bugtraq mailing list - 2007/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2007/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 25	³ 28	⁴ 46	⁵ 14	⁶ 15	⁷ 7	⁸
⁹ 16	¹⁰ 11	¹¹ 18	¹² 26	¹³ 6	¹⁴ 17	¹⁵
¹⁶ 29	¹⁷ 36	¹⁸ 40	¹⁹ 26	²⁰ 9	²¹ 4	²²
²³ 32	²⁴ 18	²⁵ 27	²⁶ 14	²⁷ 13	²⁸ 2	²⁹
³⁰ 13

Messages by day:

April 2 (25 messages)

Re: Xoops All Version -Articles- Print.PHP (ID) Blind SQL Injection Exploit And PoC (vaughan.montgomery@...il.com)
2BGal 3.1.1 <= (admin/index.php) Remote File Include Vulnerability ("BorN To K!LL BorN To K!LL" <q.t.i@...mail.com>)
MS announces out-of-band patch for ANI 0day (Gadi Evron <ge@...uxbox.org>)
[ GLSA 200703-27 ] Squid: Denial of Service (Raphael Marichez <falco@...too.org>)
[SECURITY] [DSA 1274-1] New file packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
[security bulletin] HPSBMA02198 SSRT061177 rev.1 - HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Access (security-alert@...com)
[ GLSA 200703-28 ] CUPS: Denial of Service (Raphael Marichez <falco@...too.org>)
DirectAdmin persistant XSS [takeover an Administrator`s account] (Kanedaaa Bohater <kaneda@...ater.net>)
Re: Drake CMS v0.3.2 < = RFi Vulnerabilities (legolas558@...rs.sourceforge.net)
Norton Multiple insufficient argument validation of hooked SSDT function Vulnerability (Matousec - Transparent security Research <research@...ousec.com>)
Re: Denial of Service Vulnerabilities in TrueCrypt 4.3 Linux (re. bid 23180) (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
0day Oracle 10g exploit - dbms_aq.enqueue - become DBA ("Andrea \"bunker\" Purificato" <bunker@...twebnet.it>)
Windows XP/Vista (.ANI) Remote Exploit (bypass eeye patch) (jamikazu@...il.com)
Maplab <= 2.2.1 (gszAppPath) Remote File Inclusion Vulnerability (mufti.rizal@...il.com)
iDefense Security Advisory 03.31.07: Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
More information on ZERT patch for ANI 0day (Gadi Evron <ge@...uxbox.org>)
WOVB #01: Bypassing Vista Firewall, Flying over obstructive line (TWOVB Team <twovb@...urinfos.info>)
Re: AIX 4.3 lsmcode local root command execution (Shiva Persaud <shivapd@...tin.ibm.com>)
APOP vulnerability (gaetan.leurent@....fr (Gaëtan LEURENT))
iDefense Security Advisory 04.02.07: Hewlett-Packard Mercury Quality Center ActiveX Control ProgColor Buffer Overflow V… (iDefense Labs <labs-no-reply@...fense.c…)
Re: Maplab <= 2.2.1 (gszAppPath) Remote File Inclusion Vulnerability (jasus <jasus@...efonica.net>)
Re: Maplab <= 2.2.1 (gszAppPath) Remote File Inclusion Vulnerability (str0ke <str0ke@...w0rm.com>)
[CFP] VNSECON 07 - Call for Papers / HCMC - August 03-04, 2007 (rd <rd@...ecurity.net>)
[ GLSA 200704-01 ] Asterisk: Two SIP Denial of Service vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
iDefense Security Advisory 03.31.07: IBM Tivoli Provisioning Manager for OS Deployment Multiple Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)

April 3 (28 messages)

[SECURITY] [DSA 1275-1] New zope2.7 packages fix cross-site scripting flaw (Noah Meyerhans <noahm@...ian.org>)
TWOVB][ The Week Of Vista Bugs: the truth is out there (TWOVB Team <twovb@...urinfos.info>)
Re: Exploiting Microsoft dynamic Dns updates (Denis Jedig <dj@...eticon.de>)
[MajorSecurity Advisory #37]HolaCMS - Cross Site Scripting Issue (SecurityAudit@...orsecurity.de)
MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploit (gmdarkfig@...il.com)
Re: [Full-disclosure] [RECTIFY] Oracle 10g exploit - dbms_aq.enqueue - become DBA ("Andrea \"bunker\" Purificato" <bunker@...twebnet.it>)
Remote File Include In Script stat12 (RaeD@...Mail.Com)
Re: APOP vulnerability (gaetan.leurent@....fr (Gaëtan LEURENT))
Re[2]: APOP vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: [Full-disclosure] More information on ZERT patch for ANI 0day ("Matthew Murphy" <mattmurphy@...rr.com>)
Re: APOP vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: More information on ZERT patch for ANI 0day (Stefan Kelm <stefan.kelm@...orvo.de>)
MITKRB5-SA-2007-002: KDC, kadmind stack overflow in krb5_klog_syslog [CVE-2007-0957] (Tom Yu <tlyu@....EDU>)
FLEA-2007-0006-2: ImageMagick (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
MITKRB5-SA-2007-003: double-free vulnerability in kadmind (via GSS-API library) [CVE-2007-1216] (Tom Yu <tlyu@....EDU>)
iDefense Security Advisory 04.03.07: Microsoft Windows WMF Triggerable Kernel Design Error DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: 0day Oracle 10g exploit - dbms_aq.enqueue - become DBA (Gadi Evron <ge@...uxbox.org>)
MITKRB5-SA-2007-001: telnetd allows login as arbitrary user [CVE-2007-0956] (Tom Yu <tlyu@....EDU>)
Re: 0day Oracle 10g exploit - dbms_aq.enqueue - become DBA (Andrea Purificato - bunker <bunker@...twebnet.it>)
iDefense Security Advisory 04.03.07: Multiple Vendor Kerberos kadmind Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: On-going Internet Emergency and Domain Names ("Bob Fiero" <bob@...talfloss.net>)
FLEA-2007-0007-1: nas (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Re: More information on ZERT patch for ANI 0day ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
ZDI-07-012: Yahoo! Messenger AudioConf ActiveX Control Buffer Overflow (zdi-disclosures@...m.com)
FLEA-2007-0006-1: ImageMagick (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[SECURITY] [DSA 1276-1] New krb5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200704-02 ] MIT Kerberos 5: Arbitrary remote code execution (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Nine Vista CVEs, including Microsoft inaccurate Teredo use case documentation (Jim Hoagland <jim_hoagland@...antec.com>)

April 4 (46 messages)

