripts (luny@...f**ktard.com)
[USN-308-1] shadow vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-309-1] libmms vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-310-1] ppp vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Re: [WEB SECURITY] Cross Site Scripting in Google (Javor Ninov <drfrancky@...urax.org>)
RE: [Full-disclosure] Re: [WEB SECURITY] Cross Site Scripting in Google ("Martin O'Neal" <martin.oneal@...saire.com>)
RE: Re: [WEB SECURITY] Cross Site Scripting in Google ("Martin O'Neal" <martin.oneal@...saire.com>)
[SECURITY] [DSA 1104-2] New OpenOffice.org packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues (Moritz Naumann <securityfocus.com@...itz-naumann.com>)
Re: vBulletin 3.5.4 (install_path) Exploit (mikathebest2003@...oo.de)
Format string bug in Sparklet 0.9.4try3 (Luigi Auriemma <aluigi@...istici.org>)
Possible code execution in Kaillera 0.86 (Luigi Auriemma <aluigi@...istici.org>)
Various heap and stack overflow bugs in AdPlug library 2.0 (CVS 04 Jul 2006) (Luigi Auriemma <aluigi@...istici.org>)
Re: vBulletin 3.5.4 (install_path) Exploit (scott@...lletin.com)
Mico crashes when contected with wrong IOR / DoS (tuergeist <tuergeist@...glemail.com>)
IBM AIX Security contact? (Joxean Koret <joxeankoret@...oo.es>)
Re: IBM AIX Security contact? (Bart.Lansing@...ls.com)

July 7 (12 messages)

Re: IBM AIX Security contact? (Troy Bollinger <troy@...tin.ibm.com>)
ZDI-06-021: WebEx Downloader Plug-in Code Execution Vulnerability (zdi-disclosures@...m.com)
Re: IBM AIX Security contact? ("COURTNEY ROGERS" <courtrogue@....com>)
Re: Re: [WEB SECURITY] Cross Site Scripting in Google ("Peter Dawson" <slash.pd@...il.com>)
Major updates to Excel 0-day Vulnerability FAQ at SecuriTeam Blogs (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
McAfee VirusScan Enterprise 8.0.0 Buffer Overflow (johndoe1529@...oo.com)
TSLSA-2006-0040 - kernel (Trustix Security Advisor <tsl@...stix.org>)
WebEx Downloader Plug-in Multiple Vulnerabilities + rant ("Mark Litchfield" <mark@...software.com>)
PHP-Blogger Multiple Cross Site Scripting Vulnerabilities ("OS2A BTO" <os2a.bto@...il.com>)
rPSA-2006-0122-1 kernel ("Justin M. Forbes" <jmforbes@...th.com>)
ATutor : Cross-Site Scripting Vulnerabilities ("bug@...uritynews.ir" <bug@...uritynews.ir>)
[ECHO_ADV_36$2006] ExtCalendar <== v2.0 Remote File Include Vulnerabilities (matdhule@...il.com)

July 8 (16 messages)

PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities (paisterist.nst@...il.com)
[ MDKSA-2006:117 ] - Updated libmms packages fix buffer overflow vulnerability (security@...driva.com)
MS Word Unchecked Boundary Condition Vulnerability - POC (naveed <naveedafzal@...il.com>)
HostingController: An attacker can gain reseller privileges and after that can gain admin privileges (Irsdl@...oo.com)
Sport-slo.net Guestbook v1.0 (luny@...fucktard.com)
Pivot <=1.30rc2 privilege escalation / remote commands execution (rgod@...istici.org)
[SECURITY] [DSA 1105-1] New xine-lib packages fix denial of service (joey@...odrom.org (Martin Schulze))
lintah_|adv|_01@...6>=========<[Aura-CMS v1.62]<===>[XSS vulnerable]&[bug] ("k07iX" <apem-zigzag@...kom.net>)
Re: MS Word Unchecked Boundary ConditionVulnerability - POC ("Dave \"No, not that one\" Korn" <davek_throwaway@...mail.com>)
Re: Re: MS Word Unchecked Boundary ConditionVulnerability - POC (naveed <naveedafzal@...il.com>)
[ MDKSA-2006:118 ] - Updated OpenOffice.org packages fix various vulnerabilities (security@...driva.com)
PAPOO <=3RC3 sql injection / admin credentials disclosure (rgod@...istici.org)
Re: Re: flock d0s exploit remote. beta 1 (v0.7) (flockoyd@...il.com)
[KAPDA::#46] - AjaxPortal Authentication Bypass (alireza hassani <trueend5@...oo.com>)
ATutor 1.5.3 Cross Site Scripting (securityconnection@...il.com)
RW::Download stats.php Remote File Inc. (StorMBoY@...MaiL.Org)

July 9 (6 messages)

Re: Mico crashes when contected with wrong IOR / DoS (tuergeist <tuergeist@...glemail.com>)
Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit ("Alexander Hristov" <joffer@...il.com>)
[ GLSA 200607-02 ] FreeType: Multiple integer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200607-03 ] libTIFF: Multiple buffer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200607-04 ] PostgreSQL: SQL injection (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200607-05 ] SHOUTcast server: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

July 10 (31 messages)

MIMESweeper For Web 5.X Cross Site Scripting ("Erez Metula" <erezmetula@...ecure.co.il>)
ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) (mozilla@...-guide.de)
Re: ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) ("Test Drive" <testdrive6@...il.com>)
Re: rPSA-2006-0122-1 kernel (Paul Starzetz <paul@...rzetz.de>)
RE: MIMESweeper For Web 5.X Cross Site Scripting ("Erez Metula" <erezmetula@...ecure.co.il>)
Re: Mico crashes when contected with wrong IOR / DoS (Karel Gardas <kgardas@...ectsecurity.com>)
[USN-312-1] gimp vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Mico crashes when contected with wrong IOR / DoS (tuergeist <tuergeist@...glemail.com>)
Webvizyon Portal 2006 Version SQL Injection (StorMBoY@...Mail.Org)
Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof)) (Gezim Hoxha <gezimetc@...w.ca>)
Re: Invision Power Board "v1.X & 2.X" SQL Injection (mattmecham@...il.com)
Graffiti Forums v1.0 SQL Injection Vulnerabilities (paisterist.nst@...il.com)
Juniper Networks DX Web Administration Persistent System Log XSS Vulnerability ("Darren Bounds" <dbounds@...il.com>)
MT rmcek Toplist v2.2 Version Microsoft Access Driver ( MDB ) Download (StorMBoY@...MaiL.Org)
Re: RE: Invision Vulnerabilities, including remote code execution (mattmecham@...il.com)
LAMP vs Microsoft (Darren Reed <avalon@...igula.anu.edu.au>)
Re: [KAPDA::#46] - AjaxPortal Authentication Bypass (earthquake@...email.hu)
[ECHO_ADV_37$2006] pc_cookbook Mambo/Joomla Component <= v0.3 Remote File Include Vulnerabilities (matdhule@...il.com)
[SECURITY] [DSA 1106-1] New ppp packages fix privilege escalation (joey@...odrom.org (Martin Schulze))
Re: [ MDKSA-2006:116 ] - Updated kernel packages fixes multiple vulnerabilities (Paul Starzetz <paul@...rzetz.de>)
phpPolls 1.0.3 Administration ByPass (alp_eren@...ildiz.org)
Re: galleria <= 1.0 Remote File Inclusion Vulnerability (counterpoint@...boguru.com)
Re: Invision Power Board v1.3 Final SQL Injection (mattmecham@...il.com)
Re: Mico crashes when contected with wrong IOR / DoS (Karel Gardas <kgardas@...ectsecurity.com>)
CC announces new Rootkit help forum insync with Book (Paul Laudanski <zx@...tlecops.com>)
MS Word Unchecked Boundary Condition Vulnerability (naveed <naveedafzal@...il.com>)
Re: Re: vBulletin 3.5.4 (install_path) Exploit (mikathebest2003@...oo.de)
Gracenote buffer overflow ("MNV" <mnv@...mni.princeton.edu>)
RE: WebEx Downloader Plug-in Multiple Vulnerabilities + rant (Web Ex <exwebex@...oo.ca>)
Digital Armaments Security Advisory 10.07.2006: Flexwath Authorization Bypassing and XSS Vulnerability (info@...italarmaments.com)
Re: PHP security (or the lack thereof) (Darren Reed <avalon@...igula.anu.edu.au>)

