bugtraq mailing list - 2006/08

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2006/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 27	² 22	³ 29	⁴ 15	⁵ 5	⁶
⁷ 43	⁸ 18	⁹ 14	¹⁰ 23	¹¹ 42	¹² 14	¹³
¹⁴ 25	¹⁵ 42	¹⁶ 15	¹⁷ 19	¹⁸ 37	¹⁹ 7	²⁰
²¹ 20	²² 20	²³ 17	²⁴ 16	²⁵ 17	²⁶ 12	²⁷
²⁸ 12	²⁹ 19	³⁰ 17	³¹ 23

Messages by day:

August 1 (27 messages)

[ GLSA 200608-01 ] Apache: Off-by-one flaw in mod_rewrite (Matthias Geerdsen <vorlon@...too.org>)
NewsLetter v3.5 <= (NL_PATH) Remote File Inclusion Exploit (tr_zindan@...fsecurity.org)
[Kurdish Security # 16 ] newsReporter v1.0 Remote Command Execution (botan@...uxmail.org)
[Kurdish Security # 17 ] GuestBook 3.5 Remote Command Execution (botan@...uxmail.org)
[Kurdish Security # 18 ] FAQ Script Remote Command Execution (botan@...uxmail.org)
[Kurdish Security # 19 ] FileManager Remote Command Execution (botan@...uxmail.org)
[Kurdish Security # 20 ] Quickie Remote Command Execution (botan@...uxmail.org)
[Kurdish Security # 21] ShoutBox v4.4 Remote Command Execution (botan@...uxmail.org)
[SECURITY] [DSA 1130-1] New sitebar packages fix cross-site scripting (joey@...odrom.org (Martin Schulze))
WoW Roster <= 1.5.x Remote File Include (hsList.php) ("AG Spider" <ag-spider@...mail.com>)
Re: Gdiplus.dll division by 0 ("giacomo collini" <gcliste@...il.com>)
[vuln.sg] Lhaplus LHA Extended Header Handling Buffer Overflow Vulnerability (vulnpost-remove@...n.sg)
[ MDKSA-2006:135 ] - Updated freeciv packages fix DoS vulnerabilities (security@...driva.com)
VMSA-2006-0004 Cross site scripting vulnerability and other fixes (VMware Security Team <security@...are.com>)
[USN-327-2] firefox regression (Martin Pitt <martin.pitt@...onical.com>)
TSEP 0.9.4.2 <= Remote File Inclusion (philipp.niedziela@....de)
ISS BlackICE PC Protection DLL faking of run-time linked libraries Vulnerability (David Matousek <david@...ousec.com>)
WoW Roster <= 1.5.x Remote File Include (hsList.php) ("AG Spider" <ag-spider@...mail.com>)
[SECURITY] [DSA 1132-1] New apache2 packages fix buffer overflow (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1131-1] New apache package fix buffer overflow (Steve Kemp <skx@...ian.org>)
SUSE Security Announcement: freetype2 (SUSE-SA:2006:045) (Thomas Biege <thomas@...e.de>)
[ MDKSA-2006:136 ] - Updated kdegraphics packages fix multiple libtiff vulnerabilities (security@...driva.com)
SUSE Security Announcement: libtiff (SUSE-SA:2006:044) (Thomas Biege <thomas@...e.de>)
SYM06-013 Symantec On-Demand Protection Encrypted Data Exposure (secure@...antec.com)
Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01] (gssincla@...software.com)
Barracuda Vulnerability: Arbitrary File Disclosure [NNL-20060801-02] (gssincla@...software.com)
DMA[2006-0801a] - 'Apple OSX fetchmail buffer overflow' ("K F (lists)" <kf_lists@...italmunition.com>)

August 2 (22 messages)

Re: Gdiplus.dll division by 0 (Dennis Lubert <plasmahh@...jectiwear.org>)
[ MDKSA-2006:137 ] - Updated libtiff packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1133-1] New mantis packages fix execution of arbitrary web script code (Moritz Muehlenhoff <jmm@...ian.org>)
JavaScript port scanning ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
rPSA-2006-0142-1 libtiff ("Justin M. Forbes" <jmforbes@...th.com>)
EEYE: research.eeye.com ("Marc Maiffret" <mmaiffret@...e.com>)
[SECURITY] [DSA 1134-1] New Mozilla Thunderbird packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Secunia Research: Jetbox Multiple Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Re: Cisco VPN Concentrator IKE resource exhaustion DoS Advisory (Roy Hills <Roy.Hills@...-monitor.com>)
Re: SYM06-013 Symantec On-Demand Protection Encrypted Data Exposure (Chris Wysopal <weld@...nwatch.org>)
SaveWeb Portal 3.4 <- (SITE_Path) Remote File Inclusion Vulnerability (x0r0n@...mail.com)
Content Management Framework "G3" - XSS Vulnerability in Search Function (Stefan Friedli <stefan.friedli@...il.com>)
rPSA-2006-0143-1 gnupg ("Justin M. Forbes" <jmforbes@...th.com>)
[eVuln] MyBB 'Avatar URL' XSS Vulnerability (alex@...ln.com)
[USN-330-1] tiff vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Re: Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01] ("pingywon" <pingywon@...mail.com>)
[security bulletin] HPSBUX02108 SSRT061133 rev.13 - HP-UX Running Sendmail, Remote Execution of Arbitrary Code (security-alert@...com)
[SECURITY] [DSA 1136-1] New gpdf packages fix denial of service (joey@...odrom.org (Martin Schulze))
[security bulletin] HPSBUX02124 SSRT061159 rev.1 - HP-UX Sendmail MIME Remote Denial of Service (DoS) (security-alert@...com)
OZJournal v1.5 - XSS (luny@...fucktard.com)
[SECURITY] [DSA 1137-1] New tiff packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[security bulletin] HPSBGN02136 SSRT061173 rev.1 - ProCurve Series 3500yl, 6200yl, and 5400zl Switches Running Software Prior to K.11.33 R… (security-alert@...com)

August 3 (29 messages)

Hobbit monitor security bugfix release - 4.1.2p2 (henrik@...n.dk (Henrik Stoerner))
[SECURITY] [DSA 1138-1] New cfs packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1135-1] New libtunepimp packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[security bulletin] HPSBUX02087 SSRT4728 rev.3 - HP-UX running TCP/IP Remote Denial of Service (DoS) (security-alert@...com)
Simpliciti Locked Browser Jail Breakout Vulnerability (EvilPacket <evilpacket@...il.com>)
RE: Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01] ("Roger A. Grimes" <roger@...neretcs.com>)
TSEP <= 0.942 Remote File Include (beford <xbefordx@...il.com>)
Vwar v1.5.0 <= Sql Injection and XSS vuln. (mfoxhacker@...il.com)
Secunia Research: PC Tools AntiVirus Insecure Default Directory Permissions (Secunia Research <remove-vuln@...unia.com>)
CMSimple Cross Site Scripting (Outlaw@...a-security.net)
[USN-331-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-332-1] gnupg vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released ("Philip M. Gollucci" <pgollucci@...7g8.com>)
[SECURITY] [DSA 1139-1] New ruby1.6 packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
Re: [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
Javascript software authentication brute force attack (Gianstefano Monni <gianstefano@...nu.it>)
[MajorSecurity Advisory #27]ToendaCMS - Cross Site Scripting Issue (admin@...orsecurity.de)
SendCard <= 3.4.0 unauthorized administrative access / remote commands execution (rgod@...istici.org)
[SECURITY] [DSA 1140-1] New GnuPG packages fix denial of service (joey@...odrom.org (Martin Schulze))
SolpotCrew Advisory #5 - modernbill ver 1.6 (DIR) Remote File Inclusion (chris_hasibuan@...oo.com)
[ GLSA 200608-02 ] Mozilla SeaMonkey: Multiple vulnerabilities (Stefan Cornelius <dercorny@...too.org>)
[DRUPAL-SA-2006-011] Drupal 4.7.3 / 4.6.9 fixes XSS issue (Uwe Hermann <uwe@...mann-uwe.de>)
Re: Barracuda Vulnerability: Arbitrary File Disclosure [NNL-20060801-02] (Matthew Hall <lists@...c.co.uk>)
vbulletin 3.5.4 IE exploit xss (stefan@...otacom.net)
[ GLSA 200608-03 ] Mozilla Firefox: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
ME Download System 1.3 Remote File Inclusion (philipp.niedziela@....de)
[ GLSA 200608-04 ] Mozilla Thunderbird: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
ZoneX 1.0.3 - Publishers Gold Edition Remote File Inclusion Vulnerability (x0r0n@...mail.com)
[security bulletin] HPSBUX02137 SSRT051024 rev.1 - HP-UX Running Xserver Local Execution of Arbitrary Code, Privilege Elevation (security-alert@...com)