[ GLSA 200704-05 ] zziplib: Buffer Overflow (Raphael Marichez <falco@...too.org>)
[ MDKSA-2007:075 ] - Updated qt4 packages to address utf8 decoder bug (security@...driva.com)
iDefense Security Advisory 04.03.07: Multiple Vendor X Server fonts.dir File Parsing Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200704-03 ] OpenAFS: Privilege escalation (Raphael Marichez <falco@...too.org>)
Three New Papers on Oracle Forensics ("David Litchfield" <davidl@...software.com>)
rPSA-2007-0063-1 krb5 krb5-server krb5-services krb5-test krb5-workstation (rPath Update Announcements <announce-noreply@...th.com>)
CYBSEC Pre-Advisory: SAP TRUSTED_SYSTEM_SECURITY RFC Function Information Disclosure (CYBSEC Advisories <advisories@...sec.com>)
iDefense Security Advisory 04.03.07: Multiple Vendor X Server XC-MISC Extension Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
CYBSEC Security Pre-Advisory: SAP RFC_START_PROGRAM RFC Function Multiple Vulnerabilities (CYBSEC Advisories <advisories@...sec.com>)
lite-cms-0.2.1 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
CYBSEC Security Pre-Advisory: SAP RFC_START_GUI RFC Function Buffer Overflow (CYBSEC Advisories <advisories@...sec.com>)
CYBSEC Security Pre-Advisory: SAP SYSTEM_CREATE_INSTANCE RFC Function Buffer Overflow (CYBSEC Advisories <advisories@...sec.com>)
[USN-449-1] krb5 vulnerabilities (Kees Cook <kees@...ntu.com>)
CYBSEC Security Pre-Advisory: SAP RFC_SET_REG_SERVER_PROPERTY RFC Function Denial Of Service (CYBSEC Advisories <advisories@...sec.com>)
rPSA-2007-0064-1 ImageMagick (rPath Update Announcements <announce-noreply@...th.com>)
CYBSEC Release: SAP Security - Paper & Tool release (Mariano Nuñez Di Croce <mnunez@...sec.com>)
[ MDKSA-2007:074 ] - Updated qt3 packages to address utf8 decoder bug (security@...driva.com)
[MajorSecurity Advisory #38]eXV2 CMS - Session fixation and Cross-Site-Scripting Issues (Securityaudit@...orsecurity.de)
[USN-448-1] X.org vulnerabilities (Kees Cook <kees@...ntu.com>)
iXon_CMS 0.30 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
rPSA-2007-0067-1 nas (rPath Update Announcements <announce-noreply@...th.com>)
K-CMS v1.0 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
rPSA-2007-0066-1 kdelibs qt-x11-free (rPath Update Announcements <announce-noreply@...th.com>)
Monkey CMS v0.0.3 Remote File Include Vulnerabilitiy (the_3dit0r@...oo.com)
phpechocms v.2 Cross-Site Scripting Vulnerabilitiy (the_3dit0r@...oo.com)
iDefense Security Advisory 04.03.07: Multiple Vendor X Server BDF Font Parsing Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
phpechocms2 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
rPSA-2007-0065-1 freetype xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (rPath Update Announcements <announce-noreply@...th.com>)
MyBlog: PHP and MySQL Blog/CMS software Cross-Site Scripting Vulnerabilitiy (the_3dit0r@...oo.com)
[ MDKSA-2007:076 ] - Updated kdelibs packages to address UTF8 issue in KJS (security@...driva.com)
MyBlog: PHP and MySQL Blog/CMS software Remote File Include Vulnerabilitiy (the_3dit0r@...oo.com)
Mozilla Firefox Insecure Element Stealth Injection Vulnerability ("Michal Majchrowicz" <m.majchrowicz@...il.com>)
rPSA-2007-0062-1 firefox (rPath Update Announcements <announce-noreply@...th.com>)
Re: Denial of Service Vulnerabilities in TrueCrypt 4.3 Linux (re. bid 23180) (Marco Ivaldi <raptor@...eadbeef.info>)
High Risk Vulnerability in OpenOffice ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Several Windows image viewers vulnerabilities ("Ivan Fratric" <ifsecure@...il.com>)
Re: More information on ZERT patch for ANI 0day ("Jason Frisvold" <xenophage0@...il.com>)
Re: More information on ZERT patch for ANI 0day ("Jason Frisvold" <xenophage0@...il.com>)
Re: More information on ZERT patch for ANI 0day ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
[SECURITY] [DSA 1277-1] New XMMS packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
Gazi Okul Sitesi 2007(tr)(fotokategori.asp) Remote SQL Injection (r00t-balance@...mail.com)
[ MDKSA-2007:077 ] - Updated krb5 packages fix vulnerabilities (security@...driva.com)
Firefox extensions go Evil - Critical Vulnerabilities in Firefox/Firebug ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
VMSA-2007-0003 VMware ESX 3.0.1 and 3.0.0 server security updates (VMware Security team <security@...are.com>)
[ MDKSA-2007:078 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)
Remot File Include In phpexplorator_2_0 (RaeD@...Mail.Com)

April 5 (14 messages)

[ MDKSA-2007:079 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities (security@...driva.com)
Re: [WEB SECURITY] Firefox extensions go Evil - Critical Vulnerabilities in Firefox/Firebug (Daniel Veditz <dveditz@...zio.com>)
LedgerSMB 1.2.0 finally released, fixes CVE-2006-5589 (Chris Travers <chris@...atrontech.com>)
[ MDKSA-2007:080 ] - Updated tightvnc packages fix integer overflow vulnerabilities (security@...driva.com)
[ MDKSA-2007:081 ] - Updated freetype2 packages fix vulnerability (security@...driva.com)
iDefense Security Advisory 04.04.07: Kaspersky AntiVirus SysInfo ActiveX Control Information Disclosure Vulnerability (iDefense Labs <labs-no-reply@...fense.co…)
iDefense Security Advisory 04.04.07: Kaspersky Internet Security Suite klif.sys Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Microsoft .NET request filtering bypass vulnerability (BID 20753) (research@...checkup.com)
iDefense Security Advisory 04.04.07: ESRI ArcSDE Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
FLEA-2007-0008-1: krb5 (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
FLEA-2007-0009-1: xorg-x11 freetype (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Wserve HTTP Server 4.6 Version (Long Directory Name) Buffer Overflow - Denial Of Service (UniquE@...quE-Key.Org)
FLEA-2007-0010-1: evolution (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[security bulletin] HPSBUX02204 SSRT071341 rev.1 - HP-UX Running CIFS Server (Samba), Remote Denial of Service (DoS) (security-alert@...com)

April 6 (15 messages)