July 11 (21 messages)

Old vulnerable sotwares collection (Jerome Athias <jerome.athias@...e.fr>)
Re: Windows Explorer URL File format overflow (naveed <naveedafzal@...il.com>)
[ANNOUNCEMENT] Samba 3.0.1 - 3.0.22: memory exhaustion DoS against smbd ("Gerald (Jerry) Carter" <jerry@...ba.org>)
[SECURITY] [DSA 1107-1] New GnuPG packages fix denial of service (joey@...odrom.org (Martin Schulze))
Local file inclusion in Farsinews3.0BETA1 (armin390@...il.com)
randshop <= 1.1.x (index.php) Remote File Inclusion Vulnerability (Saudi.Unix@...mail.com)
Re: LAMP vs Microsoft ("Jarrod Frates" <jfrates.ml@...il.com>)
Re: LAMP vs Microsoft (Bob Beck <beck@...h.cns.ualberta.ca>)
Re: Securing PHP or finding PHP alternatives (Crispin Cowan <crispin@...ell.com>)
Google PR Mechanism Possible Vulnerability ("cumhur onat" <cumhuronat@...il.com>)
RE: MIMESweeper For Web 5.X Cross Site Scripting ("Erez Metula" <erezmetula@...ecure.co.il>)
RE: Re: [WEB SECURITY] Cross Site Scripting in Google (tcp fin <inet_inaddr@...oo.com>)
[USN-311-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Re: ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) (Mailinglists <mozilla@...-guide.de>)
[SECURITY] Plain text password in Finjan Appliance 5100/8100 NG backup file (finde_schwachstelle@....net)
Fuzzing Microsoft Office (naveed <naveedafzal@...il.com>)
Re: Google PR Mechanism Possible Vulnerability (bugtraq@...security.net)
SYMSA-2006-007: Microsoft Office Malformed String Parsing Vulnerability (research@...antec.com)
CYBSEC - Security Pre-Advisory: Microsoft Windows DHCP Client Service Remote Buffer Overflow (Mariano Nuñez Di Croce <mnunez@...sec.com>)
ZDI-06-022: Microsoft Office Excel File Rebuilding Code Execution Vulnerability (zdi-disclosures@...m.com)
TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability ("Tippingpoint Security Research Team" <tsrt@...pingpoint.com>)

July 12 (22 messages)

rPSA-2006-0128-1 samba samba-swat ("Justin M. Forbes" <jmforbes@...th.com>)
Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t Exploit ( BID 18874 / CVE-2006-2451 ) (Roman Medina-Heigl Hernandez <roman@...labs.com>)
Microsoft Excel Array Index Error Remote Code Execution (Sowhat <smaillist@...il.com>)
[USN-313-1] OpenOffice.org vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
NSFOCUS SA2006-05 : Microsoft Excel SELECTION Record Memory Corruption Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
[USN-316-1] installer vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-314-1] samba vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-315-1] libmms, xine-lib vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
NSFOCUS SA2006-06 : Microsoft Excel COLINFO Record Buffer Overflow Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
Re: LAMP vs Microsoft ("Steven M. Christey" <coley@...re.org>)
Cisco Security Advisory: Multiple Cisco Unified CallManager Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Router Web Setup Ships with Insecure Default IOS Configuration (Cisco Systems Product Security Incident Response Team <psirt@...c…)
Re: ATutor 1.5.3 Cross Site Scripting (info@...tor.ca)
[ MDKA-2006:119 ] - Updated ppp packages fix plugin vulnerability (security@...driva.com)
SQuery <= 4.5(libpath) Remote File Inclusion Exploit (SHiKaA-@...mail.com)
Re: [ANNOUNCEMENT] Samba 3.0.1 - 3.0.22: memory exhaustion DoS against smbd ("Gerald (Jerry) Carter" <jerry@...ba.org>)
Cisco Security Advisory: Cisco Intrusion Prevention System Malformed Packet Denial of Service (Cisco Systems Product Security Incident Response Team <psirt@...c…)
SMB Information Disclosure Vulnerability (Avert@...rtlabs.com)
[ MDKSA-2006:117-1 ] - Updated libmms packages fix buffer overflow vulnerability (security@...driva.com)
[SECURITY] [DSA 1108-1] New mutt packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
TOPo v.2.2.178 Account Reset (darkz.gsa@...il.com)

July 13 (33 messages)