August 4 (15 messages)

GaesteChaos <= 0.2 Multiple Vulnerabilities (Tamriel <tamriel@....net>)
CounterChaos <= 0.48c SQL Injection Vulnerability (Tamriel <tamriel@....net>)
GeheimChaos <= 0.5 Multiple SQL Injection Vulnerabilities (Tamriel <tamriel@....net>)
XSS in Vbulletin 3.6.0 in IE 0nly (Stefan@...otacom.net)
[SECURITY] [DSA 1141-1] New GnuPG2 packages fix denial of service (joey@...odrom.org (Martin Schulze))
[ GLSA 200608-05 ] LibVNCServer: Authentication bypass (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200608-06 ] Courier MTA: Denial of Service vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ECHO_ADV_42$2006] BufferOverflow in Eremove Client (erdc@...o.or.id)
[SECURITY] [DSA 1142-1] New freeciv packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1143-1] New dhcp packages fix denial of service (joey@...odrom.org (Martin Schulze))
[ECHO_ADV_42$2006] PHP Live Helper <= 2.0 (abs_path) Remote File Inclusion (matdhule@...il.com)
TSLSA-2006-0044 - multi (Trustix Security Advisor <tsl@...stix.org>)
CAID 34509 - CA eTrust Antivirus WebScan vulnerabilities ("Williams, James K" <James.Williams@...com>)
phpAutoMembersArea 3.2.5 ($installed_config_file) Remote File Inclusion (philipp.niedziela@....de)
Barracuda Spam Firewall: Administrator Level Remote Command Execution [ID-20060804-01] (Matthew Hall <lists@...c.co.uk>)

August 5 (5 messages)

[ GLSA 200608-07 ] libTIFF: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
vBulletin 3.0.14 ~ init.php~ registerring global arbitary variable~ XSS exploit (addmimistrator@...il.com)
Tinyportal Shoutbox (exploitex@...mail.com)
[ GLSA 200608-08 ] GnuPG: Integer overflow vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
MyBloggie <= 2.1.4 trackback.php SQL injection / admin credentials disclosure (rgod@...istici.org)

August 7 (43 messages)

XSS Vulnerability in FTD v3.7.3 (try_og@...mail.com)
Re: flatnuke <= 2.5.7 arbitrary php file upload (segatom@...oo.it)
[ECHO_ADV_44$2006] PHP Simple Shop <= 2.0 (abs_path) Remote File Inclusion (erdc@...o.or.id)
XennoBB <= 2.1.0 "birthday" SQL injection (c.boulton@...board.com)
SAPID CMS remote File Inclusion vulnerabilities (simo64@...x.org)
0-day XP SP2 wmf exploit (cyanid-E <biz4rre@...il.com>)
SolpotCrew Advisory #6 - phpCC - Beta 4.2 (base_dir) Remote File Inclusion (chris_hasibuan@...oo.com)
0-day XP SP2 wmf exploit (some details) (cyanid-E <biz4rre@...il.com>)
NEWSolved Lite v1.9.2 (abs_path) Remote File Inclusion (philipp.niedziela@....de)
blur6ex 0.3 Comment title HTML inyection vuln. ("piiiiiii pppiiiiiiii" <heliosz_time@...mail.com>)
when will AV vendors fix this??? ("Bipin Gautam" <gautam.bipin@...il.com>)
PHP: Zend_Hash_Del_Key_Or_Index Vulnerability (Stefan Esser <sesser@...dened-php.net>)
IMENDIO PLANNER REMOTE FILENAME FORMAT STRING VULNERABILITY (king_purba@...oo.co.uk)
Multiple vulnerabilities in DConnect Daemon 0.7.0 (CVS 30 Jul 2006) (Luigi Auriemma <aluigi@...istici.org>)
[ GLSA 200608-10 ] pike: SQL injection vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
php local buffer underflow could lead to arbitary code execution (heintz@...mail.com)
[ GLSA 200608-11 ] Webmin, Usermin: File Disclosure (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[vuln.sg] Lhaz LHA Long Filename Buffer Overflow Vulnerability (vulnpost-remove@...n.sg)
Virtual War v1.5.0 Remote File Include (vwar_root) ("AG Spider" <ag-spider@...mail.com>)
[SECURITY] [DSA 1144-1] New chmlib packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Re: when will AV vendors fix this??? (Denis Jedig <seclists@...eticon.de>)
linksys WRT54g authentication bypass ("Ginsu Rabbit" <ginsurabbit@...mail.com>)
[ GLSA 200608-12 ] x11vnc: Authentication bypass in included LibVNCServer code (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Will Microsoft patch remarkable old Msjet40.dll issue? (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: Vanilla CMS <= 1.0.1 (RootDirectory) Remote file inclusion Vuln. (dinoboff@...mail.com)
RE: linksys WRT54g authentication bypass ("Andy Meyers" <andy.meyers@...hmail.com>)
simplog 0.9.3 and prior XSS ("piiiiiii pppiiiiiiii" <heliosz_time@...mail.com>)
Visual Events Calendar v1.1 (cfg_dir) Remote Inclusion Vulnerability (x0r0n@...mail.com)
DeluxeBB Multiple Vulnerabilities (darkz.gsa@...il.com)
TSRT-06-06: Computer Associates eTrust AntiVirus WebScan Manifest Processing Buffer Overflow Vulnerability (TSRT@...m.com)
TSRT-06-05: Computer Associates eTrust AntiVirus WebScan Automatic Update Code Execution Vulnerability (TSRT@...m.com)
Re: [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released (Steve VanDevender <stevev@...adecimal.uoregon.edu>)
Re: SolpotCrew Advisory #5 - modernbill ver 1.6 (DIR) Remote File Inclusion (Mailinglists Address <mailinglist@...resshosting.net>)
ARES 2007: Call for workshop proposals, deadline Sept 10, 2006 ("Manh Tho" <manhthovn@...il.com>)
Attacking the local LAN via XSS ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [Full-disclosure] Attacking the local LAN via XSS (Schanulleke <schalulleke@...il.com>)
Re: [Full-disclosure] Attacking the local LAN via XSS (Thierry Zoller <Thierry@...ler.lu>)
Re: [Full-disclosure] Attacking the local LAN via XSS ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: Re[2]: [Full-disclosure] Attacking the local LAN via XSS ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re[2]: [Full-disclosure] Attacking the local LAN via XSS (Thierry Zoller <Thierry@...ler.lu>)
Re: vbulletin 3.5.4 IE exploit xss (james@...il.com)
AUTODAFE: an Act of Software Torture [FUZZER] (Martin Vuagnoux <autodafe@...gnoux.com>)
phpPrintAnalyzer <= 1.1 (rep_par_rapport_racine) Remote File Inclusion Vulnerability (sh3ll@...ll.ir)

