bugtraq mailing list - 2006/09

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2006/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 6	² 10	³
⁴ 12	⁵ 22	⁶ 24	⁷ 28	⁸ 27	⁹ 7	¹⁰
¹¹ 32	¹² 23	¹³ 28	¹⁴ 18	¹⁵ 23	¹⁶ 9	¹⁷
¹⁸ 19	¹⁹ 30	²⁰ 13	²¹ 20	²² 23	²³ 1	²⁴
²⁵ 36	²⁶ 30	²⁷ 22	²⁸ 27	²⁹ 17	³⁰ 6

Messages by day:

September 1 (6 messages)

[SECURITY] [DSA 1165-1] New capi4hylafax packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
ISS BlackICE PC Protection Insufficient validation of arguments of NtOpenSection Vulnerability (David Matousek <david@...ousec.com>)
Re: Submit ( ToendaCMS<= ( Remote File Include Vulnerabilities ) ("Carsten Eilers" <ceilers-lists@....de>)
[ MDKSA-2006:159 ] - Updated sudo packages whitelist environments (security@...driva.com)
[ MDKSA-2006:160 ] - Updated xorg-x11/XFree86 packages fix potential vulnerabilities (security@...driva.com)
[Informix] Is Telelogic's Synergy integrated Informix server also vulnerable? ("Sec Anon" <sec_anon@...mail.com>)

September 2 (10 messages)

forum v0.4c (members.dat) MD5 Passwd Hash Disclosure Poc (gmdarkfig@...il.com)
Icblogger <= "YID" Remote Blind SQL Injection (ChironeX.FleckeriX@...il.Com)
Sql injection in SMF [Admin section] ("Omid" <omid@...kers.ir>)
Sql injections in e107 [Admin section] ("Omid" <omid@...kers.ir>)
Re: ModuleBased CMS alfa 1 Multiple Remote File Inclusion ("Carsten Eilers" <ceilers-lists@....de>)
XXS in Powered by vbzoom (exe_crack@...mail.com)
PHP-Revista Multiple vulnerabilities (sirdarckcat@...il.com)
Autentificator <=2.01 SQL Injection Vulnerability (sirdarckcat@...il.com)
ssLinks <=v1.22 Multiple SQL Injection Vulnerabilities (sirdarckcat@...il.com)
Annuaire 1Two 2.2 Remote SQL Injection Exploit (gmdarkfig@...il.com)

September 4 (12 messages)

Tr Forum V2.0 Multiple Vulnerabilities (gmdarkfig@...il.com)
Airscanner Mobile Security Advisory #05081701: IM+ v3.10 Local Password Plaintext Exposure (contact_removethis@...scanner.com)
The Amazing Little Poll Admin Pwd (tugra@...al-root.org)
Re: [ECHO_ADV_45$2006] WEBinsta CMS 0.3.1 (templates_dir) Remote File Inclusion Vulnerability (atomo64@...il.com)
[SECURITY] [DSA 1166-1] New cheesetraceker packages fix buffer overflow (Steve Kemp <skx@...ian.org>)
Web Dictate Admin Null Password Vulnerability (revnic@...il.com)
Airscanner Mobile Security Advisory #05081201: PDAapps Verichat v1.30bh Local Password Disclosure (contact_removethis@...mvethis_airscanner.com)
SoftBB 0.1 Remote PHP Code Execution Exploit (gmdarkfig@...il.com)
[SECURITY] [DSA 1167-1] New apache packages fix several vulnerabilities (Steve Kemp <skx@...ian.org>)
AnywhereUSB/5 1.80.00 Drivers Integer Overflow (SecuriTeam Assisted Disclosure <STAD@...uriteam.com>)
Re: TinyWebGallery v1.5 ( image ) Remote Include Vulnerability (tinywebgallery@...mpfle.de)
CFP, IT Underground, Warsaw, Poland 2006 (Piotr Sobolewski <piotr.sobolewski@...nderground.org>)

September 5 (22 messages)

SoftBB v0.1 < = Cross-Site Scripting (the.leo.008@...il.com)
[USN-338-1] MySQL vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
TTG0602 - Alt-N WebAdmin MDaemon Account Hijacking ("TTG" <releases@...low.com>)
[SECURITY] [DSA 1168-1] New imagemagick packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Microsoft Word 0-day Vulnerability (September) FAQ document available (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[USN-339-1] OpenSSL vulnerability (Martin Pitt <martin.pitt@...onical.com>)
HITBSecConf2006 Final Call ! (Praburaajan <prabu@...kinthebox.org>)
[SECURITY] [DSA 1169-1] New MySQL 4.1 packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[Kurdish Security # 25 ] GrapAgenda Remote Command Vulnerability (botan@...uxmail.org)
SolpotCrew Advisory #7 - AlstraSoft Template Seller Remote File Include Vulnerability (jong_amq@...mail.com)
MyBace Light (hauptverzeichniss) Remote File Inclusion (philipp.niedziela@....de)
VirtualPC 2004 (build 528) detection (?) (gynvael@...illium.org)
Re: CuteNews 1.3.* Remote File Include Vulnerability (satalin <satalin@...il.com>)
Buffer overflow vulnerability in dsocks (Michael Adams <parasite@....lonestar.org>)
2nd European Conference on Computer Network Defense (EC2ND) ("Blyth A J C (AT)" <ajcblyth@...m.ac.uk>)
Anti-vir vulnerability (rugginello@...il.com)
ZIXForum 1.12 <= "RepId" Remote SQL Injection (ChironeX.FleckeriX@...il.Com)
[Kurdish Security # 26 ] AnnonceV News Script Remote Command Vulnerability (botan@...uxmail.org)
[security bulletin] HPSBUX02145 SSRT061202 rev.1 - HP-UX running Apache Remote Execution of Arbitrary Code, Denial of Service (DoS), and U… (security-alert@...com)
AuditWizard 6.3.2 gives away administrator password (Terry Donaldson <tdx14145@...oo.com>)
Re: VirtualPC 2004 (build 528) detection (?) (gynvael@...illium.org)
UPDATE: [ GLSA 200509-09 ] Py2Play: Remote execution of arbitrary Python code (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

September 6 (24 messages)