S21Sec-032-en: Vulnerability in Fatwire Content Server (<labs@...sec.com>)
Re: Browser bugs hit IE, Firefox today (SANS) (3CO <threecheeseopera@...il.com>)
RE: Old vulnerable sotwares collection ("John Rigali" <jrigali@...bumdei.us>)
Lazarus Guestbook Cross Site Scripting Vulnerabilities (simo64@...il.com)
[ MDKSA-2006:120 ] - Updated samba packages fix DoS vulnerability (security@...driva.com)
New CVE number states Excel Style handling as a separate issue (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: WordPress 2.0.3 SQL Error and Full Path Disclosure ("zck zck" <zckzck@...il.com>)
Re: # MHG Security Team --- PHPAskIt v2.0.1 Remote File Inc. (Amelie <amelie@...-noticeably.net>)
FLV Players Multiple Input Validation Vulnerabilities (xzerox@...uxmail.org)
[ MDKSA-2006:121 ] - Updated xine-lib packages fix buffer overflow vulnerability (security@...driva.com)
Re: Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t Exploit ( BID 18874 / CVE-2006-2451 ) (Ariel Biener <ariel@...t.tau.ac.il>)
Re: Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t Exploit ( BID 18874 / CVE-2006-2451 ) (Ariel Biener <ariel@...t.tau.ac.il>)
Re: # MHG Security Team --- PHPAskIt v2.0.1 Remote File Inc. (amelie@...-noticeably.net)
Re: Re: Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t Exploit ( BID 18874 / CVE-2006-2451 ) (Jon Hart <jhart@...ofed.org>)
Re: Linux Kernel 2.6.x PRCTL Core Dump Handling - simple workaround (lars brun nielsen <lbn@...bon14.dk>)
[USN-317-1] zope2.8 vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-318-1] libtunepimp vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ECHO_ADV_38$2006] Multiple Mambo/Joomla Component Remote File Include Vulnerabilities (matdhule@...il.com)
RE: WordPress 2.0.3 SQL Error and Full Path Disclosure ("Aaron Newman" <aaroncharlesnewman@...oo.com>)
SYMSA-2006-004 (Full Details): Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (research@...antec.com)
Photocycle v1.0 - XSS (luny@...fucktard.com)
ScozNews Final-Php <=1.1 Remote File Inclusion Vulnerability (x0r0n@...mail.com)
Orbitmatrix PHP Script v1.0 (luny@...fucktard.com)
Flipper Poll <= 1.1.0 Remote File Inclusion Vulnerability (x0r0n@...mail.com)
[ MDKSA-2006:122 ] - Updated php packages fix multiple vulnerabilities (security@...driva.com)
flatnuke <= 2.5.7 arbitrary php file upload (rgod@...istici.org)
PHORUM 5 arbitrary local inclusion (rgod@...istici.org)
phpbb 3.x sql injection (with global moderator rights) (rgod@...istici.org)
Re: [ECHO_ADV_38$2006] Multiple Mambo/Joomla Component Remote File Include Vulnerabilities (Joxean Koret <joxeankoret@...oo.es>)
[ MDKSA-2006:123 ] - Updated kernel packages fixes multiple vulnerabilities (security@...driva.com)
perForms <= 1.0 ([mosConfig_absolute_path]) Remote File Inclusion (endeneu@...uxmail.com)
rPSA-2006-0122-2 kernel ("Justin M. Forbes" <jmforbes@...th.com>)
[security bulletin] HPSBUX02120 SSRT051057 rev.2 - HP-UX Local Denial of Service (DoS) (security-alert@...com)

July 14 (11 messages)

Looking for any vulnerabilities in GreenBorder Pro - Download please, and let me know ("Bill Stout" <bill.stout@...enborder.com>)
Re: Looking for any vulnerabilities in GreenBorder Pro - Download please, and let me know (mikeiscool <michaelslists@...il.com>)
Re: WebEx Downloader Plug-in Multiple Vulnerabilities + rant (Mark Rowe <mark.rowe@...test.co.uk>)
IE <= 6 DoS vulnerability (jonasschaub@...il.com)
Phorum 5.1.15 security release (fixes "PHORUM 5 arbitrary local inclusion") (Maurice Makaay <maurice.makaay@...ernl.net>)
Microsoft Works - Buffer Overflows / Denial of Service (DoS)-Vulnerabilities ("Benjamin Tobias Franz" <0-1-2-3@....de>)
Microsoft PowerPoint 0-day Vulnerability FAQ document written (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround ("Caveo Internet BV - Security" <security@...eo.nl>)
EEYE: McAfee ePolicy Orchestrator Remote Compromise ("eEye Advisories" <Advisories@...e.com>)
Re: Photocycle v1.0 - XSS (securityfocus@...mbrown.info)
Re: Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround (Hugo van der Kooij <hvdkooij@...derkooij.org>)

July 15 (39 messages)

Bybass HTTP ( extension files ) in ISA 2004 (medozero@...oo.com)
MS Power Point Multiple Vulnerabilities (powerpnt.exe)- POC (naveed <naveedafzal@...il.com>)
MS Power Point Multiple Vulnerabilities - (mso.dll) POC (naveed <naveedafzal@...il.com>)
MS Power Point Multiple Vulnerabilities - (memory corruption) POC (naveed <naveedafzal@...il.com>)
Norton Insufficient protection of Norton service registry keys (David Matousek <david@...ousec.com>)
Kerio Terminating 'kpf4ss.exe' using internal runtime error Vulnerability (David Matousek <david@...ousec.com>)
Re: Securing PHP or finding PHP alternatives (SkyFlash <webmaster@...kquest.de>)
Linux sys_prctl LKM based hotfix ("Abhisek Datta" <abhisek.datta@...il.com>)
crashing firefox <= 1.5.0.4 (reywen@...il.com)
saphp "add.php" forumid Parameter SQL Injection (Breeeeh@...mail.com)
RE: Re: vBulletin 3.5.4 (install_path) Exploit ("Robert Marquardt" <email@...ert-marquardt.com>)
XSS phpBB 2.0.21 in administration (renatrix@...il.com)
MyGallery "Room.php" SQL Injection (Breeeeh@...mail.com)
Rocks Clusters <=4.1 local root (Xavier <compromise@...il.com>)
Re: WordPress 2.0.3 SQL Error and Full Path Disclosure (jholguin@...il.com)
[SECURITY] Plain text password in Finjan Appliance 5100/8100 NG backup file (finde_schwachstelle@....net)
Phorum 5.1.14 XSS SQL injection Vulnerability (securityconnection@...il.com)
Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit ("José Parrella" <joseparrella@...il.com>)
VBZooM "sendmail.php" SQL Injection (Breeeeh@...mail.com)
Re: [Full-disclosure] ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) (Mailinglists <mozilla@...-guide.de>)
Re: LAMP vs Microsoft (Darren Reed <avalon@...igula.anu.edu.au>)
Re: WordPress 2.0.3 SQL Error and Full Path Disclosure (nate <nate@...urityminded.net>)
RE: MIMESweeper For Web 5.X Cross Site Scripting ("Erez Metula" <erezmetula@...ecure.co.il>)
MiniBB Forum <= 1.5a Remote File Include Vulnerabilities (matdhule@...il.com)
VBZooM <=V1.11 " reply.php" SQL Injection (Breeeeh@...mail.com)
Microsoft PowerPoint 0-day Vulnerability FAQ document written (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
VBZooM <=V1.11 " ignore-pm.php" SQL Injection (Breeeeh@...mail.com)
Re: [ GLSA 200607-05 ] SHOUTcast server: Multiple vulnerabilities (Cyneox <cyneox@...eox.net>)
SubberZ[Lite] - Remote File Include (ChironeX.FleckeriX@...il.Com)
Re: Securing PHP or finding PHP alternatives ("Sheryl Coppenger" <gubydala@....com>)
VBZooM <=V1.11 "sub-join.php" SQL Injection (Breeeeh@...mail.com)
Re: phpbb 3.x sql injection (with global moderator rights) (bugtraq@...thermic.com)
Re: LAMP vs Microsoft (Bob Beck <beck@...h.cns.ualberta.ca>)
Crtical Shockwave Embeded XSS Execution (spammeanddie@....com)
Fantastic Guestbook v2.0.1 Advisory (omnipresent@...il.it)
Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof)) (Matthias Kestenholz <lists@...nlock.ch>)
Re: LAMP vs Microsoft (Darren Reed <avalon@...igula.anu.edu.au>)
[OpenPKG-SA-2006.013] OpenPKG Security Advisory (mutt) (OpenPKG <openpkg@...npkg.org>)
Re: LAMP vs Microsoft (Bob Beck <beck@...h.cns.ualberta.ca>)