August 8 (18 messages)

[EEYEB-20060719] McAfee Subscription Manager Stack Buffer Overflow ("eEye Advisories" <Advisories@...e.com>)
Announcement: Feed Injection in Web 2.0: Hacking RSS and Atom Feed Implementations [Whitepaper] ("SPI Labs" <Spi.Labs@...dynamics.com>)
[ GLSA 200608-13 ] ClamAV: Heap buffer overflow (Matthias Geerdsen <vorlon@...too.org>)
ZDI-06-026: Microsoft Internet Explorer Multiple CSS Imports Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-06-027: Microsoft Internet Explorer CSS Class Ordering Memory Corruption Vulnerability (zdi-disclosures@...m.com)
[SECURITY] [DSA 1145-1] New freeradius packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Archangel Weblog 0.90.02 and prior Multiple HTML injections ("piiiiiii pppiiiiiiii" <heliosz_time@...mail.com>)
docpile:we v0.2.2 (INIT_PATH) Remote File Inclusion Vulnerability (x0r0n@...mail.com)
rPSA-2006-0147-1 mysql mysql-bench mysql-server ("Justin M. Forbes" <jmforbes@...th.com>)
phNNTP <= 1.3 (article-raw.php) Remote File Include Vulnerability (tr_zindan@...fsecurity.org)
Microsoft PowerPoint Malformed Record Memory Corruption (Sowhat <smaillist@...il.com>)
[ GLSA 200608-14 ] DUMB: Heap buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
unwrapping PL/SQL (pete@...efinnigan.com)
MojoScripts' xss vulnerable (tugra@...mail.com)
TSRT-06-07: eIQnetworks Enterprise Security Analyzer Monitoring Agent Buffer Overflow Vulnerabilities (TSRT@...m.com)
MITKRB-SA-2006-001: multiple local privilege escalation vulnerabilities (Tom Yu <tlyu@....EDU>)
Re: Will Microsoft patch remarkable old Msjet40.dll issue? (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
ERRATA: [ GLSA 200608-08 ] GnuPG: Integer overflow vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

August 9 (14 messages)

AW: Virtual War v1.5.0 Remote File Include (vwar_root) (Frank Reißner <mail@...nk-reissner.de>)
rPSA-2006-0150-1 krb5 krb5-server krb5-services krb5-test krb5-workstation ("Justin M. Forbes" <jmforbes@...th.com>)
[Overflow.pl] Clam AntiVirus Win32-UPX Heap Overflow (pucik@...rflow.pl)
SUSE Security Announcement: clamav (SUSE-SA:2006:046) (Ludwig Nussel <ludwig.nussel@...e.de>)
PgMarket 2.2.3 (CFG[libdir]) Remote File Inclusion Vulnerabilities (x0r0n@...mail.com)
[USN-333-1] libwmf vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Stack and heap overflows in MODPlug Tracker/OpenMPT 1.17.02.43 and libmodplug 0.8 (Luigi Auriemma <aluigi@...istici.org>)
TSRT-06-09: Microsoft DirectAnimation COM Object Memory Corruption Vulnerability (TSRT@...m.com)
Multiple buffer-overflows in AlsaPlayer 0.99.76 (Luigi Auriemma <aluigi@...istici.org>)
TSRT-06-08: Microsoft Internet Help COM Object Memory Corruption Vulnerability (TSRT@...m.com)
[ MDKSA-2006:139 ] - Updated krb5 packages fix local privilege escalation vulnerability (security@...driva.com)
Assessment of Vista Kernel Mode Security (ATR-Bugtraq <atrbugtraq@...urityfocus.com>)
[SECURITY] [DSA 1148-1] New gallery packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1147-1] New drupal packages fix cross-site scripting (Moritz Muehlenhoff <jmm@...ian.org>)

August 10 (23 messages)

Latinchat Denial Of Service (Vicente Perez <vp.vicenteperez@...il.com>)
[SECURITY] [DSA 1146-1] New krb5 packages fix privilege escalation (joey@...odrom.org (Martin Schulze))
[ MDKSA-2006:138 ] - Updated clamav packages fix vulnerability (security@...driva.com)
CivicSpace Version 0.8.5 HTML injection ("HeLiOsZ RooT" <heliosz_time@...mail.com>)
BlogHoster v2.2 Post Comment Html Injection ("piiiiiii pppiiiiiiii" <heliosz_time@...mail.com>)
Cwfm <= 0.9.1 (Language) Remote File Inclusion Vulnerability (philipp.niedziela@....de)
[ MDKSA-2006:140 ] - Updated ncompress packages fix vulnerability (security@...driva.com)
[ISR] - Novell Groupwise Webaccess (Cross-Site Scripting) ("Francisco Amato" <famato@...obyte.com.ar>)
TSRT-06-10: Microsoft HLINK.DLL Hyperlink Object Library Buffer Overflow Vulnerability (TSRT@...m.com)
XChat <= 2.6.4-1 (win version) Remote Denial of Service Exploit (php) (ratboy727@...il.com)
PHPMyRing <= 4.2.0 (view_com.php) Remote SQL Injection (simo64@...x.org)
Yabb XSS (Outlaw@...a-security.net)
TinyWebGallery v1.5 ( image ) Remote Include Vulnerability (x0r0n@...mail.com)
[SECURITY] [DSA 1149-1] New ncompress packages fix potential code execution (joey@...odrom.org (Martin Schulze))
Sending multipart/form-data requests from Flash (with arbitrary headers) ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
Directory Traversal vulnerability in IPCheck Monitor Server (auuw73@....pipex.com)
CYBSEC - Security Pre-Advisory: SAP Internet Graphics Service (IGS) Remote Denial of Service (Mariano Nuñez Di Croce <mnunez@...sec.com>)
CYBSEC - Security Pre-Advisory: SAP Internet Graphics Service (IGS) Remote Buffer Overflow (Mariano Nuñez Di Croce <mnunez@...sec.com>)
PocketPC MMS - Remote Code Injection/Execution Vulnerability and Denial-of-Service ("Collin R. Mulliner" <collin@...aversion.net>)
[ GLSA 200608-15 ] MIT Kerberos 5: Multiple local privilege escalation (test Falco for security@) (Raphael Marichez <falco@...too.org>)
[ GLSA 200608-17 ] libwmf: Buffer overflow vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200608-18 ] Net::Server: Format string vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200608-16 ] Warzone 2100 Resurrection: Multiple buffer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

August 11 (42 messages)