FlashChat <= 4.5.7 Remote File Include Vulnerability (mc.nadz@...il.com)
rPSA-2006-0163-1 openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
in-link <=2.3.4 (adodb-postgres7.inc.php) Remote File Inclusion Exploit (saudi.unix@...mail.com)
Dyn CMS <= REleased (x_admindir) Remote File Inclusion Exploit (SHiKaA-@...mail.com)
Anti-vir2 (rugginello@...il.com)
Easy Address Book Web Server Format String Vulnerability (revnic@...il.com)
php download local file include (ali@...kerz.ir)
Re: Microsoft Word 0-day Vulnerability (September) FAQ document available (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Details for BID 18428 (shulman@...erva.com)
[OpenPKG-SA-2006.018] OpenPKG Security Advisory (openssl) (OpenPKG <openpkg@...npkg.org>)
Details for BID 19586 (shulman@...erva.com)
[USN-340-1] imagemagick vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Reminder: 3rd Annual US OWASP AppSec Conference - Oct 16-18 2006 - Seattle, WA ("Dave Wichers" <dave.wichers@...ectsecurity.com>)
release uhooker v1.2 (Hernan Ochoa <lists@...e-sdi.com>)
Cisco IOS GRE issue (FX <fx@...noelit.de>)
[security bulletin] HPSBUX02102 SSRT051078 rev.4 - HP-UX usermod(1M) Local Unauthorized Access. (security-alert@...com)
[ GLSA 200609-04 ] LibXfont: Multiple integer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200609-03 ] OpenTTD: Remote Denial of Service (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[SECURITY] [DSA 1170-1] New fastjar packages fix directory traversal (joey@...odrom.org (Martin Schulze))
Canon ImageRunner reveals SMB, IPX, and FTP username/passwords (gunrnr@...thlink.net)
[ GLSA 200609-01 ] Streamripper: Multiple remote buffer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Sql Injection and Path Disclosoure Wordpress v2.0.5 (vannovax@...il.com)
IBM Lotus Notes DUNZIP32.dll Buffer Overflow Vulnerability (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ GLSA 200609-02 ] GTetrinet: Remote code execution (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

September 7 (28 messages)

Microsoft confirmed Word 0-day vulnerability (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
WDT :-phpopenchat-3.0.* ($sourcedir) Remote File Inclusion Exploit (stormhacker@...mail.com)
FreeBSD Security Advisory FreeBSD-SA-06:19.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[ MDKSA-2006:161 ] - Updated openssl packages fix vulnerability (security@...driva.com)
[OpenPKG-SA-2006.019] OpenPKG Security Advisory (bind) (OpenPKG <openpkg@...npkg.org>)
[USN-341-1] libxfont vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-342-1] PHP vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
SECURITY.NNOV: Panda Platinum Internet Security privilege escalation / bayesian filter control security vulnerabilities (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: ZoneX 1.0.3 - Publishers Gold Edition Remote File Inclusion Vulnerability ("Steven M. Christey" <coley@...re.org>)
PHPFusion <= 6.01.4 extract()/_SERVER[REMOTE_ADDR] sql injection exploit (rgod@...istici.org)
Re: Sql Injection and Path Disclosoure Wordpress v2.0.5 ("Paul Robertson" <compuwar@...il.com>)
Host header cannot be trusted as an anti anti DNS-pinning measure ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
Re: ZoneX 1.0.3 - Publishers Gold Edition Remote File Inclusion Vulnerability (str0ke <str0ke@...w0rm.com>)
[ GLSA 200609-05 ] OpenSSL, AMD64 x86 emulation base libraries: RSA signature forgery (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ MDKSA-2006:162 ] - Updated php packages fix vulnerabilities (security@...driva.com)
Re: PasswordSafe 3.0 weak random number generator allows key recovery attack (ronys@...rs.sourceforge.net)
CORE-2006-0321: AOL ICQ Pro 2003b heap overflow vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
BinGoPHP News <= 3.01 [bnrep] Remote File Include Vulnerability (ciriboflacs@...oo.com)
CORE-2006-0322: Multiple vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer (CORE Security Technologies Advisories <advisories@...esecurity.com>)
xxs in MKPortal M1.1 (exe_crack@...mail.com)
DokuWiki <= 2006-03-09brel /bin/dwpage.php remote commands execution (rgod@...istici.org)
Shadow Prmod <= 2.7.1 [phpbb_root_path] Remote File Include Vulnerability (ciriboflacs@...oo.com)
SL_Site <= 1.0 [spaw_root] Remote File Include Vulnerability (ciriboflacs@...oo.com)
Full Disclosure for SQL-Ledger vulnerability CVE-2006-4244 (Chris Travers <chris@...atrontech.com>)
ZDI-06-028: Ipswitch Collaboration Suite SMTP Server Stack Overflow (zdi-disclosures@...m.com)
Re: WDT :-phpopenchat-3.0.* ($sourcedir) Remote File Inclusion Exploit ("Carsten Eilers" <ceilers-lists@....de>)
Re: [Full-disclosure] Linux kernel source archive vulnerable (Raj Mathur <raju@...ux-delhi.org>)
Sql injection in RunCMS ("Omid" <omid@...kers.ir>)

September 8 (27 messages)

WM-News v0.5 - Remote File Include Vulnerabilities (erne@...ealizm.com)
Re: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords (Doug Atkins <d.atkins1@...il.com>)
NDSS CFP Due September 10th (Crispin Cowan <crispin@...ell.com>)
XSS in AckerTodo v4.0 (viz.security@...il.com)
Linux kernel source archive vulnerable (hadmut@...isch.de (Hadmut Danisch))
FreeBSD Security Advisory FreeBSD-SA-06:20.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Sql injection in BLOG:CMS ("Omid" <omid@...kers.ir>)
Re: [Full-disclosure] Linux kernel source archive vulnerable (hadmut@...isch.de (Hadmut Danisch))
[SECURITY] [DSA 1171-1] New ethereal packages fix execution of arbitrary code (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Microsoft confirmed Word 0-day vulnerability ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
Black Hat Briefings Japan Speakers Selected! (Jeff Moss <jmoss@...ckhat.com>)
ACGV News v0.9.1 - Remote File Include Vulnerabilities (erne@...ealizm.com)
News Evolution v3.0.3 - Remote File Include Vulnerabilities (erne@...ealizm.com)
[USN-343-1] bind9 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[RISE-2006001] X11R6 XKEYBOARD extension Strcmp() buffer overflow (advisories@...esecurity.org)
AW: WDT :-phpopenchat-3.0.* ($sourcedir) Remote File Inclusion Exploit (Frank Reißner <mail@...nk-reissner.de>)
PhotoKorn Gallery => 1.52 (dir_path) Remote File Inclusion Exploit (saudi.unix@...mail.com)
rPSA-2006-0165-1 mailman (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2006-0166-1 bind bind-utils (rPath Update Announcements <announce-noreply@...th.com>)
client side vulnerability in yahoo mail (p3rlhax@...il.com)
Timesheet 1.2.1 Blind SQL Injection Vulnerability (secaware2006@...oo.com)
Akarru rfi (erne@...ealizm.com)
mcNews v1.3 - Remote File Include (erne@...ealizm.com)
Airscanner Mobile Security Advisory #06260602: Pocket Expense Pro 3.9.1 Authentication Bypass (removethis_contact@...movethis_airscanner.com)
Airscanner Mobile Security Advisory #06070101: Abidia & OAnywhere (All versions) (removethis_contact@...scanner_removethis.com)
Re: Re: Sql Injection and Path Disclosoure Wordpress v2.0.5 (vanovax@...il.com)
RSA SecurID SID800 Token vulnerable by design (hadmut@...isch.de (Hadmut Danisch))