July 16 (10 messages)

Re: Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround (Michael Shigorin <mike@...n.org.ua>)
Re: Securing PHP or finding PHP alternatives (Michael Shigorin <mike@...n.org.ua>)
Re: LAMP vs Microsoft (Joel Maslak <jmaslak@...elope.net>)
Re: Buddy Zone Version 1.0.1 - XSS (support@...tal.com)
Invision Power Board 2.1 <= 2.1.6 sql injection (rst@....ru)
Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof)) (Meet Myself on the Internet <me@...eabstracta.net>)
Re: Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround (Lukasz Trabinski <lukasz@...siz.edu.pl>)
Re: [Full-disclosure] Re: Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t Exploit ( BID 18874 / CVE-2006-2451 ) (Jon Hart <jhart@...ofed.org>)
Gracenote buffer overflow ("MNV" <mnv@...mni.princeton.edu>)
MyBulletinBoard (MyBB) 1.1.5 'CLIENT-IP' sql injection (rgod@...istici.org)

July 17 (12 messages)

Mercury Messenger (Hans Wolters <hans.wolters@...all.nl>)
Re: Bybass HTTP ( extension files ) in ISA 2004 ("Thor (Hammer of God)" <thor@...merofgod.com>)
Several updates in MS PowerPoint 0-day Vulnerability FAQ at SecuriTeam Blogs (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
PHP Event Calendar versi 1.4 (path_to_calendar) Remote File Inclusion (chris_hasibuan@...oo.com)
Calendar Module <= 1.5.7 Remote File Include Vulnerabilities (matdhule@...il.com)
Plesk Control Panel <= 8.0.0 XSS vulnerability (vuln.invent@...il.com)
Re: Phorum 5.1.14 XSS SQL injection Vulnerability (Maurice Makaay <maurice.makaay@...ernl.net>)
Secunia Research: IceWarp Web Mail Two File Inclusion Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1109-1] New rssh packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
RE: Bybass HTTP ( extension files ) in ISA 2004 ("Edward Tripovich" <edward.tripovich@...mail.com>)
rPSA-2006-0130-1 kernel ("Justin M. Forbes" <jmforbes@...th.com>)
[EEYEB-20060227] D-Link Router UPNP Stack Overflow ("eEye Advisories" <Advisories@...e.com>)

July 18 (44 messages)

Secunia Research: VisNetic Mail Server Two File Inclusion Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1110-1] New samba packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Secunia Research: BitZipper unacev2.dll Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
PacSec 2006 CALL FOR PAPERS (Deadline Aug. 4; Event Nov. 27-30) (Dragos Ruiu <dr@....net>)
boastMachine <= 3.1 SQL Injection Exploit (gmdarkfig@...il.com)
ListMessenger v0.9.3 Remote File Inclusion Vulnerability (x0r0n@...mail.com)
Multiple vulnerabilities in UFO2000 svn 1057 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 1111-1] New Linux kernel 2.6.8 packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1112-1] New mysql-dfsg-4.1 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Invision Power Board 2.1 <= 2.1.6 sql injection (paul dansing <dansing@...ssinfo.org>)
ToorCon 2006 Call for Papers ("h1kari@...rcon.org" <h1kari@...rcon.org>)
RUXCON 2006 Final Call For Papers (cfp@...con.org.au)
Re: Securing PHP or finding PHP alternatives (Crispin Cowan <crispin@...ell.com>)
[USN-319-1] Linux kernel vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: LAMP vs Microsoft (George Capehart <gwc@....org>)
Re: LAMP vs Microsoft (Darren Reed <avalon@...igula.anu.edu.au>)
New Article Mambo Component <= 1.0 (com_articles.php) Remote File Include Vulnerabilities (matdhule@...il.com)
23rd Chaos Communication Congress 2006: Call for Participation (fukami <fukami@...lin.ccc.de>)
Calendar Mambo Module <= 1.5.7 Remote File Include Vulnerabilities (matdhule@...il.com)
Re: Invision Power Board 2.1 <= 2.1.6 sql injection (str0ke <str0ke@...w0rm.com>)
Unauthenticated access to BT Voyager config file and PPP credentials embedded in HTML form (pagvacito <unknown.pentester@...il.com>)
Re: WebEx Downloader Plug-in Multiple Vulnerabilities + rant ("Mark Litchfield" <mark@...software.com>)
Cross Site Scripting Vulnerability in Zoho Virtual Office (ss_team <ssteam.pl@...il.com>)
Professional PHP Tools Guestbook Multiple Vulnerabilities (tamriel@....net)
ToendaCMS <= 1.0.0 arbitrary file upload (rgod@...istici.org)
Keyif Portal v2.0 - Microsoft Access Driver ( MDB ) Download (x0r0n@...mail.com)
Outpost Firewall Pro secrately fixing security flaws? ("Bipin Gautam" <gautam.bipin@...il.com>)
[ MDKSA-2006:124 ] - Updated kernel packages fix privilege escalation vulnerability (security@...driva.com)
Re: Invision Power Board 2.1 <= 2.1.6 sql injection (mattmecham@...il.com)
About the latest three Powerpoint vulnerabilities: exploitable? (ewt@...ecomitalia.it)
DeluxeBB mutiple vulnerabilities ("Jessica Hope" <jessicasaulhope@...glemail.com>)
[KAPDA::#52] - PHP-Post 1.0 Cookie Modification Privilege Escalation Vulnerability (farhadkey@...da.ir)
$100 plus several of my books if you can crack my Windows password hashes. ("Roger A. Grimes" <roger@...neretcs.com>)
RE: [lists] Re: PHP security (or the lack thereof) ("Curt Purdy" <purdy@...man.com>)
Oracle Database - SQL Injection in SYS.KUPW$WORKER [DB03] (ak@...-database-security.com)
Oracle Database - SQL Injection in SYS.DBMS_CDC_IMPDP [DB01] (ak@...-database-security.com)
Re: Bybass HTTP ( extension files ) in ISA 2004 (medozero@...oo.com)
Re: Bybass HTTP ( extension files ) in ISA 2004 (medozero@...oo.com)
WebScarab <= 20060621-0003 cross site scripting (security@...itz-naumann.com)
Consumers of Broadband Providers (ISP) may be open to hijack attacks (peter_philipp@...enet.de)
[SECURITY] [DSA 1113-1] New zope2.7 packages fix information disclosure (Moritz Muehlenhoff <jmm@...ian.org>)
ExtCalendar Mambo Module <= v2( extcalendar.php ) Remote File Include Vulnerabilities (saudi.unix@...mail.com)
PcAnywhere > 12 Local Privilege Escalation (root@...italbullets.org)