Re: SYM06-013 Symantec On-Demand Protection Encrypted Data Exposure (dm@...urityfocus.com)
Mambo/Joomla Component Remository v3.25 (mosConfig_absolute_path) Remote File Inclusion Vulnerability (camino@...magnet.com)
Netgear FVG318 is vunerable to DOS attack (root@...alhost.com)
Mafia Moblog <= 6 (pathtotemplate) Remote File Inclusion Vulnerability (sh3ll@...ll.ir)
InfanView 3.98 (with plugins) - Access violation at processing images ANI files (sehato@...dex.ru)
myBloggie <= 2.1.3 (mybloggie_root_path) Remote File Inclusion Vulnerability (sh3ll@...ll.ir)
Compersus ASP shopping cart <= DataBase Downloading vuln. (mfoxhacker@...il.com)
Virtual War v1.5.0 <= Sql Injection vuln. (mfoxhacker@...il.com)
XennoBB <= "avatar gallery" Directory Transversal (c.boulton@...board.com)
CGI Script Source Code Disclosure Vulnerability in Apache for Windows (susam.pal@...il.com)
Simple one-file GuestBook 1.0 (omnipresent@...il.it)
Dragonfly CMS 9.0.6.1 and prior XSS ("HeLiOsZ RooT" <heliosz_time@...mail.com>)
Security Contact ("Sean Warnock" <swarnock@...nocksolutions.com>)
Re: when will AV vendors fix this??? (Marius Huse Jacobsen <mahuja@....net>)
RE: when will AV vendors fix this??? ("Thomas D." <whistl0r@...glemail.com>)
Re: when will AV vendors fix this??? (Paul Schmehl <pauls@...allas.edu>)
RE: [Full-disclosure] RE: when will AV vendors fix this??? ("Thomas D." <whistl0r@...glemail.com>)
Re: Re: Cisco VPN Concentrator IKE resource exhaustion DoS Advisory (henry.sieff@...il.com)
Re: [Full-disclosure] Attacking the local LAN via XSS (Nikolay Kubarelov <admin@...mophon.com>)
Re: linksys WRT54g authentication bypass (Nicholas Knight <nknight@...awaynet.com>)
Re: linksys WRT54g authentication bypass (Rodrigo Barbosa <rodrigob@...kover.org>)
Re: linksys WRT54g authentication bypass ("Ginsu Rabbit" <ginsurabbit@...mail.com>)
RE: linksys WRT54g authentication bypass ("Miguel Valentin" <valentinousn@...izon.net>)
RE: linksys WRT54g authentication bypass ("Ginsu Rabbit" <ginsurabbit@...mail.com>)
Re: when will AV vendors fix this??? ("Bipin Gautam" <gautam.bipin@...il.com>)
Bypassing script filters with variable-width encodings ("Cheng Peng Su" <applesoup@...il.com>)
Re: linksys WRT54g authentication bypass ("guant a" <guant@...kermail.com>)
XSSing the Lan 3 (web trojans.. not a new idea) ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: linksys WRT54g authentication bypass ("Ginsu Rabbit" <ginsurabbit@...mail.com>)
Security Vulnerability in Ruby on Rails 1.1.x (michael@...iarski.com)
[security bulletin] HPSBUX02108 SSRT061133 rev.14 - HP-UX Running Sendmail, Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBUX02124 SSRT061159 rev.2 - HP-UX Sendmail MIME Remote Denial of Service (DoS) (security-alert@...com)
TSLSA-2006-0046 - multi (Trustix Security Advisor <tsl@...stix.org>)
Re: Re: Cisco VPN Concentrator IKE resource exhaustion DoS Advisory ("Henry Sieff" <henry.sieff@...il.com>)
miniBloggie <= 1.0 (fname) Remote File Inclusion Vulnerability (sh3ll@...ll.ir)
[ GLSA 200608-19 ] WordPress: Privilege escalation (Raphael Marichez <falco@...too.org>)
Startpage <= 1.0 (cfgLanguage) Remote File Inclusion Vulnerability (sh3ll@...ll.ir)
rPSA-2006-0152-1 squirrelmail ("Justin M. Forbes" <jmforbes@...th.com>)
WEBInsta Mailing list manager (cabsolute_path) 1.3e RFI (philipp.niedziela@....de)
Re: [ GLSA 200608-12 ] x11vnc: Authentication bypass in included LibVNCServer code (xvml@...lrunge.com)
wheatblog ُSession.php Remote File Inclusion (Outlaw@...a-security.net)
UPDATE: [ GLSA 200511-12 ] Scorched 3D: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)

August 12 (14 messages)

VWar <= 1.50 R14 (n) Remote SQL Injection (brom0815@....de)
Nokia Browser Crash (qode@...e.org)
SquirrelMail 1.4.8 released - fixes variable overwriting attack (Thijs Kinkhorst <kink@...irrelmail.org>)
Re: [SM-ANNOUNCE] SquirrelMail 1.4.8 released - fixes variable overwriting attack (Yves Goergen <nospam.list@...lassified.de>)
Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability (sh3ll@...ll.ir)
myEvent <= 1.4 Multiple Remote File Include Vulnerabilities (sh3ll@...ll.ir)
Concurrency-related vulnerabilities in browsers - expect problems (Michal Zalewski <lcamtuf@...ne.ids.pl>)
[SECURITY] [DSA 1150-1] New shadow packages fix privilege escalation (joey@...odrom.org (Martin Schulze))
Microsoft Help (WINHLP32.EXE) - Multiple Remote Code Execution and Denial Of Service Vulnerabilities ("Benjamin Tobias Franz" <0-1-2-3@....de>)
Re: myBloggie <= 2.1.3 (mybloggie_root_path) Remote File Inclusion Vulnerability (nukedx@...edx.com)
(Security Advisory) SYM06-014 Symantec Backup Exec Internal RPC Overflow ("Secure" <secure@...antec.com>)
Forum Software ASPPlayground.NET Advanced Edition 2.4.5 Unicode Xss (blood2_20032003@...oo.com)
ScatterChat Advisory 2006-01: Cryptanalytic Attack Vulnerability ("ScatterChat Advisories" <sc_advisories@...ktivismo.com>)
Re: Microsoft Help (WINHLP32.EXE) - Multiple Remote Code Execution and Denial Of Service Vulnerabilities (Reversemode <advisories@...ersemode.com>)

August 14 (25 messages)

Re: TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability (public@...nk4dd.com)
Informix - Discovery, Attack and Defense ("David Litchfield" <davidl@...software.com>)
Informix Long Username Buffer Overflow Vulnerability ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Error logging buffer overflow in Informix ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Re: myEvent <= 1.4 Multiple Remote File Include Vulnerabilities ("Carsten Eilers" <ceilers-lists@....de>)
Re: Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
Re: Mafia Moblog <= 6 (pathtotemplate) Remote File Inclusion Vulnerability (noname@...omain.com)
[ECHO_ADV_45$2006] WEBinsta CMS 0.3.1 (templates_dir) Remote File Inclusion Vulnerability (erdc@...o.or.id)
RE: [Full-disclosure] RE: when will AV vendors fix this??? ("Dmitry Yu. Bolkhovityanov" <D.Yu.Bolkhovityanov@....nsk.su>)
Re: miniBloggie <= 1.0 (fname) Remote File Inclusion Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
Google Picasa Listening on Port 80? ("Geoff Vass" <geoff@...zow.com.au>)
SQLIDEBUG envariable overflow on Informix ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
XMB <= 1.9.6 Final basename()/'langfilenew' arbitrary local inclusion / remote commands execution (rgod@...istici.org)
Re: Yabb XSS - or NOT (Volker Tanger <vtlists@...e.de>)
BlaBla 4U XSS Vulnerabilite (vampire_chiristof@...oo.com)
Virtual War v1.5.0 SQL injection and XSS (vampire_chiristof@...oo.com)
Re: [SM-ANNOUNCE] SquirrelMail 1.4.8 released - fixes variable overwriting attack (Allie Daneman <ad@...nix.net>)
JavaScript get Internal Address (thanks to DanBUK) ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
RE: Re: Cisco VPN Concentrator IKE resource exhaustion DoS Advisory ("Lance Seelbach" <lance@...inc.net>)
Re: Startpage <= 1.0 (cfgLanguage) Remote File Inclusion Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
HPSBMA02138 SSRT061184 rev.1 - HP OpenView Storage Data Protector, Remote Arbitrary Command Execution (security-alert@...com)
Kaspersky Anti-Hacker personal firewall unstealthy stealth mode (tbratusa@...il.com)
Wordpress WP-DB Backup Plugin Directory Traversal Vulnerability (ss_team <ssteam.pl@...il.com>)
Arbitrary Library Loading in Informix ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Multiple Arbitrary Command Execution Vulnerabilities ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)

August 15 (42 messages)