September 9 (7 messages)

[ MDKSA-2006:163 ] - Updated bind packages fix DoS vulnerabilities (security@...driva.com)
Re: RSA SecurID SID800 Token vulnerable by design (3APA3A <3APA3A@...URITY.NNOV.RU>)
Multible injections and vulnerabilities in Jetbox CMS (security@...or.net)
PHP 5.1.6 / 4.4.4 Critical php_admin* bypass by ini_restore() (cxib@...urityreason.com)
Cross Context Scripting with Sage ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [Full-disclosure] Re: RSA SecurID SID800 Token vulnerable by design ("Brian Eaton" <eaton.lists@...il.com>)
[SECURITY] [DSA 1172-1] New bind9 packages fix denial of service (joey@...odrom.org (Martin Schulze))

September 11 (32 messages)

Re: PHP 5.1.6 / 4.4.4 Critical php_admin* bypass by ini_restore() (İsmail Dönmez <ismail@...dus.org.tr>)
Re: RSA SecurID SID800 Token vulnerable by design ("Bojan Zdrnja" <bojan.zdrnja@...il.com>)
SimpleBoard Mambo Component 1.1.0 Remote File Include (stormhacker@...mail.com)
ConSec Symposium - Sept 20-22 in Austin, TX ("Michael Allgeier" <Michael.Allgeier@...a.org>)
Re: Re: Sql Injection and Path Disclosoure Wordpress v2.0.5 ("Paul Robertson" <compuwar@...il.com>)
[SECURITY] [DSA 1159-2] New Mozilla Thunderbird packages fix several problems (joey@...odrom.org (Martin Schulze))
Web Server Creator v0.1 (l) Remote Include Vulnerability (x0r0n@...mail.com)
Re: [Full-disclosure] Linux kernel source archive vulnerable (Christine Kronberg <seeker@...lla.de>)
Re: RSA SecurID SID800 Token vulnerable by design ("Bojan Zdrnja" <bojan.zdrnja@...il.com>)
Re: WDT :-phpopenchat-3.0.* ($sourcedir) Remote File Inclusion Exploit ("Carsten Eilers" <ceilers-lists@....de>)
Re[3]: RSA SecurID SID800 Token vulnerable by design (3APA3A <3APA3A@...URITY.NNOV.RU>)
R: Linux kernel source archive vulnerable ("Perego Paolo Franco" <p.perego@...ly.it>)
Vikingboard 0.1b Multiple Vulnerabilities (no-replay@...samx.net)
XHP CMS v0.5.1 Vuls Xss and Full path vuls (security@...or.net)
Re: Linux kernel source archive vulnerable ("Gerald (Jerry) Carter" <jerry@...ba.org>)
Re[2]: RSA SecurID SID800 Token vulnerable by design (3APA3A <3APA3A@...URITY.NNOV.RU>)
[SECURITY] [DSA 1174-1] New openssl096 packages fix RSA signature forgery cryptographic weakness (Moritz Muehlenhoff <jmm@...ian.org>)
MagpieRSS (a simple RSS integration tool) Full path vul (security@...or.net)
PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities (l0x3@...mail.com)
PUMA 1.0 RC 2 (config.php) Remote File Inclusion (philipp.niedziela@....de)
Open Bulletin Board <= 1.0.8 (root_path) File Include Vulnerability (l0x3@...mail.com)
text ads xss attack (ali@...kerz.ir)
PayProCart <= 1146078425 Multiple Remote File Include Vulnerabilities (l0x3@...mail.com)
HotPlug CMS Config File Include Vulnerability (security@...or.net)
Re: [Full-disclosure] Re: RSA SecurID SID800 Token vulnerable by design ("Brian Eaton" <eaton.lists@...il.com>)
PhpLinkExchange v1.0 RFI + RC + Xss [RC-exploit] (ali@...kerz.ir)
[SECURITY] [DSA 1173-1] New openssl packages fix RSA signature forgery cryptographic weakness (Moritz Muehlenhoff <jmm@...ian.org>)
SIPS v 0.2.2 < = Remote File Include Vulnerability (the.leo.008@...il.com)
Microsoft visual basic 6. overflow (mallahzadeh@...il.com)
C-News v 1.0.1 < = Multiple Remote File Include Vulnerabilities (the.leo.008@...il.com)
SolpotCrew Advisory #8 - Mcgallerypro (path_to_folder) Remote File Inclusion (chris_hasibuan@...oo.com)
ShAnKaR: multiple PHP application poison NULL byte vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)

September 12 (23 messages)

CMS.R. the Content Management System admin authentication baypass (security@...or.net)
RE: [Full-disclosure] Re: RSA SecurID SID800 Token vulnerable by design ("Lyal Collins" <lyal.collins@...2it.com.au>)
Re[5]: RSA SecurID SID800 Token vulnerable by design (3APA3A <3APA3A@...URITY.NNOV.RU>)
Sql injection in Tikiwiki ("Omid" <omid@...kers.ir>)
Re: Re[3]: RSA SecurID SID800 Token vulnerable by design ("Brian Eaton" <eaton.lists@...il.com>)
WTools v0.0.1-ALPH - Remote File Include Vulnerabilities (erne@...ealizm.com)
rPSA-2006-0167-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (rPath Update Announcements <announce-noreply@...th.com>)
AzzCoder => phpBB XS 0.58 Remote File Include (azzcoder@...mail.com)
LedgerSMB 1.0.0 and SQL-Ledger 2.6.18 and earler arbitrary code execution (Chris Travers <chris@...atrontech.com>)
Newsscript version 0.5 (print.php) Local File Inclusion Vulnerability (daftrix@...il.com)
NETGEAR Rotuer DG834GT Firmware V1.01.28 (DoS) (nullflag@...il.com)
Re: ShAnKaR: multiple PHP application poison NULL byte vulnerability (Jerome Athias <jerome.athias@...e.fr>)
Session Token Remains Valid After Logout in IBM Lotus Domino Web Access (dave.ferguson@...hnetsecurity.com)
ERRATA: [ GLSA 200609-05 ] OpenSSL, AMD64 x86 emulation base libraries: RSA signature forgery (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Apple QuickTime Player H.264 Codec Remote Integer Overflow (Piotr Bania <bania.piotr@...il.com>)
Computer Terrorism (UK) :: Incident Response Centre - Microsoft Publisher Font Parsing Vulnerability (irc@...puterterrorism.com)
Computer Terrorism (UK) :: Incident Response Centre - Adobe/Macromedia Flash Player Vulnerability (irc@...puterterrorism.com)
[USN-344-1] X.org vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Apple QuickTime H.264 Integer Overflow Vulnerability (Sowhat <smaillist@...il.com>)
iDefense Security Advisory 09.12.06: Apple QuickTime FLIC File Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 09.12.06: Multiple Vendor X Server CID-keyed Fonts 'scan_cidfont()' Integer Overflow Vulnera… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 09.12.06: Multiple Vendor X Server CID-keyed Fonts 'CIDAFM()' Integer Overflow (iDefense Labs <labs-no-reply@...fense.com>)
[EEYEB-20080824] Internet Explorer Compressed Content URL Heap Overflow Vulnerability #2 ("eEye Advisories" <Advisories@...e.com>)