July 19 (33 messages)

Invision Power Board v2.1 <= 2.1.6 sql injection exploit (paul14075@...il.com)
Oracle Database - SQL Injection in SYS.DBMS_STATS [DB21] (ak@...-database-security.com)
[security bulletin] HPSBTU02132 SSRT061154 rev.1 - HP Tru64 UNIX running NIS ypserv, Remote Denial of Service (DoS) (security-alert@...com)
Oracle Database - SQL Injection in SYS.DBMS_UPGRADE [DB22] (ak@...-database-security.com)
hdweGUEST <= 2.1.1 Cross Site Scripting Vulnerabilities (tamriel@....net)
ASP.DLL Include File Buffer Overflow ("Brett Moore" <brett.moore@...urity-assessment.com>)
Escalation of privileges in Outpost and Lavasoft Firewalls -Unusual ShellExecute behavior (mullware@...il.com)
Re: Re: Invision Power Board 2.1 <= 2.1.6 sql injection (paul14075@...il.com)
Re: LAMP vs Microsoft (Bob Beck <beck@...h.cns.ualberta.ca>)
Re: XSS phpBB 2.0.21 in administration ("Jessica Hope" <jessicasaulhope@...glemail.com>)
Re: LAMP vs Microsoft (Hugo van der Kooij <hvdkooij@...derkooij.org>)
Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit (str0ke <str0ke@...w0rm.com>)
osDate 1.1.7 multiple vulnerabilities (binary.loc@...il.com)
Re: crashing firefox <= 1.5.0.4 (bugtraq@...ev.net)
Webmin / Usermin Arbitrary File Disclosure Vulnerability Perl ("Alexander Hristov" <joffer@...il.com>)
New PowerPoint Trojan installs itself as LSP (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[USN-320-1] PHP vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[ MDKSA-2006:125 ] - Updated webmin packages fix arbitray file read vulnerability. (security@...driva.com)
[ MDKSA-2006:127 ] - Updated gimp packages fix buffer overflow vulnerability. (security@...driva.com)
[ MDKSA-2006:126 ] - Updated libtunepimp packages fixes buffer overflow vulnerabilities. (security@...driva.com)
[ MDKSA-2006:128 ] - Updated wireshark packages fix numerous vulnerabilities (security@...driva.com)
Re: Bybass HTTP ( extension files ) in ISA 2004 ("Thor (Hammer of God)" <thor@...merofgod.com>)
rPSA-2006-0132-1 tshark wireshark ("Justin M. Forbes" <jmforbes@...th.com>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Security Monitoring, Analysis and Response System (CS-MARS) (Cisco Systems Product Security Incident …)
VMSA-2006-0003 VMware possible incorrect permissions on SSL key files (VMware Security Team <security@...are.com>)
[ GLSA 200607-06 ] libpng: Buffer overflow (Thierry Carrez <koon@...too.org>)
[USN-319-2] Linux kernel vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: imageVue16.1 upload vulnerability (info@...gevuex.com)
[USN-313-2] OpenOffice.org vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
AFCommerce Shopping Cart (sledge@...adise.net.nz)
Security point-of-contact for Ameritrade? ("James M. Blackburn" <BlackburnJ@...c.edu>)
Re: osDate 1.1.7 multiple vulnerabilities (binary.loc@...il.com)
rPSA-2006-0133-1 libpng ("Justin M. Forbes" <jmforbes@...th.com>)

July 20 (8 messages)

Cisco MARS < 4.2.1 remote compromise (Jon Hart <jhart@...ofed.org>)
[ECHO_ADV_40$2006] iManage CMS <= 4.0.12 (absolute_path) Remote File Inclusion (matdhule@...il.com)
Advisory: Remote command execution in planetGallery (RedTeam Pentesting <release@...team-pentesting.de>)
[MajorSecurity #20]SiteDepth CMS <= 3.01 - Remote File Include Vulnerability (admin@...orsecurity.de)
[MajorSecurity #21] phpFaber TopSites <=2.0.9 - SQL Injection Vulnerability (admin@...orsecurity.de)
[MajorSecurity #22] Top XL <=1.1 - XSS and cookie disclosure (admin@...orsecurity.de)
[ MDKSA-2006:129 ] - Updated freetype2 packages fixes overflow vulnerability. (security@...driva.com)
[security bulletin] HPSBUX02108 SSRT061133 rev.12 - HP-UX Running Sendmail, Remote Execution of Arbitrary Code (security-alert@...com)

July 21 (14 messages)

rPSA-2006-0134-1 sendmail sendmail-cf ("Justin M. Forbes" <jmforbes@...th.com>)
[USN-321-1] mysql-dfsg-4.1 vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 1117-1] New libgd2 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200607-07 ] xine-lib: Buffer overflow (Thierry Carrez <koon@...too.org>)
SECURITY UPDATE::Farsinews release FarsiNewsPro3.0Stable1SecurityPath1 (armin390@...il.com)
[SECURITY] [DSA 1115-1] New GnuPG2 packages fix denial of service (joey@...odrom.org (Martin Schulze))
LoudBlog <=0.5 Sql injection (rgod@...istici.org)
Unidomedia Chameleon LE/Pro Directory Traversal (kicktd@...mail.com)
TSLSA-2006-0042 - multi (Trustix Security Advisor <tsl@...stix.org>)
Samba Internal Data Structures DOS Vulnerability Exploit ("Alexander Hristov" <joffer@...il.com>)
[ MDKSA-2006:130 ] - Updated kdelibs packages fix konqueror crash vulnerability. (security@...driva.com)
[SECURITY] [DSA 1114-1] New hashcash packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
SolpotCrew Advisory #2 - Advanced Poll ver 2.02 (base_path) Remote File Inclusion (chris_hasibuan@...oo.com)
[SECURITY] [DSA 1116-1] New gimp packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)

July 22 (43 messages)