InfanView 3.98 (with plugins) - Access violation at processing images CUR files (sehato@...dex.ru)
Re: [SM-ANNOUNCE] SquirrelMail 1.4.8 released - fixes variable overwriting attack (Michael Engert <michi@...lo.engert.org>)
Technical note: under some conditions, it's possible to steal HTTP credentials using Flash ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
Unauthorized Database Creation Privilege on Informix ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Local privilege Escalation in SmartLine DeviceLock 5.73 (seppi@...pig.de)
Multiple Password Exposures Flaws ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Re: Re: TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability (mr@...la.colostate.edu)
osDate 1.1.8 - Multiple HTML Injection Vulnerability - fixed (vijay@...rvijay.com)
RE: ANNOUNCING: 3rd Annual US OWASP AppSec Conference - Oct 16-18 2006 - Seattle, WA ("Dave Wichers" <dave.wichers@...ectsecurity.com>)
Re: Startpage <= 1.0 (cfgLanguage) Remote File Inclusion Vulnerability (noname@...omain.com)
Peoplebook Mambo Component <= v1.0 Remote File Include Vulnerabilities (matdhule@...il.com)
Multiple buffer-overflows in libmusicbrainz 2.1.2 (Luigi Auriemma <aluigi@...istici.org>)
[Overflow.pl] ImageMagick ReadSGIImage() Heap Overflow (Damian Put <pucik@...rflow.pl>)
(somewhat) breaking the same-origin policy by undermining dns-pinning ("Martin Johns" <martin.johns@...il.com>)
Multiple Buffer Overflow Vulnerabilities in Informix ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Joomla Webring Component (component_dir) Remote File Inclusion Vulnerabilities (x0r0n@...mail.com)
[ GLSA 200608-20 ] Ruby on Rails: Several vulnerabilities (Raphael Marichez <falco@...too.org>)
RE: linksys WRT54g authentication bypass ("TeamXMM Consulting, Inc." <security@...mxmm.com>)
Multiple Arbitrary File Access (Write/Read) Vulnerabilities ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Opera 9 Remote Denial of Service (NNP <version5@...il.com>)
Re: TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
Re: RE: linksys WRT54g authentication bypass (gooorguss@...il.com)
Re: Re: myBloggie <= 2.1.3 (mybloggie_root_path) Remote File Inclusion Vulnerability (istgha@...onianx.net)
Security contact from Critical Path Inc (Guillermo Marro <gmmarro@...wgate.net>)
Re: Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability ("Steven M. Christey" <coley@...re.org>)
[ MDKSA-2006:142 ] - Updated heartbeat packages fix vulnerability (security@...driva.com)
[ MDKSA-2006:141 ] - Updated gnupg packages fix vulnerability (security@...driva.com)
Re: phpPrintAnalyzer <= 1.1 (rep_par_rapport_racine) Remote File Inclusion Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
Mailslot bug (MS06-035) vs non-Mailslot bug (CVE-2006-3942) (Gerardo Richarte <lists@...e-sdi.com>)
[XSec-06-02]: Internet Explorer (IMSKDIC.DLL) COM Object Instantiation Vulnerability (nop <nop@...c.org>)
Re: Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
[XSec-06-03]: Internet Explorer (CHTSKDIC.DLL) COM Object Instantiation Vulnerability (nop <nop@...c.org>)
[XSec-06-04]: Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability (nop <nop@...c.org>)
[SECURITY] [DSA 1151-1] New heartbeat packages fix denial of service (joey@...odrom.org (Martin Schulze))
[security bulletin] HPSBUX02141 SSRT51153 rev.1 - HP-UX in Trusted mode, Local Denial of Service (DoS) (security-alert@...com)
Koobi Pro CMS 5.6 SQL injection & XSS (vampire_chiristof@...oo.com)
Re: Concurrency-related vulnerabilities in browsers - expect problems (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Lizge V.20 Web Portal File Include Vulnerability (crackers_child@...ersavascilar.com)
otopholder 1.8 suffers from a local file inclusion,XSS and directory listing vuln (vampire_chiristof@...oo.com)
fusionnews 3,7 Remote File Inclusion (Outlaw@...a-security.net)
local file include in PHP-Nuke (autohtml.php) (MosT3mR@...mail.com)
CORE-2006-0714: Microsoft SRV.SYS SMB_COM_TRANSACTION Denial of Service (Core Security Technologies advisories <advisories@...esecurity.com>)

August 16 (15 messages)

[USN-334-1] krb5 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[XSec-06-05]: VMware 5.5.1 for Windows arbitrary partition table delete issue. (root <root@...c.org>)
Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows (Joe Orton <jorton@...hat.com>)
Re: TinyWebGallery v1.5 ( image ) Remote Include Vulnerability (tinywebgallery@...mpfle.de)
Mambo com_lm component (archive.php) Remote File Include Vulnerabilities (crackers_child@...ersavascilar.com)
[USN-335-1] heartbeat vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[scip_Advisory 2456] Horde Framework and Horde IMP /index.php cross site referencing (Marc Ruef <maru@...p.ch>)
[scip_Advisory 2457] Horde Framework and Horde IMP /horde/imp/search.php cross site scripting (Marc Ruef <maru@...p.ch>)
MS Terminal Server application session breakout (pedantic1@...il.com)
ShockwaveFlash 9 (Stack overflow) (Mr.Niega@...il.com)
[security bulletin] HPSBUX02115 SSRT061077 rev.2 - HP-UX running Support Tools Manager (xstm, cstm, stm) Local Denial of Service (DoS) (security-alert@...com)
Technical note by Amit Klein: "Sending arbitrary HTTP requests with Flash 7/8 (+IE 6.0)" ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
[ MDKSA-2006:143 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
Re: MS Terminal Server application session breakout ("Thor (Hammer of God)" <thor@...merofgod.com>)
SYM06-16 Symantec NetBackup PureDisk Remote Office Edition Elevation of Privilege ("Mike Prosser" <mprosser@...antec.com>)

August 17 (19 messages)

Reporter Mambo Component Remote File İnclude (crackers_child@...ersavascilar.com)
Re: [Overflow.pl] ImageMagick ReadSGIImage() Heap Overflow (Daniel Kobras <kobras@...ian.org>)
discloser 0.0.4 Remote File Inclusion (with Exploit) (dr.t3rr0r1st@...oo.com)
[USN-337-1] imagemagick vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[EEYEB-20060703] IBM eGatherer ActiveX Code Execution Vulnerability ("eEye Advisories" <Advisories@...e.com>)
Registration Now Open!: Security OPUS Infosec Conference - Oct 2-5 2006 - San Francisco, CA ("Richard Lindberg" <Richard@...alRealms.com>)
[USN-336-1] binutils vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows (nareshhacker@...il.com)
[XSec-06-06]: Windows 2003 (tsuserex.dll) COM Object Instantiation Vulnerability (nop <nop@...c.org>)
CubeCart <= 3.0.11 SQL injection & cross site scripting (rgod@...istici.org)
Re: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems ("Steven M. Christey" <coley@...us.mitre.org>)
World Summit on Intrusion Prevention (wsip@...tek.com)
UPDATED: MITKRB5-SA-2006-001: multiple local privilege escalation vulnerabilities (Tom Yu <tlyu@....EDU>)
Re: discloser 0.0.4 Remote File Inclusion (with Exploit) ("Carsten Eilers" <ceilers-lists@....de>)
RE: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems ("Michael Wojcik" <Michael.Wojcik@...rofocus.com>)
powergap <= (s0x.php) Remote File Inclusion (saudi.unix@...mail.com)
Re: SYM06-16 Symantec NetBackup PureDisk Remote Office Edition Elevation of Privilege (secure@...antec.com)
[security bulletin] HPSBUX02139 SSRT5981 rev.1 - HP-UX Running the LP Subsystem, remote Denial of Service (DoS) (security-alert@...com)
[ MDKSA-2006:143-1 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)