September 13 (28 messages)

[SECURITY] [DSA 1175-1] New isakmpd packages fix replay protection bypass (joey@...odrom.org (Martin Schulze))
# ForumJBC v4 < = Cross-Site Scripting - XSS Exploit ; (x17@...mail.fr)
PHP Event Calendar Multiple Parameter Cross Site Scripting Vulnerability ("OS2A BTO" <os2a.bto@...il.com>)
Re: PHP 5.1.6 / 4.4.4 Critical php_admin* bypass by ini_restore() ("Ryan Buena" <dreamsbig@...il.com>)
NetPerformer FRAD ACT Multiple Vulnerabilities (arif.jatmoko@....ccamatil.com)
Re: PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities ("Carsten Eilers" <ceilers-lists@....de>)
[USN-345-1] mailman vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 1161-2] New Mozilla Firefox packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[ GLSA 200609-07 ] LibXfont, monolithic X.org: Multiple integer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[security bulletin] HPSBUX02151 SSRT051021 rev.1 - HP-UX Running ARPA Transport Software, Local Denial of Service (DoS) (security-alert@...com)
Cisco IOS VTP issues (FX <fx@...noelit.de>)
[0day] daxctle2.c - Internet Explorer COM Object Heap Overflow Download Exec Exploit (nop <nop@...c.org>)
Multiple Vulnerabilities in Apple QuickTime (avert@...rtlabs.com)
Snitz Forums 2000 v3.4.06 (ajannhwt@...mail.com)
[security bulletin] HPSBMA02149 SSRT050968 rev.1 - HP OpenView Operations, Remote Unauthorized Access and Denial of Service (DoS) (security-alert@...com)
[eVuln] Doika guestbook 'page' XSS Vulnerability (Alex <alex@...ln.com>)
Re: SECURITY.NNOV: Panda Platinum Internet Security privilege escalation / bayesian filter control security vulnerabilities (lolfischer@...il.com)
[eVuln] indexcity SQL Injection and XSS Vulnerabilities (Alex <alex@...ln.com>)
[eVuln] Links Manager Multiple XSS and SQL Injection Vulnerabilities (Alex <alex@...ln.com>)
[eVuln] CJ Tag Board XSS Vulnerability (Alex <alex@...ln.com>)
[eVuln] NX5Linkx Multiple Vulnerabilities (Alex <alex@...ln.com>)
[ GLSA 200609-09 ] FFmpeg: Buffer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
TualBLOG v 1.0 multiple sql injection (dj_remix_20@...mail.com)
[ GLSA 200609-08 ] xine-lib: Buffer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
PAKCON III: Announce (2006) (Ayaz Ahmed Khan <ayaz@...con.org>)
PAKCON III: Call for Papers (CfP 2006) (Ayaz Ahmed Khan <ayaz@...con.org>)
Re: Cisco IOS VTP issues (psirt@...co.com)
[SECURITY] [DSA 1176-1] New zope2.7 packages fix information disclosure (Moritz Muehlenhoff <jmm@...ian.org>)

September 14 (18 messages)

Mailman 2.1.8 Multiple Security Issues (Moritz Naumann <security@...itz-naumann.com>)
[ MDKSA-2006:164 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities (security@...driva.com)
ToorCon Pre-Registration Closing Friday! ("h1kari@...rcon.org" <h1kari@...rcon.org>)
ADOdb Date Library Full path Bugs (security@...or.net)
DCP-Portal SE 6.0 multiple injections (security@...or.net)
[ GLSA 200609-10 ] DokuWiki: Arbitrary command execution (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
XSS vulnerability in Blojsom (p3rlhax@...il.com)
Secunia Research: Tagger LE PHP "eval()" Injection Vulnerabilities (Secunia Research <vuln-remove@...unia.com>)
[USN-346-2] Fixed linux-restricted-modules-2.6.15 for previous Linux kernel update (Martin Pitt <martin.pitt@...onical.com>)
Magic News Pro => 1.0.3 (script_path) Remote File Inclusion Exploit (saudi.unix@...mail.com)
Re: PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities ("Carsten Eilers" <ceilers-lists@....de>)
SIP over TLS: X.509 peer authentication vulnerability in Ingate products (Per Cederqvist <ceder@...ate.com>)
Fullpath disclosure in Blue Magic Board 5.5 (hack2prison@...oo.com)
SolpotCrew Advisory #9 - phpQuiz v0.01 design and coding byJule Slootbeek (pagename) Remote File Inclusion (chris_hasibuan@...oo.com)
Layered Defense Advisory :Symantec AntiVirus Corporate Edition Format String Vulnerability (dh@...ereddefense.com)
[security bulletin] HPSBUX02126 SSRT051019 rev.1 - HP-UX running X.25 Local Denial of Service (Dos) (security-alert@...com)
Re: Snitz Forums 2000 v3.4.06 (bob@...il.com)
PhotoPost =>4.6 (PP_PATH) Remote File Inclusion Exploit (saudi.unix@...mail.com)

September 15 (23 messages)