[security bulletin] HPSBMA02133 SSRT061201 rev.1 - HP Oracle for OpenView (OfO) Critical Patch Update July 2006 (security-alert@...com)
Re: Samba Internal Data Structures DOS Vulnerability Exploit ("Gerald (Jerry) Carter" <jerry@...ba.org>)
Re: Securing PHP or finding PHP alternatives (Crispin Cowan <crispin@...ell.com>)
MiniBB Forum <= 1.5a Remote File Include (search.php-whosOnline.php) ("AG Spider" <ag-spider@...mail.com>)
iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability (labs-no-reply <labs-no-reply@...fense.com>)
Re: [EEYEB-20060227] D-Link Router UPNP Stack Overflow (kala_z@...mail.com)
Re: ATutor 1.5.3 Cross Site Scripting ("Steven M. Christey" <coley@...re.org>)
Re: LAMP vs Microsoft (Darren Reed <avalon@...igula.anu.edu.au>)
RE: $100 plus several of my books if you can crack my Windows password hashes. ("Roger A. Grimes" <roger@...neretcs.com>)
Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vu… (Micheal Turner <wh1t3h4t3@...oo.co.uk>)
Re: Securing PHP or finding PHP alternatives ("Michael Cordover" <michael.cordover@...il.com>)
Microsoft Internet Explorer DOS Vulnerability (SnoBmsn@...mail.de)
RE: [EEYEB-20060227] D-Link Router UPNP Stack Overflow ("m" <m@...v.com>)
[MajorSecurity #25] Advanced Guestbook 2.4 for phpBB - Multiple XSS and SQL-Injection Vulnerabilities (admin@...orsecurity.de)
[MajorSecurity #24] Fire-Mouse TopList <=v1.1 - Cross Site Scripting (admin@...orsecurity.de)
MicroGuestBook Remote XSS Attack (omnipresent@...il.it)
RE: XSS phpBB 2.0.21 in administration ("David Thomson" <dave@...inityhost.com>)
Low security hole affecting IPCalc's CGI wrapper (Tim Brown <timb@...-dimension.org.uk>)
[SECURITY] [DSA 1118-1] New Mozilla packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
about bid 17404 (crack@...e.com)
[SECURITY] [DSA 1119-1] New hiki packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: SubberZ[Lite] - Remote File Include (the.jalal@...il.com)
Re: XSS phpBB 2.0.21 in administration ("Jessica Hope" <jessicasaulhope@...glemail.com>)
New CVE identifiers for separate PowerPoint 0-day issues assigned (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
RE: $100 plus several of my books if you can crack my Windows password hashes. ("Michael Scheidell" <scheidell@...nap.net>)
Re: [EEYEB-20060227] D-Link Router UPNP Stack Overflow (scott <redhowlingwolves@...lsouth.net>)
RE: $100 plus several of my books if you can crack my Windows password hashes. ("Roger A. Grimes" <roger@...neretcs.com>)
new shell bypass safe mode (d3nger@...mail.com)
SolpotCrew Advisory #3 - com_trade Remote File Inclusion (mosConfig_absolute_path) (mail@...plah.com)
Re: XSS phpBB 2.0.21 in administration ("Jessica Hope" <jessicasaulhope@...glemail.com>)
[Kurdish Security # 13] Savant2 Remote File Include Vulnerability [For Mambo, Joomla] (botan@...uxmail.org)
Re: AFCommerce Shopping Cart (contact@...ommerce.com)
Re: ExtCalendar Mambo Module <= v2( extcalendar.php ) Remote File Include Vulnerabilities (matdhule@...il.com)
Re: New PowerPoint Trojan installs itself as LSP (Mike Healan <mike@...wareinfo.com>)
MiniBB Forum <= 1.5a Remote File Include (news.php) ("AG Spider" <ag-spider@...mail.com>)
Com Multibanners Remote File Inclusion (mosConfig_absolute_path) (mail@...e-spy.net)
[MajorSecurity #23] BLOG:CMS <= 4.0.0j - XSS and cookie disclosure (admin@...orsecurity.de)
Blackboard Academic Suite 6.2.23 +/-: Persistent cross-site scripting vulnerability (<harbl@...hmail.com>)
Re: [MajorSecurity #22] Top XL <=1.1 - XSS and cookie disclosure (admin@...orsecurity.de)
Re: [Full-disclosure] Re: New PowerPoint Trojan installs itself as LSP (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: Digital Armaments Security Advisory 10.07.2006: Flexwath Authorization Bypassing and XSS Vulnerability (sales@...xwatch.com)
Map MS Security Bulletins to MS KB numbers ("Matthew Leeds" <mleeds@...leeds.net>)
DotClear : Multiples Full Path Disclosure (Silitix@...il.com)

July 24 (25 messages)

[SECURITY] [DSA 1120-1] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[Kurdish Security # 14] MoSpray [base_dir] Remote Command Execution [ Mambo & Joomla] (botan@...uxmail.org)
Vanilla CMS <= 1.0.1 (RootDirectory) Remote file inclusion Vuln. (mfoxhacker@...il.com)
[ GLSA 200607-08 ] GIMP: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[CYBSEC] TippingPoint detection bypass ("Andres Riancho" <ariancho@...sec.com>)
Buffer-overflow in the XM loader of Cheese Tracker 0.9.9 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 1121-1] New postgrey packages fix denial of service (joey@...odrom.org (Martin Schulze))
PHP Live! v3.2 (header.php) Remote File Include Vulnerabilities (saudi.unix@...mail.com)
Re: [ GLSA 200607-08 ] GIMP: Buffer overflow (Michael Shigorin <mike@...n.org.ua>)
Re: Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosur… (Micheal Turner <wh1t3h4t3@...oo.co.uk>)
[USN-322-1] Konqueror vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Check Point R55W Directory Traversal ("Sec-Tec Lists" <zen31438@....co.uk>)
MusicBox <= 2.3.4 XSS SQL injection Vulnerability (securityconnection@...il.com)
[SECURITY] [DSA 1124-1] New fbi packages fix potential deletion of user data (Moritz Muehlenhoff <jmm@...ian.org>)
Windows XP/NT/SMB2003/2000 Denial of Service attack ("J. Oquendo" <joquendo@...hmail.com>)
ERRATA: [ GLSA 200607-08 ] GIMP: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Write-up by Amit Klein: "Forging HTTP request headers with Flash" ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities (admin@...orsecurity.de)
SQuery v.x (devi.php) (armygame.php) Remote File Inclusion (saudi.unix@...mail.com)
Heap overflow in the GT2 loader of libmikmod 3.2.2 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 1123-1] New libdumb packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Digital Armaments Security Advisory 24.07.2006: Siemens Speedstream Wireless/Router Denial of Service Vulnerability (info@...italarmaments.com)
rPSA-2006-0135-1 gimp ("Justin M. Forbes" <jmforbes@...th.com>)
Opsware NAS 6.0 reveals MySQL 'root' password ("Freeman, Michael" <mfreeman@...timax.com>)
SYMSA-2006-008:Password Safe - Lock Password Database Configuration Not Enforced (research@...antec.com)