August 18 (37 messages)

[XSec-06-07]: Visual Studio 6.0 Multiple COM Object Instantiation Vulnerability (nop <nop@...c.org>)
RE: Mailslot bug (MS06-035) vs non-Mailslot bug (CVE-2006-3942) ("Marc Maiffret" <mmaiffret@...e.com>)
ToorCon 8 Call for Papers Closing Tomorrow & Workshops/Seminars Added ("h1kari@...rcon.org" <h1kari@...rcon.org>)
Secunia Research: AOL Insecure Default Directory Permissions (Jakob Balle <jb@...unia.com>)
mtg_myhomepage Component For Mambo R.F.I (Outlaw@...a-security.net)
Joomla x-shop <= 1.7 Remote File Include Vulnerability (crackers_child@...ersavascilar.com)
Joomla Rssxt <= 1.0 Remote File Include Vulnerability (crackers_child@...ersavascilar.com)
anjel Mambo Component Remote File Include (crackers_child@...ersavascilar.com)
[SECURITY] [DSA 1152-1] New trac packages fix information disclosure (joey@...odrom.org (Martin Schulze))
mambo-phphop Product Scroller Module R.F.I (Outlaw@...a-security.net)
Norton DLL faking via 'SuiteOwners' protection bypass Vulnerability (David Matousek <david@...ousec.com>)
Mambo jim Component Remote Include Vulnerability (x0r0n@...mail.com)
Re: when will AV vendors fix this??? (Andreas Marx <gega-it@....de>)
Re: [Full-disclosure] RE: when will AV vendors fix this??? (Paul Schmehl <pauls@...allas.edu>)
Multiple xxs cPanel 10 (preth00nker@...il.com)
Re: [Full-disclosure] Re: when will AV vendors fix this??? (Paul Schmehl <pauls@...allas.edu>)
Re: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems (Michal Zalewski <lcamtuf@...ne.ids.pl>)
RE: Google Picasa Listening on Port 80? ("Kameron Gasso" <kgasso-lists@...p.net>)
UPDATE vBulletin Version 3.5.4 exploit (dicomdk@...il.com)
RE: Security contact from Critical Path Inc ("Tony Maupin" <tony@...maupins.com>)
Registration Now Open!: 3rd Annual US OWASP AppSec Conference - Oct 16-18 2006 - Seattle, WA ("Dave Wichers" <dave.wichers@...ectsecurity.com>)
OneOrZero Helpdesk V1.6.4.1 susceptible to SQL injection and XSS (vampire_chiristof@...oo.com)
Re: [Full-disclosure] RE: when will AV vendors fix this??? ("Bipin Gautam" <gautam.bipin@...il.com>)
JavaScript Lazy Authorization Forcer and Visited Link Scaner ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
contentpublisher Mambo Component Remote File Include Vulnerabilities (crackers_child@...ersavascilar.com)
Re: Mailslot bug (MS06-035) vs non-Mailslot bug (CVE-2006-3942) (naveed <naveedafzal@...il.com>)
Mambo mambelfish Component <= 1.1 Remote File Include Vulnerability (bilkopat@...mail.com)
[SECURITY] [DSA 1153-1] New ClamAV packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Joomla Kochsuite Component <= 0.9.4 (config.kochsuite.php) Remote File Inclusion Vulnerability (camino@...magnet.com)
Re: Concurrency-related vulnerabilities in browsers - expect problems (mannion@...t.net)
Re: UPDATE vBulletin Version 3.5.4 exploit (scott@...lletin.com)
Joomla MamboWiki Component <= 0.9.4 (MamboLogin.php) Remote File Inclusion Vulnerability (camino@...magnet.com)
[KAPDA::#55] - Joomla poll component vulnerability (alireza hassani <trueend5@...oo.com>)
Joomla RFİ ( ERNE ) (erne@...ealizm.com)
Sonium Enterprise Adressbook Version 0.2 (folder) RFI (philipp.niedziela@....de)
Re: Concurrency-related vulnerabilities in browsers - expect problems (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: Re: discloser 0.0.4 Remote File Inclusion (with Exploit) (dr.t3rr0r1st@...oo.com)

August 19 (7 messages)

Re: JavaScript Lazy Authorization Forcer and Visited Link Scaner (mikeiscool <michaelslists@...il.com>)
Modification For OpenSEF Remote file Inclusion (Outlaw@...a-security.net)
Ako Comments (mod) Remote File Inclusion (Outlaw@...a-security.net)
[Kurdish Security # 23] Spaw Editor Remote Include Vulnerability (botan@...uxmail.org)
Mambo CatalogShop Remote File Inclusion (Outlaw@...a-security.net)
Mambo com_cropimage 1.0 Component Remote Include Vulnerability (x0r0n@...mail.com)
XennoBB <= 2.2.1 "icon_topic" SQL Injection (c.boulton@...board.com)

August 21 (20 messages)

POC & exploit for Apache mod_rewrite off-by-one (Jacobo Avariento <jack-sec@...cas.org>)
LBlog <= "comments.asp" SQL Injection Exploit (ChironeX.FleckeriX@...il.Com)
WoltLab Burning Board 2.3.5(WBB) in XSS (ZeberuS@...eruS.Com)
[SECURITY] [DSA 1154-1] New squirrelmail packages fix information disclosure (Moritz Muehlenhoff <jmm@...ian.org>)
New PowerPoint 0-day and Trojan - FAQ document ready (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: [SECURITY] [DSA 1150-1] New shadow packages fix privilege escalation (Henry Jensen <hjensen@....de>)
[XSec-06-08]: Windows 2000 Multiple COM Object Instantiation Vulnerability (nop <nop@...c.org>)
Mambo Component - Display MOSBot Manager Remote File Inclusion Vuln (Outlaw@...a-security.net)
Mambo Component - Display MOSBot Manager Remote File Inclusion Vuln (Outlaw@...a-security.net)
DoS 2wire Gateway (preth00nker@...il.com)
Mambo Component - EstateAgent Remote File Inclusion (Outlaw@...a-security.net)
ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include (h4ck3riran@...oo.com)
[XSec-06-09]: Internet Explorer Multiple COM Objects Color Property DoS Vulnerability (nop <nop@...c.org>)
Re: Startpage <= 1.0 (cfgLanguage) Remote File Inclusion Vulnerability (securityfocus@...ijer.org)
SimpleBlog 2.0 <= "comments.asp" SQL Injection Exploit (ChironeX.FleckeriX@...il.Com)
Diesel Job Site forgot.php Cross-Site Scripting (night_warrior-@...mail.com)
Diesel Paid Mail getad.php Cross-Site Scripting Vulnerability (night_warrior-@...mail.com)
Smart Traffic Remote File Include Vulnerability (night_warrior-@...mail.com)
DieselPay İndex.php Cross-Site Scripting Vulnerability (night_warrior-@...mail.com)
[ MDKSA-2006:144 ] - Updated php packages fix vulnerability (security@...driva.com)

August 22 (20 messages)