Fwd: IE ActiveX 0day? ("Tyop Tyip" <tyoptyop@...il.com>)
PhotoPost => 4.6 (PP_PATH) Remote File Inclusion Exploit (Saudi.unix@...mail.com)
[SECURITY] [DSA 1160-2] New Mozilla packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1177-1] New usermin packages fix denial of service (joey@...odrom.org (Martin Schulze))
ClickBlog! <= v2.0 (default.asp) Admin ByPASS SQL Injection (ajannhwt@...mail.com)
Hackers to Hackers Conference III - Call for Papers ("Rodrigo Rubira Branco (BSDaemon)" <rodrigo@...nelhacking.com>)
mcLinksCounter v1.1 - Remote File Include Vulnerabilities (erne@...ealizm.com)
Complain Center v1(loginprocess.asp) Admin ByPASS SQL Injection (ajannhwt@...mail.com)
RE: IE ActiveX 0day? ("Hayes, Bill" <Bill.Hayes@....com>)
Jupiter CMS Multiple injections (security@...or.net)
Re: Fwd: IE ActiveX 0day? (H D Moore <sflist@...italoffense.net>)
Signkorn Guestbook <= v1.3 Multiple Remote File Include Vulnerabilities (x17@...mail.fr)
Re: PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities ("eddy BAck0o" <eddy_back0o@...mail.com>)
Re: PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities ("Steven M. Christey" <coley@...re.org>)
MyBB Full path and Cross site scripting vulnerabilities (security@...or.net)
ppalCart V(2.5 EE) Remote File Inclusion (l0x3@...mail.com)
SolpotCrew Advisory #11 - ReviewPost 2.5 (RP_PATH) Remote File Inclusion (bius@....com)
SolpotCrew Advisory #10 - phpBB XS (phpbb_root_path) Remote File Include (jong_amq@...mail.com)
Mambo com_serverstat Component <=0.4.4 Remote File Include Vulnerability (x0r0n@...mail.com)
@System Security Meeting in Pisa (Giorgio Zoppi <zoppi@....di.unipi.it>)
Google Search API Worms ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Symantec Norton Insufficient validation of 'SymEvent' driver input buffer (David Matousek <david@...ousec.com>)
phpQuiz sensitive file (install.php) (sn_0py@...mail.com)

September 16 (9 messages)

BolinOS v.4.5.5 <= (gBRootPath) Remote File Include Vulnerability (x0r0n@...mail.com)
[Reversemode Advisory] Apple Quicktime FLIC File Heap Overflow (Reversemode <advisories@...ersemode.com>)
Roller Weblogger XSS vulnerability (p3rlhax@...il.com)
Limbo - Lite Mambo CMS Multiple Vulnerabilities (security@...or.net)
rPSA-2006-0169-1 firefox thunderbird (rPath Update Announcements <announce-noreply@...th.com>)
easypage.org >> v7 sql injection (ali@...kerz.ir)
Re: RSA SecurID SID800 Token vulnerable by design (vin@...world.com)
Re: Fwd: IE ActiveX 0day? (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ GLSA 200609-11 ] BIND: Denial of Service (Raphael Marichez <falco@...too.org>)

September 18 (19 messages)

McAfee VirusScan Enterprise - disabling the client side "On-Access Scan" ("EitanCaspi@...oo.com" <eitancaspi@...oo.com>)
BizDirectory all version xss (ali@...kerz.ir)
PhotoPost PHP 4.6 - 4.5 [PP_PATH] >> Remote File Include Vulnerability ("AG- Spider" <ag-spider@....com>)
MyBB 1.2 Full path and Cross site scripting vulnerabilities (security@...or.net)
[USN-348-1] GnuTLS vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Busy box httpd file traversal vulenrability (bug-finder@...mail.com)
Sql injection in Moodle ("Omid" <omid@...kers.ir>)
EShoppingPro v1.0(search_run.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Q-Shop v3.5(browse.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Re: mcLinksCounter v1.1 - Remote File Include Vulnerabilities ("Carsten Eilers" <ceilers-lists@....de>)
USB Attacks Going Commercial? (Gadi Evron <ge@...uxbox.org>)
Charon Cart v3(Review.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Re: IE ActiveX 0day? (Alexander Sotirov <asotirov@...ermina.com>)
AzzCoder => PNphpBB (Latest) Remote File Include (azzcoder@...mail.com)
Techno Dreams FAQ Manager Package v1.0(faqview.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
Symantec Security Advisory: Symantec AntiVirus Corporate Edition (secure@...antec.com)
Techno Dreams Articles&Papers Package <=v2.0(ArticlesTableview.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
HitWeb v3.0 - Remote File Include Vulnerabilities (erne@...ealizm.com)
NixieAffiliate all version bypass admin and xss (ali@...kerz.ir)

September 19 (30 messages)

PHPQuiz Multiple Remote Vulnerabilites (simo64@...x.org)
PHP-Post Multiple Input Validation Vulnerabilities (security@...or.net)
Plume CMS <= 1.1.10 [prepend.php] Remote File Include Vulnerability (D3nGeR@...il.CoM)
HP-UX X.25 Denial of Service Vulnerability (oktayonur@...erposta.com)
ECardPro v2.0(search.asp) Remote SQL Injection Vulnerability (ajannhwt@...mail.com)
[SECURITY] [DSA 1178-1] New freetype packages fix execution of arbitrary code (Moritz Muehlenhoff <jmm@...ian.org>)
[Kurdish Security # 27] Artmedic Links Script Remote File Include Vulnerability (botan@...uxmail.org)
FreeBSD Security Advisory FreeBSD-SA-06:21.gzip (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: Plume CMS <= 1.1.10 [prepend.php] Remote File Include Vulnerability (Craig Morrison <craig@...hpalace.org>)
[SECURITY] [DSA 1179-1] New alsaplayer packages fix denial of service (joey@...odrom.org (Martin Schulze))
[ MDKSA-2006:165 ] - Updated mailman packages fix multiple vulnerabilities (security@...driva.com)
New PowerPoint 0-day Trojan in the wild (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[USN-349-1] gzip vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
eSyndiCat Portal System XSS Vuln. (meto5757@...mail.com)
Apple Remote Desktop root vulneravility (fribitch@...anic.com)
Yet another 0day for IE (Gadi Evron <ge@...uxbox.org>)
[ GLSA 200609-12 ] Mailman: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[RLSA_02-2006] OSU httpd for OpenVMS path and directory disclosure - is this a bug or a feature? (rfdslabs@...slabs.com.br)
Site@...ool 2.4.02 and below Multiple remote Command Execution Vulnerabilities (simo64@...x.org)
NextAge Cart Cross-Site Scripting multiple Vulnerabilities (meto5757@...mail.com)
[ECHO_ADV_47$2006] WAP Y! Messenger Cross-Site Scripting Vulnerability (erdc@...o.or.id)
PT News 1.7.8 (Search.php) XSS Vulnerability (Snake.Apollyon@...oo.com)
Pie Cart Pro => (Home_Path) Remote File Inclusion Exploit (saudi.unix@...mail.com)
White paper release: Bypassing network access control (NAC) systems (Ofir Arkin <ofir@...-security.com>)
Re: ShAnKaR: multiple PHP application poison NULL byte vulnerability (idontthinkso@...mple.com)
Innovate Portal v2.0 Index.PHP Xss Vuln. (meto5757@...mail.com)
[SECURITY] [DSA 1180-1] New bomberclone packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Microsoft PowerPoint 0-day Vulnerability FAQ - September written (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
rPSA-2006-0170-1 gzip (rPath Update Announcements <announce-noreply@...th.com>)
Re: Apple Remote Desktop root vulneravility (Erik Lat <erik.lat@...tech.com>)