Re: Firefox extensions go Evil - Critical Vulnerabilities in Firefox/Firebug ("Thor Larholm" <larholm@...il.com>)
ACLS ineffective in SQL-Ledger and LedgerSMB (Chris Travers <chris@...atrontech.com>)
Re: Nine Vista CVEs, including Microsoft inaccurate Teredo use case documentation (Jim Hoagland <jim_hoagland@...antec.com>)
ZDI-07-014: Kaspersky Anti-Virus ActiveX Control Unsafe Method Exposure Vulnerablity (zdi-disclosures@...m.com)
phpContact Multiple Remote File Inclusion Vulnerabilities (rko.thelegendkiller@...il.com)
[MajorSecurity Advisory #39]onelook onebyone CMS - Session fixation Issue (Securityaudit@...orsecurity.de)
ZDI-07-013: Kaspersky AntiVirus Engine ARJ Archive Parsing Heap Overflow Vulnerability (zdi-disclosures@...m.com)
[MajorSecurity Advisory #40]onelook oboShop - Session fixation Issue (Securityaudit@...orsecurity.de)
[MajorSecurity Advisory #41]onelook courts online - Session fixation Issue (Securityaudit@...orsecurity.de)
livor 2.5 Cross-Site Scripting Vulnerability (rko.thelegendkiller@...il.com)
AOL Nullsoft Winamp LIBSNDFILE.DLL Remote Memory Corruption (Off By Zero) (Piotr Bania <bania.piotr@...il.com>)
AOL Nullsoft Winamp S3M Module "IN_MOD.DLL" Remote Heap Memory Corruption (Piotr Bania <bania.piotr@...il.com>)
AOL Nullsoft Winamp IT Module "IN_MOD.DLL" Remote Heap Memory Corruption (Piotr Bania <bania.piotr@...il.com>)
[SECURITY] [DSA 1278-1] New man-db packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
LayerOne 2007 - Speaker Line up Announced ("Layer One" <layeronecfp@...il.com>)

April 7 (7 messages)

[ GLSA 200704-06 ] Evince: Stack overflow in included gv code (Raphael Marichez <falco@...too.org>)
[ GLSA 200704-07 ] libwpd: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
PHP <= 5.2.1 wbmp file handling integer overflow ("Ivan Fratric" <ifsecure@...il.com>)
[MajorSecurity Advisory #42]webblizzard CMS - Cross Site Scripting and Session fixation Issues (Securityaudit@...orsecurity.de)
Re: Nine Vista CVEs, including Microsoft inaccurate Teredo use case documentation (GomoR <bt@...or.org>)
CmailServer WebMail <= V.5.3.4 (signup) Remote XSS Exploit (ajannhwt@...mail.com)
witshare 0.9 Remote File Include Vulnerabilitiy (the_3dit0r@...oo.com)

April 9 (16 messages)

UBB.threads (<= 6.1.1) SQL Injection Vulnerability (john@...tinelli.com)
Scorp Book <== v1.0 (smilies.php) Remote File Include Exploit (k4rtal@...il.com)
Take Control In Script Jeebles Directory (RaeD@...Mail.Com)
phpMyAdmin 2.6.1 Local Cross Site Scripting (the_3dit0r@...oo.com)
Remot File Include In Script Lore v1 (RaeD@...Mail.Com)
DeskPRO v2.0.1 - Cross-Site Scripting Vulnerability (john@...tinelli.com)
Gsylvain35 Portail Web Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
Request It : Song Request System 1.0b - remote file inclusion (mail@...kberry.ath.cx)
QuizShock 1.6.1 - Cross-Site Scripting Vulnerability (john@...tinelli.com)
Mybb Hot Editor Plugin Local File Inclusion (liz0@...w0rm.com)
Hot Editor v4.0 Local File Inclusion (liz0@...w0rm.com)
Re: Mybb Hot Editor Plugin Local File Inclusion ("Kevin Finisterre (lists)" <kf_lists@...italmunition.com>)
xodagallery Remote Code Execution Vulnerability (the_3dit0r@...oo.com)
rPSA-2007-0070-1 openoffice.org (rPath Update Announcements <announce-noreply@...th.com>)
Re: Re: Mybb Hot Editor Plugin Local File Inclusion (liz0@...w0rm.com)
iDefense Security Advisory 04.09.07: AOL AIM and ICQ File Transfer Path-Traversal Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

April 10 (11 messages)

[USN-450-1] ipsec-tools vulnerability (Kees Cook <kees@...ntu.com>)
phpGalleryScript 1.0 - File Inclusion Vulnerabilities (z12xxa@...il.com)
DEF CON One Five CfP in effect! (The Dark Tangent <dtangent@...con.org>)
EEYE: Windows VDM Zero Page Race Condition Privilege Escalation ("eEye Advisories" <Advisories@...e.com>)
EEYE: Windows Vista CSRSS Dangling Process Pointer Privilege Escalation ("eEye Advisories" <Advisories@...e.com>)
PhpOpenChat <= 3.0.1 (poc.php) Multiple Remote File Include Vulnerabilities (seko@...ko.info)
Secunia Research: Microsoft Agent URL Parsing Memory Corruption Vulnerability (Secunia Research <remove-vuln@...unia.com>)
iDefense Security Advisory 04.10.07: Microsoft Windows Universal Plug and Play Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ MDKSA-2007:077-1 ] - Updated krb5 packages fix vulnerabilities (security@...driva.com)
Re: vbulletin admincp sql injection (rjmjr69@....com)
[ MDKSA-2007:081-1 ] - Updated freetype2 packages fix vulnerability (security@...driva.com)

April 11 (18 messages)

[USN-451-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
webMethods Glue Management Console Directory Traversal ("Patrick Webster" <patrick@...hack.com>)
[ MDKSA-2007:080-1 ] - Updated tightvnc packages fix integer overflow vulnerabilities (security@...driva.com)
nEw Bug :D ("asdasd asdsadas" <dr.rover@...kermail.com>)
New bug :) ("asdasd asdsadas" <dr.rover@...kermail.com>)
pL-PHP beta 0.9 - Multiple Vulnerabilities (omnipresent@...il.it)
[MajorSecurity Advisory #43]Calacode ATMail 5.0 - Cross Site Scripting and Cookie Manipulation Issue (admin@...orsecurity.de)
CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability (john@...tinelli.com)
Cosign SSO Authentication Bypass (Jon Oberheide <jon@...rheide.org>)
Re: On-going Internet Emergency and Domain Names (Alexander Klimov <alserkli@...ox.ru>)
Re: Latinchat Denial Of Service (d4rksoft@...mail.com)
PunBB <= 1.2.14 Multiple Vulnerabilities (Advisory) (gmdarkfig@...il.com)
Steganos Encrypted Safe NOT so safe (frankrizzo604@...il.com)
[ MDKSA-2007:079-1 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities (security@...driva.com)
PunBB <= 1.2.14 Remote Code Execution (Exploit) (gmdarkfig@...il.com)
[ MDKSA-2007:083 ] - Updated apache-mod_perl packages fix DoS vulnerability (security@...driva.com)
[ MDKSA-2007:075-1 ] - Updated qt4 packages to address utf8 decoder bug (security@...driva.com)
iDefense Security Advisory 04.11.07: Apache HTTPD suEXEC Multiple Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)