[ MDKSA-2006:145 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
MDaemon POP3 server remote buffer overflow (preauth) ("infocus" <infocus@...igo.hr>)
[ MDKSA-2006:146 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
TTG0601 - Alt-N WebAdmin Multiple Vulnerabilities ("TTG" <releases@...low.com>)
Vendor Statement: fixed Mobotix IP Network Cameras Multiple XSS bug (dkabs@...otix.com)
Simpliciti Locked Browser Jail Breakout Vulnerability (dc@...pliciti.biz)
EEYE:ALERT: MS06-042 Related Internet Explorer 'Crash' is Exploitable ("Marc Maiffret" <mmaiffret@...e.com>)
Major updates in PowerPoint FAQ document - not a 0-day issue (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Simple Machines Forum <=1.1RC2 unset() vulnerabilities (rgod@...istici.org)
Re: Joomla x-shop <= 1.7 Remote File Include Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
Re: Joomla Rssxt <= 1.0 Remote File Include Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
unauthorized VNC access in AK-Systems Windows Terminals (Victor Sudakov <sudakov@...ptus.tomsk.ru>)
Re: Mambo Component - Display MOSBot Manager Remote File Inclusion Vuln (Jan de Groot <jan@....homeip.net>)
Re: mtg_myhomepage Component For Mambo R.F.I ("Carsten Eilers" <ceilers-lists@....de>)
(exploit) firefox 1.5.0.6 linux DoS (tomas <toomaaas@...il.com>)
Linux Kernel SCTP Privilege Elevation Vulnerability (Avert@...rtlabs.com)
Symantec Enterprise Security Manager Denial-of-Service Vulnerability (Avert@...rtlabs.com)
Tons of SQL-injections and XSS in Eichhorn Portal and vendor page ("MC Iglo" <mc.iglo@...glemail.com>)
Re: mambo-phphop Product Scroller Module R.F.I ("Carsten Eilers" <ceilers-lists@....de>)
PHlyMail Lite [PM_[path][lib]=] Remote File Include Vulnerability (D3nGeR@...il.CoM)

August 23 (17 messages)

PHProjekt v0.6.1 Remote File Inclusion Vulnerability (2) (D3nGeR@...il.CoM)
BlackBoard Multiple Vulnerabilities (XSS) (Pr070n@...il.com)
Re: discloser 0.0.4 Remote File Inclusion (with Exploit) ("Carsten Eilers" <ceilers-lists@....de>)
Re: anjel Mambo Component Remote File Include ("Carsten Eilers" <ceilers-lists@....de>)
[ MDKSA-2006:147 ] - Updated squirrelmail packages fix vulnerabilities (security@...driva.com)
faille include in "VeriTECH" isreal (king-hacker@...mail.fr)
Symantec Gateway Security DNS exploit ("Gianstefano Monni" <gianstefano@...nu.it>)
Re: BlackBoard Multiple Vulnerabilities (XSS) ("C. Hamby" <fixer@....net>)
Re: BlackBoard Multiple Vulnerabilities (XSS) (pr0t0n@...ted.com)
Cisco Security Advisory: Cisco VPN 3000 Concentrator FTP Management Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Unintentional Password Modification in Cisco Firewall Products (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
AW: Symantec Gateway Security DNS exploit ("Andre Braun" <braun.andre@...il.com>)
RE: Symantec Gateway Security DNS exploit ("Pretorius, Wynand (ZA - Johannesburg)" <wpretorius@...oitte.co.za>)
Bugtraq ID: 18402 ("The Cute Group" <cuties@...cutegroup.com>)
New malware names and updates to PowerPoint FAQ document (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ GLSA 200608-21 ] Heimdal: Multiple local privilege escalation vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200608-22 ] fbida: Arbitrary command execution (Raphael Marichez <falco@...too.org>)

August 24 (16 messages)

FreeBSD Security Advisory FreeBSD-SA-06:18.ppp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Advisory: VistaBB <= 2.x Multiple File Inclusion Vulnerabilities ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Advisory: Integramod Portal <= 2.x File Inclusion Vulnerability ("Mustafa Can Bjorn IPEKCI" <nukedx@...edx.com>)
Re: Modification For OpenSEF Remote file Inclusion ("Carsten Eilers" <ceilers-lists@....de>)
Re: Joomla RFİ ( ERNE ) ("Carsten Eilers" <ceilers-lists@....de>)
Re: Opsware NAS 6.0 reveals MySQL 'root' password (danil9470@...oo.com)
[SECURITY] [DSA 1155-1] New sendmail packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: Directory Traversal vulnerability in IPCheck Monitor Server (support@...ssler.com)
Re: PHProjekt v0.6.1 Remote File Inclusion Vulnerability (2) ("Carsten Eilers" <ceilers-lists@....de>)
Re: PHlyMail Lite [PM_[path][lib]=] Remote File Include Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
Re: Mambo Component - EstateAgent Remote File Inclusion ("Carsten Eilers" <ceilers-lists@....de>)
[ GLSA 200608-23 ] Heartbeat: Denial of Service (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[SECURITY] [DSA 1155-2] New sendmail packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: ToendaCMS <= 1.0.3 -(tcms_administer_site) Remote File Include ("Carsten Eilers" <ceilers-lists@....de>)
EEYE: Internet Explorer Compressed Content URL Heap Overflow Vulnerability ("Marc Maiffret" <mmaiffret@...e.com>)
[ MDKSA-2006:149 ] - Updated MySQL packages fix user privilege vulnerabilities (security@...driva.com)

August 25 (17 messages)

[ MDKSA-2006:148 ] - Updated xorg-x11 packages fix vulnerabilities (security@...driva.com)
Advisory 05/2006: Zend Platform Multiple Remote Vulnerabilities (Stefan Esser <sesser@...dened-php.net>)
pSlash v0.7 (lvc_include_dir) Remote Include Vulnerability (x0r0n@...mail.com)
Re: contentpublisher Mambo Component Remote File Include Vulnerabilities ("Carsten Eilers" <ceilers-lists@....de>)
Re: [eVuln] B-net Software Multiple XSS Vulnerabilities (anon@...n.net)
Multiple Vulnerabilities in Asterisk 1.2.10 (Fixed in 1.2.11) ("Matt Riddell (IT)" <matt.riddell@...eapps.com>)
NSFOCUS SA2006-08 : Microsoft IE6 urlmon.dll Long URL Buffer Overflow Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
rPSA-2006-0158-1 tshark wireshark ("Justin M. Forbes" <jmforbes@...th.com>)
TSLSA-2006-0048 - multi (Trustix Security Advisor <tsl@...stix.org>)
rPSA-2006-0157-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs ("Justin M. Forbes" <jmforbes@...th.com>)
FreeBSD Security Advisory FreeBSD-SA-06:18.ppp [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Indiana University Security Advisory: Fuji Xerox Printing Systems (FXPS) print engine vulnerabilities ("Krulewitch, Sean V" <krulewit@...edu>)
YaPiG thanks_comment.php Cross-Site Scripting Vulnerability (Kuon_at_Armorize_dot_com@...this.domain)
Re: Symantec Gateway Security DNS exploit (axel@...dig.org)
[ MDKSA-2006:150 ] - Updated kernel packages fix multiple vulnerabilities (security@...driva.com)
[ MDKSA-2006:151 ] - Updated kernel packages fix multiple vulnerabilities (security@...driva.com)
CuteNews 1.3.* Remote File Include Vulnerability (stormhacker@...mail.com)

August 26 (12 messages)

[ MDKSA-2006:152 ] - Updated wireshark packages fix multiple vulnerabilities (security@...driva.com)
MyBB Html Injection ( XSS ) (Redworm@...L.Com)
Sql injection in Mambo & Joomla ("Omid" <omid@...kers.ir>)
AlstraSoft Video Share Enterprise Remote File Include Vulnerability (night_warrior-@...mail.com)
Sql injection in Xoops ("Omid" <omid@...kers.ir>)
[ GLSA 200608-24 ] AlsaPlayer: Multiple buffer overflows (Raphael Marichez <falco@...too.org>)
Bigace 1.8.2 (GLOBALS) Remote File Inclusion (vampire_chiristof@...oo.com)
Jupiter CMS 1.1.5 index.php Remote File Include (D3nGeR@...il.CoM)
Jetbox CMS search_function.php Remote File (D3nGeR@...il.CoM)
Suggested Fix for CVE-2006-4299 (Michael Jennings <mej@...nx.org>)
Cisco NAC Appliance Agent Installation Bypass Vulnerability (Andreas Gal <gal@....edu>)
Mambo/Joomla com_comprofiler Components <== v1.0 RC 2 Multiple Remote File Include Vulnerabilities (matdhule@...il.com)