September 20 (13 messages)

Camino release 1.0.3 fixes several vulnerabilities (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[OpenPKG-SA-2006.020] OpenPKG Security Advisory (gzip) (OpenPKG <openpkg@...npkg.org>)
Re: SimpleBoard Mambo Component 1.1.0 Remote File Include (Häussler, Christian <Christian.Haeussler@...-coburg.de>)
Cisco Security Advisory: Cisco Guard enables Cross Site Scripting (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Intrusion Prevention System Management Interface Denial of Service and Fragmented Packet… (Cisco Systems Product Security Incident…)
PowerPoint issue fixed in MS06-012/CVE2006-009 (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Cisco Security Advisory: DOCSIS Read-Write Community String Enabled in Non-DOCSIS Platforms (Cisco Systems Product Security Incident Response Team <psirt@...co.…)
Re: Apple Remote Desktop root vulneravility (Yannick von Arx <yanux@...ux.ch>)
vml.c - Internet Explorer VML Buffer Overflow Download Exec Exploit (nop <nop@...c.org>)
mysql_error() can lead to Cross Site Scripting attacks (gmdarkfig@...il.com)
Dr.Web 4.33 antivirus LHA long directory name heap overflow (Jean-Sébastien Guay-Leroux <jean-sebastien@...y-leroux.com>)
RE: vml.c - Internet Explorer VML Buffer Overflow Download Exec Exploit ("Aras \"Russ\" Memisyazici" <arasm@...edu>)
Internet Explorer VML Zero-Day Mitigation (Matthew Murphy <mattmurphy@...rr.com>)

September 21 (20 messages)

[USN-350-1] Thunderbird vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[scip_Advisory 2555] Sun Secure Global Desktop prior 4.3 multiple remote vulnerabilities (Marc Ruef <maru@...p.ch>)
Re: HitWeb v3.0 - Remote File Include Vulnerabilities ("Carsten Eilers" <ceilers-lists@....de>)
Re: AzzCoder => PNphpBB (Latest) Remote File Include ("Carsten Eilers" <ceilers-lists@....de>)
[ MDKSA-2006:166 ] - Updated gnutls packages fixes PKCS signature verification issue. (security@...driva.com)
[ MDKSA-2006:167 ] - Updated gzip packages fix multiple vulnerabilities (security@...driva.com)
Re: CounterPath eyeBeam Handing SIP header Vulnerabilities (support@...nterpath.com)
[ MDKSA-2006:168 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
Wili-CMS Multiple Input Validation Vulnerabilities (security@...or.net)
Grayscale BandSite CMS Multiple Input Validation Vulnerabilities (security@...or.net)
Re: mysql_error() can lead to Cross Site Scripting attacks (Christian Hammers <ch@...tend.com>)
Re: AzzCoder => PNphpBB (Latest) Remote File Include ("Carsten Eilers" <ceilers-lists@....de>)
Re: mysql_error() can lead to Cross Site Scripting attacks (mark <mark@...nox.nl>)
Re: AzzCoder => PNphpBB (Latest) Remote File Include ("Carsten Eilers" <ceilers-lists@....de>)
Re: AzzCoder => PNphpBB (Latest) Remote File Include (str0ke <str0ke@...w0rm.com>)
[CAID 34616, 34617, 34618]: CA eSCC and eTrust Audit vulnerabilities ("Williams, James K" <James.Williams@...com>)
[security bulletin] HPSBST02134 SSRT061187 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS06-052, MS06-053 an… (security-alert@...com)
FW: APPLE-SA-2006-09-21 AirPort Update 2006-001 and Security Update 2006-005 (dm@...urityfocus.com)
[security bulletin] HPSBUX02153 SSRT061181 rev.1 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial … (security-alert@...com)
[security bulletin] HPSBUX02156 SSRT061236 rev.1 - HP-UX Running Thunderbird, Remote Unauthorized Access or Elevation of Privileges or Den… (security-alert@...com)

September 22 (23 messages)

[USN-351-1] firefox vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 1182-1] New gnutls11 packages fix RSA signature forgery cryptographic weakness (Moritz Muehlenhoff <jmm@...ian.org>)
TSLSA-2006-0052 - multi (Trustix Security Advisor <tsl@...stix.org>)
E-Vision CMS Multible Remote injections (security@...or.net)
Eskolar CMS Remote Sql Injection (security@...or.net)
RE: Computer Associates eTrust Security Command Center Multiple Vulnerabilities ("Patrick Webster" <patrick@...hack.com>)
ContentKeeper Authenticated Access Password Disclosure ("Patrick Webster" <patrick@...hack.com>)
Squiz MySource Matrix Unauthorised Proxy and Cross Site Scripting ("Patrick Webster" <patrick@...hack.com>)
Google Mini Search Applicance Path Disclosure ("Patrick Webster" <patrick@...hack.com>)
Self-contained XSS Attacks (the new generation of XSS) ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
[PLESK 7.5 Reload] & [PLESK 7.6 for MS Windows] path passing and disclosure vulnerability (guanyu_vn@...oo.com)
More Vulnerable ATM Models (Steve <root@...cksilverscreen.com>)
jevoncms (.inc) Path Disclosure (CvIr.System@...il.com)
Woltlab Burning Board 2.3.X SQL Injection Vulnerability (sn4k3.23@...il.com)
[Call for Papers] DIMVA 2007 (Robin Sommer <info@...va.org>)
Call for Papers and Tutorials for the 19th Annual FIRST Conference, June 17– 22, 2007 (Ian Cook <ian.cook@...il.com>)
Re: Re: mysql_error() can lead to Cross Site Scripting attacks (gmdarkfig@...il.com)
Re: mysql_error() can lead to Cross Site Scripting attacks (Ben Wheeler <b.wheeler@...c.ac.uk>)
SolpotCrew Advisory #12 - phpQuestionnaire 3.12 (GLOBALS[phpQRootDir]) Remote File Inclusion (chris_hasibuan@...oo.com)
RSA Keyon Log verification bypass vulnerability (Andrei Mikhailovsky <mlists@...ont.com>)
Re: vml.c - Internet Explorer VML Buffer Overflow Download Exec Exploit ("Ben Hall" <ben2004uk@...glemail.com>)
Backdooring MP3 files (plus QuickTime issues and Cross-context Scripting) ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: Apple Remote Desktop root vulneravility (Mike Kuriger <m@...com>)