April 12 (26 messages)

[ MDKSA-2007:082 ] - Updated madwifi-source, wpa_supplicant packages fix vulnerabilities (security@...driva.com)
E107 - (v0.7.8) Access Escalation Vulnerbility - PoC (jd2k2000@...mail.com)
HPSBUX02205 SSRT061120 rev.1 - HP-UX Running ARPA Transport, Local Denial of Service (DoS) (security-alert@...com)
CVE-2007-1871: Cross site scripting in chcounter 3.1.3 ("Hanno Böck" <mail@...eck.de>)
INFIGO-2007-04-05: Enterprise Security Analyzer server remote buffer overflows (infocus@...igo.hr)
CVE-2007-1872: Cross site scripting in toendaCMS 1.5.3 ("Hanno Böck" <mail@...eck.de>)
Critical phpwiki c99shell exploit (rurban@...ay.at)
[security bulletin] HPSBST02206 SSRT071354 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-014 (security-alert@...com)
[security bulletin] HPSBUX01137 SSRT5954 rev.9 - HP-UX Running TCP/IP (IPv4), Remote Denial of Service (DoS) (security-alert@...com)
Cisco Security Advisory: Multiple Vulnerabilities in the Cisco Wireless LAN Controller and Cisco Lightweight Access Poin… (Cisco Systems Product Security Incident…)
[ GLSA 200704-08 ] DokuWiki: Cross-site scripting vulnerability (Matthias Geerdsen <vorlon@...too.org>)
Cisco Security Advisory: Multiple Vulnerabilities in the Cisco Wireless Control System (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[security bulletin] HPSBGN02199 SSRT071312 rev.1 - Mercury Quality Center ActiveX, Remote Unauthorized Arbitrary Code Execution (security-alert@...com)
Re: Critical phpwiki c99shell exploit (Gadi Evron <ge@...uxbox.org>)
Re: Critical phpwiki c99shell exploit ("Jamie Riden" <jamie.riden@...il.com>)
Cross site scripting in mephisto 0.7.3 ("Hanno Böck" <mail@...eck.de>)
[security bulletin] HPSBUX02203 SSRT071339 rev.1 - HP-UX Running Portable File System (PFS), Remote Increase in Privilege (security-alert@...com)
TuMusika Evolution 1.6 Cross Site Scripting Vulnerabilitiy (the_3dit0r@...oo.com)
phpwebnews v.1 Multiple Cross Site Scripting Vulnerabilites (the_3dit0r@...oo.com)
Chatness <= 2.5.3 - Arbitrary Code Execution (jd2k2000@...mail.com)
Re: Cross site scripting in mephisto 0.7.3 (encytemedia@...il.com)
RE: Critical phpwiki c99shell exploit ("Ryan Neufeld" <it@...powersystems.com>)
FAC GuestBook v2.0 remote database disclosure vulnerability (the_3dit0r@...oo.com)
Aircrack-ng (airodump-ng) remote buffer overflow vulnerability (jonny@...-art.net)
iDefense Security Advisory 04.12.07: Hewlett Packard HP-UX Remote pfs_mountd.rpc Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[USN-452-1] KDE library vulnerability (Kees Cook <kees@...ntu.com>)

April 13 (6 messages)

[Argeniss] Hacking Databases for owning your data (paper) (Cesar <cesarc56@...oo.com>)
[OPENADS-SA-2007-003] Openads 2.0.11 vulnerability fixed (Matteo Beccati <php@...cati.com>)
[OPENADS-SA-2007-004] Max Media Manager v0.1.29-rc and v0.3.31-alpha-pr2 vulnerability fixed (Matteo Beccati <php@...cati.com>)
[MajorSecurity Advisory #44]MailBee WebMail Pro - Cross Site Scripting Issue (admin@...orsecurity.de)
[waraxe-2007-SA#048] - Multiple vulnerabilities in Virtual War 1.5 module for PhpNuke (come2waraxe@...oo.com)
TSRT-07-04: LANDesk Management Suite Alert Service Stack Overflow Vulnerability (TSRT@...m.com)

April 14 (17 messages)

Vbulletin 3.6.5 Sql Injection ! [misc.php] (seko@...ko.info)
bloofoxCMS 0.2.2 Cross Site Scripting (the_3dit0r@...oo.com)
Re: Vbulletin 3.6.5 Sql Injection ! [misc.php] (scott-REMOVE@...lletin.com)
VCDGear <= 3.56 Build 050213 (FILE) Local Code Execution Exploit (meftun@...tunnet.com)
Re: Steganos Encrypted Safe NOT so safe (Andreas Beck <becka-list-bugtraq@...atec.de>)
Back-End CMS Database Tables v0.4.7 Cross Site Scripting (the_3dit0r@...oo.com)
MobilePublisherphp v1.1.2 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
FloweRS v2.0 Cross Site Scripting (the_3dit0r@...oo.com)
Maian Search v1.1 (k4rtal@...il.com)
Maian Gallery v1.0 (k4rtal@...il.com)
B2evolution 1.6 RFi (k4rtal@...il.com)
MySpeach v1.9 (k4rtal@...il.com)
Back-End CMS Database Tables v0.4.7 Remote File Include Vulnerabilities (the_3dit0r@...oo.com)
Flip-search-add-on 2.0 (k4rtal@...il.com)
Maian Weblog v3.1 (k4rtal@...il.com)
bloofoxCMS 0.2.2 Remote File Include Vulnerabilitiy (the_3dit0r@...oo.com)
phpMyChat-0.14.5 (k4rtal@...il.com)

April 16 (29 messages)