August 28 (12 messages)

Re: Cisco NAC Appliance Agent Installation Bypass Vulnerability (Eloy Paris <elparis@...co.com>)
[SECURITY] [DSA 1156-1] New kdebase packages fix information disclosure (Moritz Muehlenhoff <jmm@...ian.org>)
[XSec-06-10]: Internet Explorer (daxctle.ocx) Heap Overflow Vulnerability (nop <nop@...c.org>)
[SECURITY] [DSA 1159-1] New Mozilla Thunderbird packages fix several problems (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1158-1] New streamripper packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1157-1] New ruby1.8 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200608-25 ] X.org and some X.org libraries: Local privilege escalations (Raphael Marichez <falco@...too.org>)
interact <= 2.2 (CONFIG[BASE_PATH]) Remote File Include Vulnerability (carcabotx@...oo.com)
JetBox cms (search_function.php) Remote File Include (carcabotx@...oo.com)
Re: Another YabbSE Remote Code Execution Vulnerability (wiziwig@...cast.net)
Possible Myspace Worm (mjw@...erwart.com)
Re: Cisco NAC Appliance Agent Installation Bypass Vulnerability (Udo Sprotte <USprotte@....de>)

August 29 (19 messages)

[ GLSA 200608-27 ] Motor: Execution of arbitrary code (Raphael Marichez <falco@...too.org>)
SYMSA-2006-009 (research@...antec.com)
[ GLSA 200608-26 ] Wireshark: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200608-28 ] PHP: Arbitary code execution (Raphael Marichez <falco@...too.org>)
rPSA-2006-0159-1 ImageMagick ("Justin M. Forbes" <jmforbes@...th.com>)
[ MDKSA-2006:155 ] - Updated ImageMagick packages fix vulnerabilities (security@...driva.com)
[ MDKSA-2006:153 ] - Updated binutils packages fix multiple vulnerabilities (security@...driva.com)
[ MDKSA-2006:154 ] - Updated lesstif packages fix potential local root vulnerability (security@...driva.com)
LinksCaffe no checker at admin (hoangyenxinhdep@...oo.com)
CYBSEC - Security Advisory: Microsoft Windows DHCP Client Service Remote Buffer Overflow (Mariano Nuñez Di Croce <mnunez@...sec.com>)
[SECURITY] [DSA 1160-1] New Mozilla packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
AW: JetBox cms (search_function.php) Remote File Include (Frank Reißner <mail@...nk-reissner.de>)
e107 <= 0.75 GLOBALS[] overwrite/Zend_Hash_Del_Key_Or_Index remote commands execution (rgod@...istici.org)
Submit ( b2evolution<= 1.8 Remote File Include Vulnerabilities ) (h4ck3riran@...oo.com)
Submit ( ToendaCMS<= ( Remote File Include Vulnerabilities ) (h4ck3riran@...oo.com)
JS ASP Faq Manager v1.10 sql injection (ali@...kerz.ir)
[SECURITY] [DSA 1161-1] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
DUpoll 3.1 security alert (bozkurtserdar@...kurtserdar.com)
Portail PHP mod_phpalbum 2.15 Modules Remote File Inclusion (x0r0n@...mail.com)

August 30 (17 messages)

Re: Jupiter CMS 1.1.5 index.php Remote File Include ("Carsten Eilers" <ceilers-lists@....de>)
Re: CuteNews 1.3.* Remote File Include Vulnerability ("Carsten Eilers" <ceilers-lists@....de>)
InfoSec Paper: Creating Business Through Virtual Trust ("Kenneth F. Belva" <ken@...security.com>)
Re: Cisco NAC Appliance Agent Installation Bypass Vulnerability (Joe Feise <jfeise@...se.com>)
Re: AW: JetBox cms (search_function.php) Remote File Include ("Steven M. Christey" <coley@...re.org>)
SQL-Ledger serious security vulnerability and workaround (chris@...atrontech.com)
[SECURITY] [DSA 1162-1] New libmusicbrainz packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Ezportal/Ztml v1.0 Multiple vulnerabilities (Hessamx@...samx.net)
IwebNegar v1.1 Multiple vulnerabilities (Hessamx@...samx.net)
Nuked Klan 1.7 SP4.3 : Function Anti-XSS Bypassed (Blwood <blwood@...net.be>)
XSS in HLstats 1.34 ("MC Iglo" <mc.iglo@...glemail.com>)
[KAPDA::#56] - FREEKOT SQL Injection Vulnerability (farhadkey@...oo.com)
[SECURITY] [DSA 1163-1] New gtetrinet packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: JetBox cms (search_function.php) Remote File Include ("Carsten Eilers" <ceilers-lists@....de>)
ezContents Version 2.0.3 Remote/Local File Inclusion, SQL Injection, XSS (gmdarkfig@...il.com)
osCommerce < 2.2 Milestone 2 060817 POC Exploit (s10242006@...oo.com)
[KAPDA]MyBB 1.1.7 ~ admin/global.php ~ XSS Attack (addmimistrator@...il.com)

August 31 (23 messages)

feedsplitter considered harmful (jon@...ck.us)
Hackers to Hackers Conference III - Call for Papers ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
[KAPDA]MyBB 1.1.7~ htmlspeacialchar_uni(), fixjavascript(), functions_post.php ~[url]XSS attack (addmimistrator@...il.com)
[ MDKSA-2006:157 ] - Updated musicbrainz packages fix buffer overflow vulnerabilities (security@...driva.com)
Re: JetBox cms (search_function.php) Remote File Include ("Steven M. Christey" <coley@...us.mitre.org>)
[ECHO_ADV_46$2006] ExBB v1.9.1 (exbb[home_path]) Multiple Remote File Inclusion (erdc@...o.or.id)
[ MDKSA-2006:156 ] - Updated sendmail packages fix DoS vulnerabilities (security@...driva.com)
New NT4/Windows botnet reported (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
XXS in learncenter.asp (exe_crack@...mail.com)
rPSA-2006-0161-1 libmusicbrainz (rPath Update Announcements <announce-noreply@...th.com>)
Lyris ListManager 8.95: Add arbitrary administrator to arbitrary list (Design Properly <designsoftwareproperly@...oo.com>)
Membrepass v1.5 Php code execution, Xss, Sql Injection (gmdarkfig@...il.com)
AW: AW: JetBox cms (search_function.php) Remote File Include (Frank Reißner <mail@...nk-reissner.de>)
[SECURITY] [DSA 1164-1] New sendmail packages fix denial of service (joey@...odrom.org (Martin Schulze))
[ MDKSA-2006:158 ] - Updated MySQL packages fix DoS vuln, initscript bug (security@...driva.com)
Compression Plus and Tumblweed EMF Stack Overflow (Michael Hale Ligh <michael.ligh@...n.org>)
Re: Re: BlackBoard Multiple Vulnerabilities (XSS) (Pr070n@...il.com)
Pheap CMS<= (lpref) Remote File Inclusion Exploit (SHiKaA-@...mail.com)
ModuleBased CMS alfa 1 Multiple Remote File Inclusion (amir.scorpino@...oo.com)
[ISR] - IBM eGatherer ActiveX Code Execution PoC ("Francisco Amato" <famato@...obyte.com.ar>)
rPSA-2006-0162-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
Re: Submit ( b2evolution<= 1.8 Remote File Include Vulnerabilities ) (do@....spam)
Re: ZoneX 1.0.3 - Publishers Gold Edition Remote File Inclusion Vulnerability (maric_sasa@...oo.com)

570 messages

Powered by blists - more mailing lists