September 23 (1 message)

"Buffer overflow" term considered overloaded ("Steven M. Christey" <coley@...re.org>)

September 25 (36 messages)

Re: "Buffer overflow" term considered overloaded ("Dave \"No, not that one\" Korn" <davek_throwaway@...mail.com>)
Re: [Full-disclosure] Yet another 0day for IE (Disabling Javascript no longer a fix) (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Jamroom Media Content Management System Login.php Xss Vuln. (meto5757@...mail.com)
[SECURITY] [DSA 1183-1] New Linux 2.4.27 packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[RISE-2006002] FreeBSD 5.x kernel i386_set_ldt() integer overflow vulnerability (advisories@...esecurity.org)
ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] (Gadi Evron <ge@...uxbox.org>)
Typo3 v4.x: XSS in extension "Indexed Search" v2.9.0 (Moritz Naumann <security@...itz-naumann.com>)
phpstak <= Remote File Include Vulnerability (h4ck3riran@...oo.com)
RSA Keyon Log verification bypass vulnerability (Andrei Mikhailovsky <mlists@...ont.com>)
Windows VML Vulnerability FAQ (CVE-2006-4868) written (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[USN-352-1] Thunderbird vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200609-13 ] gzip: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[SECURITY] [DSA 1184-1] New Linux 2.6.8 packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Opial Audio/Video Download Management - Version 1.0 index.php Xss vulns. (meto5757@...mail.com)
MyPhotos<= Remote File Include Vulnerability (h4ck3riran@...oo.com)
PhotoStore Multiple Cross-Site Scripting Vulnerabilities (meto5757@...mail.com)
[ MDKSA-2006:170 ] - Updated webmin packages fix XSS vulnerability (security@...driva.com)
wwwthreads <= 5.4.2 croos site script vulnerbilities (h4ck3riran@...oo.com)
[ MDKSA-2006:169 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] (Gadi Evron <ge@...uxbox.org>)
Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
PNews v1.1.0 (nbs) Remote File Inclusion (CvIr.System@...il.com)
tech support being flooded due to IE 0day (Gadi Evron <ge@...uxbox.org>)
Re: [Full-disclosure] Self-contained XSS Attacks (the new generation of XSS) (Tim <tim-security@...tinelchicken.org>)
Re: [Full-disclosure] Self-contained XSS Attacks (the new generation of XSS) ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: More Vulnerable ATM Models (Jacob Appelbaum <jacob@...elbaum.net>)
RE: [Full-disclosure] Yet another 0day for IE ("Bill Stout" <bill.stout@...enborder.com>)
Re: Woltlab Burning Board 2.3.X SQL Injection Vulnerability (Bastian Ahrens <mail@...ks.com>)
Local File Inclusion : Kietu (cdg393@...il.com)
Re: Woltlab Burning Board 2.3.X SQL Injection Vulnerability (x82_@...ru)
[security bulletin] HPSBUX02152 SSRT5973 rev.1 - HP-UX Kerberos Client Remote Unauthenticated Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBUX02155 SSRT061235 rev.1 HP-UX CIFS Server (Samba) Local Unauthorized Access, Elevated Privileges (security-alert@...com)
Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] ("Bojan Zdrnja" <bojan.zdrnja@...il.com>)
iDefense Security Advisory 09.23.06: FreeBSD i386_set_ldt Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 09.23.06: FreeBSD i386_set_ldt Integer Signedness Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

September 26 (30 messages)

Uninformed Journal Release Announcement: Volume 5 (H D Moore <sflist@...italoffense.net>)
[ GLSA 200609-15 ] GnuTLS: RSA Signature Forgery (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200609-14 ] ImageMagick: Multiple Vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Ruxcon 2006 (cfp@...con.org.au)
WebspotBlogging => 3.0 Remote File Include Vulnerabilities (h4ck3riran@...oo.com)
DanPHPSupport => 0.5 Cross Site Scripting Vulnerabilities (h4ck3riran@...oo.com)
QB ( QuickBlogger ) =>1.4 Remote File Include Vulnerabilities (h4ck3riran@...oo.com)
php_news => 2.0 Remote File Include Vulnerabilities (h4ck3riran@...oo.com)
Back-end => 0.4.5 Remote File Include Vulnerabilities (h4ck3riran@...oo.com)
webnews <= v1.4 (WN_BASEDIR) Remote File Inclusion Exploit (the-wolf-ksa@...mail.com)
CubeCart Multiple input Validation vulnerabilities (security@...or.net)
Vbulletin 2.X sql injection (security@...or.net)
SolpotCrew Advisory #13 - phpMyChat 0.1 (ChatPath) Remote File Inclusion (chris_hasibuan@...oo.com)
[SECURITY] [DSA 1184-2] New Linux 2.6.8 packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
PHP Invoice 2.2 (Billing and client Management) home.php Xss vuln. (meto5757@...mail.com)
[ GLSA 200609-16 ] Tikiwiki: Arbitrary command execution (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[Whitepaper] - Access over Ethernet: Insecurities in AoE ("Morgan Marquis-Boire" <morgan@...urity-assessment.com>)
SUSE Security Announcement: gzip (SUSE-SA:2006:056) (Thomas Biege <thomas@...e.de>)
VML Exploit vs. AV/IPS/IDS signatures (avivra <avivra@...il.com>)
WD25:- Deparcq Pieter project File Include Vulnerability (stormhacker@...mail.com)
rPSA-2006-0173-1 openoffice.org (rPath Update Announcements <announce-noreply@...th.com>)
Re: Re: Apple Remote Desktop root vulneravility (securityfocus@...efiter.com)
Windows VML security update MS06-055 released (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
ZDI-06-029: Ipswitch WS_FTP Server Checksum Command Parsing Buffer Overflow Vulnerabilities (zdi-disclosures@...m.com)
Re: Re: Woltlab Burning Board 2.3.X SQL Injection Vulnerability (Bastian Ahrens <mail@...ks.com>)
Free Rainbow Tables.com (Jerome Athias <jerome.athias@...e.fr>)
Re: VML Exploit vs. AV/IPS/IDS signatures ("Pukhraj Singh" <pukhraj.singh@...il.com>)
JAF CMS 4.0 RC1 multiple vulnerabilities (nanoymaster@...il.com)
RE: VML Exploit vs. AV/IPS/IDS signatures ("Aviv Raff" <avivra@...il.com>)
Re: XSS in AckerTodo v4.0 (hensleyrob@...il.com)