Re: VCDGear <= 3.56 Build 050213 (FILE) Local Code Execution Exploit (str0ke <str0ke@...w0rm.com>)
Pixaria Gallery 1.0 (class.Smarty.php) Remote File Include Vulnerability (irvian_yoe@...oo.com)
Re: sitex multiple vulnerabilities (Lostmon@...il.com)
Re: Maian Gallery v1.0 (support@...anscriptworld.co.uk)
Re: Maian Search v1.1 (support@...anscriptworld.co.uk)
Sitebar 3.3.5 (index.php writerFile)Remote File Include Vulnerabilities ("?? ???? ??????" <lo-talt-alayam@...mail.com>)
[ GLSA 200704-09 ] xine-lib: Heap-based buffer overflow (Raphael Marichez <falco@...too.org>)
Re: [exploits] RPC vuln in DNS Server (fwd) (Gadi Evron <ge@...uxbox.org>)
LS simple guestbook - arbitrary code execution (jd2k2000@...mail.com)
Joomla/Mambo Jambook v1.0 beta7 Rfi Vuln. (crazy_king@...7.org)
[MajorSecurity Advisory #45]oe2edit CMS - Cross Site Scripting and Cookie Manipulation Issue (admin@...orsecurity.de)
ZoneAlarm Multiple insufficient argument validation of hooked SSDT function Vulnerability (Matousec - Transparent security Research <research@...ousec.com>)
ActionPoll Script (actionpoll.php) Remote File Include // starhack.org (seko@...ko.info)
MyBlog <= 0.9.8 Remote Command Execution Exploit (BlackHawk <hawkgotyou@...il.com>)
Re: phpMyChat-0.14.5 (stuart_smith@...il.remove.com)
Microsoft DNS Server Remote Code execution: Analysis and exploit (mballano@...il.com)
Windows DNS Cache Poisoning by Forwarder DNS Spoofing (Makoto Shiotsuki <shio@...rim.or.jp>)
Re: Critical phpwiki c99shell exploit (Taneli Leppä <taneli@...sman.fi>)
[ GLSA 200704-10 ] Inkscape: Two format string vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
Persistent CSRF and The Hotlink Hell ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
iDefense Security Advisory 04.16.07: ClamAV CAB File Unstore Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Ivan Gallery Script V.0.1 (index.php) Remote File Include Exploit (seko@...ko.info)
[ GLSA 200704-11 ] Vixie Cron: Denial of Service (Matthias Geerdsen <vorlon@...too.org>)
rPSA-2007-0071-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
Akamai Technologies Security Advisory 2007-0001 (Akamai Security Team <security@...mai.com>)
[ MDKSA-2007:086 ] - Updated cups packages fix DoS vulnerability (security@...driva.com)
[ MDKSA-2007:084 ] - Updated ipsec-tools packages fix DoS vulnerability (security@...driva.com)
[ MDKSA-2007:085 ] - Updated freeradius packages fix DoS vulnerability (security@...driva.com)
[ GLSA 200704-12 ] OpenOffice.org: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)

April 17 (36 messages)

iDefense Security Advisory 04.16.07: Akamai Download Manager ActiveX Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Netsprint Toolbar 1.1 arbitrary remote code vulnerability ("Michal Bucko" <michal.bucko@...k.pl>)
PHP Nuke <= 8.0.0.3.3b SQL Injections and Bypass SQL Injection Protection vulnerabilities (programmer@...biansite.com)
Remot File Include In Script phphd_downloads (RaeD@...Mail.Com)
Remot File Include download_engine_V1.4.3 (RaeD@...Mail.Com)
Wabbit PHP Gallery v0.9 Cross Site Scripting (the_3dit0r@...oo.com)
my little weblog Cross Site Scripting (the_3dit0r@...oo.com)
my little forum 1.7 Remote File Include Vulnerabilitiy (the_3dit0r@...oo.com)
Re: [Full-disclosure] [WEB SECURITY] Persistent CSRF and The Hotlink Hell (Blue Boar <BlueBoar@...evco.com>)
RE: Windows DNS Cache Poisoning by Forwarder DNS Spoofing ("Roger A. Grimes" <roger@...neretcs.com>)
Re: [WEB SECURITY] Persistent CSRF and The Hotlink Hell ("Ryan Barnett" <rcbarnett@...il.com>)
Re: Netsprint Toolbar 1.1 arbitrary remote code vulnerability (Michal Zalewski <lcamtuf@...ne.ids.pl>)
webMethods Security Advisory: Glue console directory traversal vu lnerability (Jeremy Epstein <jepstein@...methods.com>)
RE: Windows DNS Cache Poisoning by Forwarder DNS Spoofing ("Roger A. Grimes" <roger@...neretcs.com>)
Re: bloofoxCMS 0.2.2 Remote File Include Vulnerabilitiy (info@...ofox.com)
Internet Explorer Crash ("J. Oquendo" <sil@...iltrated.net>)
[security bulletin] HPSBTU02207 SSRT061213, SSRT061239, SSRT071304 rev.1 - HP Tru64 UNIX SSL and BIND Remote Arbitrary Code Execution or D… (security-alert@...com)
Multiple Ask IE Toolbar denial of service vulnerabilities ("Michal Bucko" <michal.bucko@...k.pl>)
Re[2]: Windows DNS Cache Poisoning by Forwarder DNS Spoofing (3APA3A <3APA3A@...URITY.NNOV.RU>)
Gizzar <= (basePath) Remote File Include Vulnerability ("BorN To K!LL BorN To K!LL" <q.t.i@...mail.com>)
BlueArc Firmware 4.2.944b FTP bounce ("Tim Rupp" <caphrim007@...il.com>)
SYMSA-2007-003 Macrovision InstallAnywhere Password and Serial Number Bypass (research@...antec.com)
Re: Internet Explorer Crash (The Anarcat <anarcat@...rcat.ath.cx>)
Re: [Full-disclosure] Cross Domain XMLHttpRequest (ascii <ascii@...amail.com>)
ShoutPro 1.5.2 - arbitrary code execution (jd2k2000@...mail.com)
WASC-Articles: 'The Importance of Application Classification in Secure Application Development' (contact@...appsec.org)
Re: Internet Explorer Crash ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: [Full-disclosure] A Botted Fortune 500 a Day ("Steven Adair" <steven@...urityzone.org>)
n.runs-SA-2007.007 - Sun Solaris 10 - Format string vulnerability (<security@...ns.com>)
Re: [Full-disclosure] A Botted Fortune 500 a Day ("Jamie Riden" <jamie.riden@...il.com>)
Re: [Full-disclosure] A Botted Fortune 500 a Day ("Steven Adair" <steven@...urityzone.org>)
Re: [Full-disclosure] A Botted Fortune 500 a Day ("Jamie Riden" <jamie.riden@...il.com>)
Re: Windows DNS Cache Poisoning by Forwarder DNS Spoofing (Tim <tim-security@...tinelchicken.org>)
Re: [Full-disclosure] A Botted Fortune 500 a Day (Simon Smith <simon@...soft.com>)
Cross Domain XMLHttpRequest ("Michal Majchrowicz" <m.majchrowicz@...il.com>)
Mambo/Joomla Component New Article Component RFI (meftun@...tunnet.com)

April 18 (40 messages)