July 25 (12 messages)

Buffer-overflow in recvTextMessage and NETrecvFile in Warzone Resurrection 2.0.3 (SVN 127) (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 1122-1] New Net::Server packages fix denial of service (joey@...odrom.org (Martin Schulze))
Two crash vulnerabilities in Freeciv 2.1.0-beta1 (SVN 15 Jul 2006) (Luigi Auriemma <aluigi@...istici.org>)
[ GLSA 200607-09 ] Wireshark: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[USN-296-2] Firefox vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Advisory: VMware Possible Incorrect Permissions On SSL Key Files ("Nick Breese" <nick.breese@...urity-assessment.com>)
[vuln.sg] DynaZip DZIP32.DLL/DZIPS32.DLL Buffer Overflow Vulnerabilities (vulnpost-remove@...n.sg)
[vuln.sg] TurboZIP ZIP Repair Buffer Overflow Vulnerability (vulnpost-remove@...n.sg)
[vuln.sg] AGEphone "sipd.dll" SIP Packet Handling Buffer Overflow (vulnpost-remove@...n.sg)
LinksCaffe 3.0 SQL injection/Command Execution Vulnerabilties (simo64@...il.com)
[ GLSA 200607-10 ] Samba: Denial of Service vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[security bulletin] HPSBUX02087 SSRT4728 rev.2 - HP-UX running TCP/IP Remote Denial of Service (DoS) (security-alert@...com)

July 26 (30 messages)

Re: Ashop Search Module SQL injection (security curmudgeon <jericho@...rition.org>)
[ MDKSA-2006:131 ] - Updated perl-Net-Server packages fix format string vulnerability (security@...driva.com)
Full Path Disclosure xGuestBook v1.02 (dicomdk@...il.com)
MS06-034 lies? IIS 6 can still be owned? (Cesar <cesarc56@...oo.com>)
Secunia Research: AutoVue SolidModel Professional Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[USN-297-3] Thunderbird vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-320-2] php4 regression (Martin Pitt <martin.pitt@...onical.com>)
EzUpload multi file vulnerabilities (hack2prison@...oo.com)
Multiple vulnerabilities in OpenCMS (Meder Kydyraliev <meder@....nu>)
[SECURITY] [DSA 1111-2] New Linux kernel 2.6.8 packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Write-up by Amit Klein: "Forging HTTP request headers with Flash" ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
Zyxel Prestige 660H-61 Cross-Site Scripting (jose.palanco@...el.es)
PHP-Auction SQL injection (l2odon@...oo.com)
ZDI-06-024: eIQNetworks Enterprise Security Analyzer License Manager Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
TP-Book <= 1.00 Cross Site Scripting Vulnerabilities (tamriel@....net)
Professional Home Page Tools Login Script Cross Site Scripting Vulnerabilities (tamriel@....net)
ZDI-06-023: eIQNetworks Enterprise Security Analyzer Syslog Server Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
wwwThreads XSS (l2odon@...oo.com)
TSRT-06-04: eIQnetworks Enterprise Security Analyzer Topology Server Buffer Overflow Vulnerability (TSRT@...m.com)
TSRT-06-03: eIQnetworks Enterprise Security Analyzer Syslog Server Buffer Overflow Vulnerabilities (TSRT@...m.com)
[SECURITY] [DSA 1125-1] New drupal packages fix execution of arbitrary web script code (Moritz Muehlenhoff <jmm@...ian.org>)
Cisco VPN Concentrator IKE resource exhaustion DoS Advisory (Roy Hills <Roy.Hills@...-monitor.com>)
Etomite CMS <= 0.6.1 'rfiles.php' remote command execution (rgod@...istici.org)
[USN-323-1] mozilla vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[ECHO_ADV_41$2006] BufferOverflow in Midirecord2 (the_day@...o.or.id)
[vuln.sg] PowerArchiver DZIPS32.DLL Buffer Overflow Vulnerability (vulnpost-remove@...n.sg)
[OpenPKG-SA-2006.014] OpenPKG Security Advisory (shiela) (OpenPKG <openpkg@...npkg.org>)
Secunia Research: FileCOPA Directory Argument Handling Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Phpprobid <= 5.24 XSS SQL injection Vulnerability (securityconnection@...il.com)
Re: new shell bypass safe mode (cxib@...urityreason.com)

July 27 (22 messages)

Re: Write-up by Amit Klein: "Forging HTTP request headers with Flash" (3CO <threecheeseopera@...il.com>)
NSFOCUS SA2006-07 : ISS RealSecure/BlackICE MailSlot Heap Overflow Detection Remote DoS Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
a6mambohelpdesk Mambo Component <= 18RC1 Remote Include Vulnerability (Dr.Jr7@...mail.com)
Re: Write-up by Amit Klein: "Forging HTTP request headers with Flash" ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
GeoClassifieds Enterprise <= 2.0.5.2 Cross Site Scripting (securityconnection@...il.com)
Re: Opsware NAS 6.0 reveals MySQL 'root' password (security-alert@...ware.com)
[SECURITY] [DSA 1126-1] New Asterisk packages fix denial of service (joey@...odrom.org (Martin Schulze))
Cross-Site Scripting and Local File Inclusion in Phorum (Meftun@...tunNet.Com)
Buffer Overflow Vulnerability in Winlpd (Meftun@...tunNet.Com)
Re: Low security hole affecting IPCalc's CGI wrapper (krischan@...ies.de)
[USN-324-1] freetype vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-325-1] ruby1.8 vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-326-1] heartbeat vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 1125-2] New drupal packages fix execution of arbitrary web script code (revised packages) (Moritz Muehlenhoff <jmm@...ian.org>)
Secunia Research: Mozilla Firefox XPCOM Event Handling Memory Corruption (Secunia Research <remove-vuln@...unia.com>)
Bypassing Oracle dbms_assert (ak@...-database-security.com)
ZDI-06-025: Mozilla Firefox Javascript navigator Object Vulnerability (zdi-disclosures@...m.com)
rPSA-2006-0137-1 firefox ("Justin M. Forbes" <jmforbes@...th.com>)
Xss in MttKe-php v2.6 (R0t-K33Y@...mail.com)
AIM Triton 1.0.4 (SipXtapi) Remote Buffer Overflow Exploit (PoC) (c0rrupt@...r.us)
Oracle 10g R2 and, probably, all previous versions ("putosoft softputo" <hasecorp@...mail.com>)
Re: HYSA-2006-008 myBloggie 2.1.3 CRLF & SQL Injection ("Steven M. Christey" <coley@...re.org>)

July 28 (27 messages)