September 27 (22 messages)

rPSA-2006-0174-1 gnome-ssh-askpass openssh openssh-client openssh-server (rPath Update Announcements <announce-noreply@...th.com>)
net2ftp: a web based FTP client :) <= Remote File Inclusion (stormhacker@...mail.com)
Blog Pixel Motion V2.1.1 PHP Code Execution / Create Admin Exploit (gmdarkfig@...il.com)
VirtueMart Joomla eCommerce Edition CMS Multiple XSS Vulnerabilities (Base64 <base640@...il.com>)
Digital Armaments September-October Hacking Challenge: Explorer and Mozilla (info@...italarmaments.com)
Exploit module available for WebViewFolderIcon setSlice 0-day ("Chris Byrd" <cbyrd01@...il.com>)
bug com_madeira (ifx@...u.us)
[ GLSA 200609-17 ] OpenSSH: Denial of Service (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Comdev Links Directory 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev Photo Gallery 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev News Publisher 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev Vote Caster 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev Customer Helpdesk 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev Contact Form 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
MkPortal Cross Site Scripting (All versions) xSS (vannovax@...il.com)
Comdev CSV Importer 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev eCommerce 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev Web Blogger 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev Guestbook 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev FAQ Support 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
Comdev Newsletter 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
PHPSelect Web Development Division <= Remote File Inclusion (stormhacker@...mail.com)

September 28 (27 messages)

Comdev Events Calendar 3.1 :) <= Remote File Inclusion (stormhacker@...mail.com)
[ GLSA 200609-18 ] Opera: RSA signature forgery (Matthias Geerdsen <vorlon@...too.org>)
Multitple XSS Vulnerabilities in Red Mombin 0.7 (security@...orize.com)
SAP Internet Transaction Server XSS vulnerability (info@...onsecurity.ch)
FreeBSD Security Advisory FreeBSD-SA-06:23.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[OpenPKG-SA-2006.021] OpenPKG Security Advisory (openssl) (OpenPKG <openpkg@...npkg.org>)
Newswriter SW v1.4.2 Remote File Include Exploit (x0r0n@...mail.com)
RE: Windows VML security update MS06-055 released (Alex Eckelberry <AlexE@...belt-software.com>)
ERRATA: [ GLSA 200609-17 ] OpenSSH: Denial of Service (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ MDKSA-2006:170-1 ] - Updated webmin packages fix XSS vulnerability (security@...driva.com)
RE: [Full-disclosure] VML Exploit vs. AV/IPS/IDS signatures ("avivra" <avivra@...il.com>)
[USN-353-1] openssl vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Multiple XSS Vulnerabilities in Zen Cart 1.3.5 (security@...orize.com)
RE: Canon ImageRunner reveals SMB, IPX, and FTP username/passwords ("Jill George" <jgeorge@...t.org>)
[SECURITY] [DSA 1185-1] New openssl packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
An analysis of Microsoft Windows Vista’s ASLR (Renaud Lifchitz <r.lifchitz@...dream.com>)
SolpotCrew Advisory #14 - phpBB XS 2 spain version (phpbb_root_path) Remote File Inclusion (chris_hasibuan@...oo.com)
Re: [Full-disclosure] VML Exploit vs. AV/IPS/IDS signatures ("Pukhraj Singh" <pukhraj.singh@...il.com>)
[ GLSA 200609-20 ] DokuWiki: Shell command injection and Denial of Service (Matthias Geerdsen <vorlon@...too.org>)
[ MDKSA-2006:157-1 ] - Updated musicbrainz packages fix buffer overflow vulnerabilities (security@...driva.com)
Re: xxs in MKPortal M1.1 (security@...lica-solutions.de)
[ GLSA 200609-19 ] Mozilla Firefox: Multiple vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
MkPortal UrloBox Increment Zize Desfiguration (vannovax@...il.com)
[ MDKSA-2006:172 ] - Updated openssl packages fix vulnerabilities (security@...driva.com)
[ MDKSA-2006:171 ] - Updated openldap packages fixes ACL vulnerability (security@...driva.com)
rPSA-2006-0175-1 openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
Re: ssLinks <=v1.22 Multiple SQL Injection Vulnerabilities (rip@...lly.bogus.spam.com)

September 29 (17 messages)

TSLSA-2006-0054 - multi (Trustix Security Advisor <tsl@...stix.org>)
Secunia Research: Joomla BSQ Sitestats Component Multiple Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
FreeBSD Security Advisory FreeBSD-SA-06:23.openssl [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[MajorSecurity Advisory #28]ConPresso CMS - Multiple Cross Site Scripting and SQL Injection Issues (admin@...orsecurity.de)
UBB.threads Multiple input validation error (security@...or.net)
Advisory 06/2006: PHProjekt (Remote) Include Vulnerabilities (Stefan Esser <sesser@...dened-php.net>)
Sql injection in PostNuke [Admin section] ("Omid" <omid@...kers.ir>)
Re: [Full-disclosure] VML Exploit vs. AV/IPS/IDS signatures (SanjayR <sanjayr@...oto.com>)
[ MDKSA-2006:173 ] - Updated ffmpeg packages fix buffer overflow vulnerabilities (security@...driva.com)
[ MDKSA-2006:174 ] - Update gstreamer-ffmpeg packages fix buffer overflow vulnerabilities (security@...driva.com)
[ MDKSA-2006:175 ] - Updated mplayer packages fix buffer overflow vulnerabilities (security@...driva.com)
[ MDKSA-2006:176 ] - Updated xine-lib packages fix buffer overflow vulnerabilities (security@...driva.com)
Determina zero-day fix for CVE-2006-3730 (WebViewFolderIcon setSlice Integer Overflow) (Alexander Sotirov <asotirov@...ermina.com>)
rPSA-2006-0175-2 openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation (Matasano Advisories <advisories@...asano.com>)
rPSA-2006-0176-1 openldap openldap-clients openldap-servers (rPath Update Announcements <announce-noreply@...th.com>)
Mercury SiteScope 8.2 (8.1.2.0) Cross Site Scripting (XSS) Vulnerability (ozkan.aziz@...tehat.org.uk)

September 30 (6 messages)

setSlice exploited in the wild - massively (Gadi Evron <ge@...uxbox.org>)
[SECURITY] [DSA 1187-1] New migrationtools packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1186-1] New cscope packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
OlateDownload 3.4.0 Multiple Vulnerabilities (no-reply@...samx.net)
Yblog => Cross Site Scripting (h4ck3riran@...oo.com)
phpBB XS <= 0.58 (phpbb_root_path) Remote File Include Vulnerability(2) (x0r0n@...mail.com)

513 messages

Powered by blists - more mailing lists