Re: Windows DNS Cache Poisoning by Forwarder DNS Spoofing (Makoto Shiotsuki <shio@...rim.or.jp>)
[ GLSA 200704-14 ] FreeRADIUS: Denial of Service (Raphael Marichez <falco@...too.org>)
Advisory: Bypass Oracle Logon Trigger (ak@...-database-security.com)
NukeSentinel Bypass SQL Injection & Nuke Evolution <= 2.0.3 SQL Injections (programmer@...biansite.com)
Re: Internet Explorer Crash (Mike Ely <me@...pehat.com>)
Advisory: SQL Injection in package SYS.DBMS_AQADM_SYS (ak@...-database-security.com)
iDefense Security Advisory 04.17.07: McAfee VirusScan On-Access Scanner Long Unicode File Name Buffer Overflow (iDefense Labs <labs-no-reply@...fense.com>)
Advisory: SQL Injection in package SYS.DBMS_UPGRADE_INTERNAL (ak@...-database-security.com)
Advisory: XSS Vulnerability in Oracle Secure Enterprise Search [SES01] (ak@...-database-security.com)
Reminder: HITBSecConf2007 - Malaysia: Call for Papers closing in 2 weeks (Praburaajan <prabu@...kinthebox.org>)
Analysis of the Oracle April 2007 Critical Patch Update ("David Litchfield" <davidl@...software.com>)
iDefense Security Advisory 04.17.07: McAfee E-Business Admin Server Invalid Data Length DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
rPSA-2007-0072-1 lighttpd (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200704-15 ] MadWifi: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
rPSA-2007-0073-1 php php-mysql php-pgsql (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200704-13 ] File: Denial of Service (Raphael Marichez <falco@...too.org>)
rPSA-2007-0074-1 dovecot (rPath Update Announcements <announce-noreply@...th.com>)
MediaBeez Sql query Execution .. Wear isn't ?? :) (security@...or.net)
Oracle Database Buffer overflow vulnerabilities in package DBMS_SNAP_INTERNAL (Team SHATTER <shatter@...secinc.com>)
Re: Internet Explorer Crash (Tom Gregory <sick.minded@...il.com>)
FullyModdedphpBB2 Remote File Inclusion (security@...or.net)
Re: [Full-disclosure] A Botted Fortune 500 a Day (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Extreme PHPBB2 Remote File Inclusion (security@...or.net)
RE: Windows DNS Cache Poisoning by Forwarder DNS Spoofing ("Roger A. Grimes" <roger@...neretcs.com>)
Re: Windows DNS Cache Poisoning by Forwarder DNS Spoofing (Makoto Shiotsuki <shio@...rim.or.jp>)
EclipseBB Remote File Inclusion (security@...or.net)
Re: Windows DNS Cache Poisoning by Forwarder DNS Spoofing (Tim <tim-security@...tinelchicken.org>)
Re: Windows DNS Cache Poisoning by Forwarder DNS Spoofing ("Bojan Zdrnja" <bojan.zdrnja@...il.com>)
Re: Linksys WAG200G - Information disclosure (no-mail@...oo.fr)
Re: Windows DNS Cache Poisoning by Forwarder DNS Spoofing (Tim <tim-security@...tinelchicken.org>)
Re: Internet Explorer Crash (elflord91@...mail.com)
[security bulletin] HPSBST02206 SSRT071354 rev.2 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-017 (security-alert@...com)
Re: Internet Explorer Crash ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: Re[2]: Windows DNS Cache Poisoning by Forwarder DNS Spoofing ("Roger A. Grimes" <roger@...neretcs.com>)
Re: Windows DNS Cache Poisoning by Forwarder DNS Spoofing (Matthew Dixon Cowles <matt@...doinfo.com>)
Re: [funsec] Re: [Full-disclosure] A Botted Fortune 500 a Day ("Fergie" <fergdawg@...zero.net>)
NuclearBB Alpha 1 - Multiple Blind SQL/XPath Injection Vulnerabilities (john@...tinelli.com)
ZDI-07-015: Novell Groupwise WebAccess Base64 Decoding Stack Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-07-016: Oracle E-Business Suite Arbitrary Node Deletion Vulnerability (zdi-disclosures@...m.com)
ZDI-07-017: Oracle E-Business Suite Arbitrary Document Download Vulnerability (zdi-disclosures@...m.com)

April 19 (26 messages)

ZDI-07-018: IBM Tivoli Monitoring Express Universal Agent Heap Overflow Vunlerability (zdi-disclosures@...m.com)
Re: PHP Nuke <= 8.0.0.3.3b SQL Injections and Bypass SQL Injection Protection vulnerabilities (Paul Laudanski <paul@...tlecops.com>)
Re: Internet Explorer Crash (Rob Bartlett <Rob.Bartlett@....COM>)
ZDI-07-019: BMC Patrol PerformAgent bgs_sdservice Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-07-020: BMC Performance Manager SNMP Command Execution Vulnerability (zdi-disclosures@...m.com)
Advisory: Shutdown unprotected Oracle TNS Listener via Oracle Discoverer Servlet [AS01] (ak@...-database-security.com)
RE: Re[2]: Windows DNS Cache Poisoning by Forwarder DNS Spoofing ("Oliver Friedrichs" <oliver_friedrichs@...antec.com>)
[USN-453-1] X.org vulnerability (Kees Cook <kees@...ntu.com>)
Re: Internet Explorer Crash ("Kevin Finisterre (lists)" <kf_lists@...italmunition.com>)
[ MDKSA-2007:087 ] - Updated php packages fix multiple vulnerabilities (security@...driva.com)
[ MDKSA-2007:088 ] - Updated php packages fix multiple vulnerabilities (security@...driva.com)
[ MDKSA-2007:089 ] - Updated php packages fix multiple vulnerabilities (security@...driva.com)
CfP Hack.lu 2007 (info <info@...k.lu>)
Re: ZDI-07-020: BMC Performance Manager SNMP Command Execution Vulnerability (<rashbi@...hmail.com>)
IPB (Invision Power Board) Full Path Disclusure (security@...or.net)
[waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20 (come2waraxe@...oo.com)
Winamp <= (WMV) 5.3 Buffer Overflow DOS Exploit (0-DAY) (UniquE@...quE-Key.ORG)
RaidenFTPd IXceedCompression multiple denial of service vulnerabilities ("Michal Bucko" <michal.bucko@...k.pl>)
Re: Internet Explorer Crash (simone colombo <colombo.simone@...il.com>)
Re: Internet Explorer Crash (Dave Walker <walker@...air.com>)
Yet another SQL injection framework (Guillermo Marro <gmmarro@...wgate.net>)
[security bulletin] HPSBMA02133 SSRT061201 rev.4 - HP Oracle for OpenView (OfO) Critical Patch Update (security-alert@...com)
[ MDKSA-2007:090 ] - Updated php packages fix multiple vulnerabilities (security@...driva.com)
[ MDKSA-2007:091 ] - Updated sqlite packages fix vulnerability (security@...driva.com)
[security bulletin] HPSBST02208 SSRT071365 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-018 to MS07-022 (security-alert@...com)
Re: Internet Explorer Crash ("C. Bergström" <cbergstrom@...syncro.com>)