[USN-327-1] firefox vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Cisco Security Advisory: Windows VPN Client Local Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[USN-328-1] Apache vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[FLSA-2006:175040] Updated php packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Re: Bypassing Oracle dbms_assert ("David Litchfield" <davidl@...software.com>)
[SECURITY] [DSA 1127-1] New ethereal packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[OpenPKG-SA-2006.015] OpenPKG Security Advisory (apache) (OpenPKG <openpkg@...npkg.org>)
[SECURITY] [DSA 1128-1] New heartbeat packages fix local denial of service (joey@...odrom.org (Martin Schulze))
Portail PHP v1.7 Remote File Include (Meftun@...tunNet.Com)
[OpenPKG-SA-2006.016] OpenPKG Security Advisory (ruby) (OpenPKG <openpkg@...npkg.org>)
[OpenPKG-SA-2006.017] OpenPKG Security Advisory (freetype) (OpenPKG <openpkg@...npkg.org>)
[ MDKSA-2006:132 ] - Updated libwmf packages fixes integer overflow vulnerability (security@...driva.com)
Remote Include Vulnerability ====> in Dr.Jr7 Gallery 3.2 RC1 (R0t-K33Y@...mail.com)
RE: Bypassing Oracle dbms_assert ("Alexander Kornbrust" <ak@...-database-security.com>)
Re: Bypassing Oracle dbms_assert ("David Litchfield" <davidl@...software.com>)
[Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released ("William A. Rowe, Jr." <wrowe@...che.org>)
Oracle 10g R2 and, probably, all previous versions (Russell Lowenthal <perpetualv@...oo.com>)
Apache mod_rewrite Buffer Overflow Vulnerability (Avert@...rtlabs.com)
[SECURITY] [DSA 1129-1] New osiris packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
PHP-Nuke INP XSS (l2odon@...oo.com)
Guestbook Mambo Module <== v1.3.0 Multiple Remote File Include Vulnerabilities (matdhule@...il.com)
Re: Fusion Polls (xtrphome) Remote File Inclusion (security curmudgeon <jericho@...rition.org>)
Lan-Aces Office Logic (Mike@...echnology.com)
Re: Check Point R55W Directory Traversal (dave_kwek@....gov.sg)
cpanel login problem (ali@...kerz.ir)
Hustle -- Tumbleweed Email Firewall Remote Vulnerability ("Ryan Smith" <whatstheaddress@...il.com>)
PrinceClan Chess Mambo Com <= 0.8 Remote Inclusion Vulnerability (tr_zindan@...fsecurity.org)

July 29 (18 messages)

rPSA-2006-0139-1 httpd mod_ssl ("Justin M. Forbes" <jmforbes@...th.com>)
[USN-329-1] Thunderbird vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
PHP ip2long() function circumvention (rgod@...istici.org)
Coppermine Photo Gallery v1.2.2b-Nuke Remote File Inclusion Vulnerabilities (A-S-T2006@...mail.com)
XSS vulnerability on AWBS (newbinaryfile@...il.com)
RE: TSRT-06-04: eIQnetworks Enterprise Security Analyzer Topology Server Buffer Overflow Vulnerability ("Desai, Deepen" <ddesai1@...licynetworks.com>)
Re: Cisco VPN Concentrator IKE resource exhaustion DoS Advisory (Eloy Paris <elparis@...co.com>)
Mambo Gallery Manager v095.r3 Remote File Inclusion Vulnerabilities (A-S-T2006@...mail.com)
[ MDKSA-2006:133 ] - Updated apache packages fix mod_rewrite vulnerability (security@...driva.com)
mambatstaff Mambo Component <= Remote Include Vulnerability (Dr.Jr7@...mail.com)
[ GLSA 200607-12 ] OpenOffice.org: Multiple vulnerabilities (Stefan Cornelius <dercorny@...too.org>)
artlinks Mambo Component <= Remote Include Vulnerability (Dr.Jr7@...mail.com)
[KAPDA::#53] MYBB XSS and Dir Traversal in usercp.php (roozbeh_afrasiabi@...oo.com)
[ MDKSA-2006:134 ] - Updated ruby packages fix safe-level vulnerabilities (security@...driva.com)
Gdiplus.dll division by 0 (Mr.Niega@...il.com)
Re: cpanel login problem (nate <nate@...urityminded.net>)
[ GLSA 200607-13 ] Audacious: Multiple heap and buffer overflows (Matthias Geerdsen <vorlon@...too.org>)
[ GLSA 200607-11 ] TunePimp: Buffer overflow (Stefan Cornelius <dercorny@...too.org>)

July 31 (23 messages)

UPDATE: [ GLSA 200605-08 ] PHP: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
RE: cpanel login problem ("Bugs" <bugs@...guinhost.net>)
Re: cpanel login problem (Scott Gemma <scott@...nel.net>)
Re: Portail PHP v1.7 Remote File Include (x0r0n@...mail.com)
Re: PHP ip2long() function circumvention (darylf@...rter.net)
com_moskool (admin.moskool.php) Remote File Include Vulnerabilities (saudi.unix@...mail.com)
ATutor <= 1.5.3.1 'links' blind SQL injection / admin credentials disclosure (rgod@...istici.org)
Re: cpanel login problem (<usar_y_tirar@...hmail.com>)
PHPAuction 2.1 (maybe higher) with phpAdsNew 2.0.5 RFI (philipp.niedziela@....de)
SQL injection Seir Anphin v666 Community Management System (vulnerabilities@...l.ru)
Re: Cisco VPN Concentrator IKE resource exhaustion DoS Advisory (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
Re: Gdiplus.dll division by 0 ("Early Warning Team" <ewt@...ecomitalia.it>)
Re: Check Point R55W Directory Traversal (Hugo van der Kooij <hvdkooij@...derkooij.org>)
Oracle and Apache mod_rewrite Vulnerability (tigerblue@...zleapuma.de)
Corsaire Security Advisory - VMware ESX Server Password Cross Site Request Forgery issue ("advisories" <advisories@...saire.com>)
Corsaire Security Advisory - VMware ESX Server Password Disclosure in Log issue ("advisories" <advisories@...saire.com>)
Corsaire Security Advisory - VMware ESX Server Password Disclosure in Cookie issue ("advisories" <advisories@...saire.com>)
Re: [EEYEB-20060227] D-Link Router UPNP Stack Overflow (solutions_PHP <support@...utionsphp.com>)
Multiple vulnerabilities in Open Cubic Player 2.6.0pre6 / 0.1.10_rc5 (Luigi Auriemma <aluigi@...istici.org>)
Re: Xss in MttKe-php v2.6 ("Steven M. Christey" <coley@...re.org>)
RE: cpanel login problem ("Alan" <bugtraq@...26.net>)
MyNewsGroups <= 0.6b (myng_root) Remote Inclusion Vulnerability (philipp.niedziela@....de)
Re: Do world's famous companies take care of their security? ("Steven M. Christey" <coley@...re.org>)

591 messages

Powered by blists - more mailing lists