April 20 (9 messages)

NeatUpload vulnerability and fix (dean@...ttle.com)
ZDI-07-021: GraceNote CDDBControl ActiveX Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
Re: Yet another SQL injection framework (file corruption) (Guillermo Marro <gmmarro@...wgate.net>)
Eba News Version : v1.1 <= (webpages.php) Remote File Include // starhack.org (seko@...ko.info)
Re: Yet another SQL injection framework ("Nick Boyce" <nick.boyce@...il.com>)
TSLSA-2007-0013 - multi (Trustix Security Advisor <tsl@...stix.org>)
iDefense Security Advisory 04.20.07: Check Point Zone Labs SRESCAN IOCTL Local Privilege Escalation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
FLEA-2007-0011-1: lighttpd (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
UseBB Version 1.0.4 Path Disclosure Vulnerability (securityresearch@...vigilance.com)

April 21 (4 messages)

Top Auction 1.0 (viewcat.php) Remote Blind SQL Injection // starhack.org (seko@...ko.info)
Re: Top Auction 1.0 (viewcat.php) Remote Blind SQL Injection // starhack.org (str0ke <str0ke@...w0rm.com>)
turbolence core 0.0.1 alpha Remote File Inclusion (omnipresent@...il.it)
WS_FTP Home 2007 NetscapeFTPHandler denial of service ("Michal Bucko" <michal.bucko@...k.pl>)

April 23 (32 messages)

Allfaclassfieds (level2.php dir) remote file inclusion ("asdasd asdsadas" <dr.rover@...kermail.com>)
Re: WS_FTP Home 2007 NetscapeFTPHandler denial of service (sapheal@...k.pl)
[ GLSA 200704-17 ] 3proxy: Buffer overflow (Raphael Marichez <falco@...too.org>)
[Reversemode advisory] CheckPoint Zonelabs - ZoneAlarm SRESCAN driver local privilege escalation (Reversemode <advisories@...ersemode.com>)
claroline <= Multiple Remote File Include Vulnerablitiy (Mohandko@...il.com)
lms 1.5.3 Remote File Inclusion (InyeXion@...il.com)
EsForum <= 3.0 SQL Injection Vulnerability (ilkerkandemir@...et.com)
PHPMyBibli <= Multiple Remote File Include (Mohandko@...il.com)
[ GLSA 200704-16 ] Aircrack-ng: Remote execution of arbitrary code (Raphael Marichez <falco@...too.org>)
File117 Remote File Inclusion (InyeXion@...il.com)
Ripe Website Manager (<= 0.8.4) - SQL Injection Vulnerability and Cross-Site Scripting Exploit (john@...tinelli.com)
c-arbre <= Multiple Remote File Include Vulnerablitiy (Mohandko@...il.com)
[SECURITY] [DSA 1279-1] New webcalendar packages fix cross-site scripting (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200704-18 ] Courier-IMAP: Remote execution of arbitrary code (Raphael Marichez <falco@...too.org>)
Remote file inclusion in Joomla 1.5.0 Beta ("Omid" <omid@...kers.ir>)
FLEA-2007-0013-1: xine-lib (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
bibtex mase Remote File Inclusion (InyeXion@...il.com)
FLEA-2007-0012-1: madwifi (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
WASC-Articles: 'The business case for security frameworks' (announcements@...appsec.org)
Big Blue Guestbook HTML Injection Vulnerabilities (seko@...ko.info)
3proxy 0.5.3i bugfix release (Vladimir Dubrovin <3APA3A@...URITY.NNOV.RU>)
TJSChat Version 0.95 Cross Site Scripting (the_3dit0r@...oo.com)
[ MDKSA-2007:092 ] - Updated freeradius packages fix vulnerability (security@...driva.com)
[ GLSA 200704-19 ] Blender: User-assisted remote execution of arbitrary code (Raphael Marichez <falco@...too.org>)
[security bulletin] HPSBUX02183 SSRT061243 rev.1 - HP-UX sendmail, Remote Denial of Service (DoS) (security-alert@...com)
[ MDKSA-2007:093 ] - Updated zziplib packages fix vulnerability (security@...driva.com)
RE: Yet another SQL injection framework ("Greg Merideth" <gmerideth@...nj.com>)
[ GLSA 200704-20 ] NAS: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
acvsws_php5_v1.0 <= Multiple Remote File Include Vulnerablitiy (Mohandko@...il.com)
DmCMS Shell Uploading (security@...or.net)
phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit (john@...tinelli.com)
Post Revolution Remote File Inclusion (InyeXion@...il.com)

April 24 (18 messages)

rPSA-2007-0081-1 postgresql postgresql-server (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200704-21 ] ClamAV: Multiple vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
gallery >> 1.5.6 Remote File Inclusion (s433d_only_linux@...oo.de)
Re: claroline <= Multiple Remote File Include Vulnerablitiy (BlackHawk <hawkgotyou@...il.com>)
ImageProcessing ... Local (Denial of Service Exploit) (Dr.Ninux@...mail.org)
Re: gallery >> 1.5.6 Remote File Inclusion (the.tiger100@...il.com)
Security Advisory: CA CleverPath SQL Injection ("Irene Abezgauz" <irene@...ktics.com>)
YA Book 0.98 Persistent XSS (omnipresent@...il.it)
Re: gallery >> 1.5.6 Remote File Inclusion (Chris Kelly <ckdake@...ake.com>)
[security bulletin] HPSBST02200 SSRT071330 rev.1 - HP StorageWorks Command View Advanced Edition for XP, Local Unauthorized Access (security-alert@...com)
Progress Webspeed exploit for all releases (suresync@...il.com)
[MajorSecurity Advisory #46]Plogger - Session fixation Issue (admin@...orsecurity.de)
[SECURITY] [DSA 1280-1] New aircrack-ng packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
3Com's TippingPoint Denial of Service (mike20061005@...mail.co.za)
Re: ImageProcessing ... Local (Denial of Service Exploit) (Tim Newsham <newsham@...a.net>)
dcp-portal v611 >> RFi (s433d_only_linux@...oo.de)
ZDI-07-022: CA BrightStor ArcServe Media Server Multiple Buffer Overflow Vulnerabilities (zdi-disclosures@...m.com)
Re: 3Com's TippingPoint Denial of Service (Simple Nomad <thegnome@...c.org>)

April 25 (27 messages)

Cisco Security Advisory: Default Passwords in NetFlow Collection Engine (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
MyNewsGroups >> RFI in include.php (alijsb@...oo.com)
HYIP Manager Pro Script >> Remote file Include (alijsb@...oo.com)
WordPress v2.1.3 >> remote file include~ (s433d_only_linux@...oo.de)
HTMLeditbox & 2.2 >> RFI (alijsb@...oo.com)
netbingo v 2000 >> RFI (alijsb@...oo.com)
DynaTracker &v151>> RFI (alijsb@...oo.com)
phpMYTGP v v1.4b >> RFI (alijsb@...oo.com)
sunshop v4 >> RFI (info@...kerz.ir)
Shop-Script v 2.0 >> RFI (alijsb@...oo.com)
adrevenue script (CyKuH.com)>> RFI (alijsb@...oo.com)
[SECURITY] [DSA 1281-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
B2 Weblog and News Publishing Tool v0.6.1 >> RFI (alijsb@...oo.com)
Searchactivity >> RFI (alijsb@...oo.com)
Built2Go_PHP_Link_Portal_v1.79 >> RFI (alijsb@...oo.com)
Re: 3Com's TippingPoint Denial of Service ("Steven M. Christey" <coley@...re.org>)
comus 2.0 Final >> RFI (alijsb@...oo.com)
blogsystem 1.4 >> local & remote = -rfi & lfi & -xss (info@...kerz.ir)
ASA-2007-010: Two stack buffer overflows in SIP channel's T.38 SDP parsing code ("Kevin P. Fleming" <kpfleming@...ium.com>)
nucleus 3.22 >> RFI (alijsb@...oo.com)
ASA-2007-011: Multiple problems in SIP channel parser handling response codes ("Kevin P. Fleming" <kpfleming@...ium.com>)
download engine V1.4.1 >> RFI (local) (alijsb@...oo.com)
Re: 3Com's TippingPoint Denial of Service (Secure@...m.com)
CFP: 3rd European Conference on Computer Network Defense (EC2ND) (Stefano Zanero <zanero@...t.polimi.it>)
Remote File Inclusion (s433d_only_linux@...oo.de)
VirtuaNews.Pro.v1.0.3.Retail.+All.Plugins Remote file Include (s433d_only_linux@...oo.de)
IE 7 and Firefox Browsers Digest Authentication Request Splitting (Stefano Di Paola <stefano.dipaola@...ec.it>)

April 26 (14 messages)

ASA-2007-012: Remote Crash Vulnerability in Manager Interface ("Kevin P. Fleming" <kpfleming@...ium.com>)
:doruk100net >> RFI (alijsb@...oo.com)
[CAID 35277]: CA CleverPath Portal SQL Injection Vulnerability ("Williams, James K" <James.Williams@...com>)
[USN-453-2] rdesktop regression (Martin Pitt <martin.pitt@...onical.com>)
[ MDKSA-2007:094 ] - Updated postgresql packages fix vulnerability (security@...driva.com)
[CAID 35198, 35276]: CA BrightStor ARCserve Backup Media Server Vulnerabilities ("Williams, James K" <James.Williams@...com>)
modbuild >> 4.1 Remote File Inclusion (s433d_only_linux@...oo.de)
Re: WordPress v2.1.3 >> remote file include~ (otto@...odestruct.com)
SineCMS (<nexus@...yhack.net>)
Re: Chicken of the VNC 2.0 remote DoS (support@...kspiff.com)
Burak Yılmaz Blog (tr) v1.0 SQL injection vulnerability (dj_remix_20@...mail.com)
Re: Steganos Encrypted Safe NOT so safe (support@...ganos.com)
[SECURITY] [DSA 1282-1] New php4 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
iDefense Security Advisory 04.26.07: Novell eDirectory NCP Fragment Denial of Service Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

April 27 (13 messages)

TSLSA-2007-0015 - postgresql (Trustix Security Advisor <tsl@...stix.org>)
FreeBSD Security Advisory FreeBSD-SA-07:03.ipv6 (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[USN-455-1] PHP vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-454-1] PostgreSQL vulnerability (Martin Pitt <martin.pitt@...onical.com>)
iDefense Security Advisory 04.26.07: Symantec Norton Ghost 10 Service Manager Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 04.26.07: Symantec Norton Ghost 10 Recovery Points Insecure Password Storage Vulnerability (iDefense Labs <labs-no-reply@...fense.co…)
Security Concerns in Web 2.0 (dharmeshmm@...il.com)
AFFLIB(TM): Time-of-Check-Time-of-Use File Race (VSR Advisories <advisories@...curity.com>)
AFFLIB(TM): Multiple Buffer Overflows (VSR Advisories <advisories@...curity.com>)
AFFLIB(TM): Multiple Format String Injections (VSR Advisories <advisories@...curity.com>)
AFFLIB(TM): Multiple Shell Metacharacter Injections (VSR Advisories <advisories@...curity.com>)
[ GLSA 200704-23 ] capi4k-utils: Buffer overflow (Raphael Marichez <falco@...too.org>)
[ GLSA 200704-22 ] BEAST: Denial of Service (Raphael Marichez <falco@...too.org>)

April 28 (2 messages)

Sphider Version 1.2.x (include_dir) file include (1one1@...eisbeginer.org)
Seir Anphin (file.php a[filepath]) Remote File Disclosure Vulnerability (ilkerkandemir@...et.com)

April 30 (13 messages)

Re: please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB" (Tim <tmorgan@...curity.com>)
Flaw in about.r OS and Progress version disclosure (suresync@...il.com)
please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB" (Simson Garfinkel <simsong@....org>)
[SECURITY] [DSA 1283-1] New php5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
GHH Portal 1.1 (passwd.txt) Remote Password Disclosure Vulnerability (crazy_king@...7.org)
3proxy[v0.5.3g]: (linux/win32 service) remote buffer overflow exploits. (v9 <v9@...ehalo.us>)
Re: GHH Portal 1.1 (passwd.txt) Remote Password Disclosure Vulnerability ("Jamie Riden" <jamie.riden@...il.com>)
iDefense Security Advisory 04.27.07: VMware Workstation Shared Folders Directory Traversal Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[security bulletin] HPSBMA02197 SSRT061285 rev.1 - HP-UX Running HP Power Manager Remote Agent (RA), Local Execution of Arbitrary Code wit… (security-alert@...com)
Re: Sphider Version 1.2.x (include_dir) file include (ijoo.keren@...il.com)
FLEA-2007-0014-1: vim (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
FLEA-2007-0015-1: gimp (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
E-Annu (home.php) Remote SQL Injection Vulnerability (ilkerkandemir@...et.com)

492 messages

Powered by blists - more mailing lists