bugtraq mailing list - 2007/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2007/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 19	² 9	³ 21	⁴ 17	⁵ 13	⁶ 12	⁷
⁸ 9	⁹ 36	¹⁰ 19	¹¹ 42	¹² 10	¹³ 8	¹⁴
¹⁵ 21	¹⁶ 20	¹⁷ 18	¹⁸ 25	¹⁹ 6	²⁰ 5	²¹
²² 21	²³ 23	²⁴ 12	²⁵ 22	²⁶ 6	²⁷ 2	²⁸
²⁹ 28	³⁰ 20	³¹ 12

Messages by day:

October 1 (19 messages)

Affiliate Network Pro Multiple Input Validation and Local file inclusion (hack2prison@...oo.com)
RE: feedreader3 has XSS vulnerability ("avivra" <avivra@...il.com>)
ASP Product catalog SQL injection vulnerability (joseph.giron13@...il.com)
[ GLSA 200709-18 ] Bugzilla: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
eGov Content Manager Cross Site Scripting Vulrnability (DoZ@...kersCenter.com)
phpBB Mod OpenID 0.2.0 BBStore.php Remote File Inclusion (h3llcode@...mail.it)
Re: OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow (snagg@...urenetwork.it)
CheckPoint Secure Platform Multiple Buffer Overflows (hvazquez@...test.es)
New Advisory: X-script GuestBook (m2x@...ox.ru)
smbftpd 0.96 format string vulnerability ("Jerry Illikainen" <jerry@...ork.se>)
Two buffer-overflow in FSD V2.052 d9 and FSFDT V3.000 d9 (Luigi Auriemma <aluigi@...istici.org>)
ASP-CMS version 1 default password location. (joseph.giron13@...il.com)
Unexploitable buffer-overflow in America's Army 2.8.2 through PB (Luigi Auriemma <aluigi@...istici.org>)
Format string in the Doom 3 engine through PB (Luigi Auriemma <aluigi@...istici.org>)
Format string in F.E.A.R. 1.08 through PB (Luigi Auriemma <aluigi@...istici.org>)
Re: phpBB Mod OpenID 0.2.0 BBStore.php Remote File Inclusion (str0ke <str0ke@...w0rm.com>)
ClubHack - CFP closing by 15th October 2007 ("`ClubHack `" <seclist@...bhack.com>)
Immunity Debugger v1.2 Release (Nicolas Waisman <nicolas.waisman@...unityinc.com>)
[ MDKSA-2007:191 ] - Updated libsndfile packages fix vulnerability (security@...driva.com)

October 2 (9 messages)

[ MDKSA-2007:192 ] - Updated mplayer packages fix vulnerability (security@...driva.com)
WifiZoo v1.2 release ("Hernan Ochoa" <hernan@...il.com>)
[SECURITY] [DSA 1365-3] New id3lib3.8.3 packages fix denial of service (dann frazier <dannf@...ian.org>)
Re: CheckPoint Secure Platform Multiple Buffer Overflows (hvazquez@...test.es)
Original Photo Gallery Remote Command Execution (ascii <ascii@...amail.com>)
Re: dvddb-0.6 media sql-inj. vuln. (james@...balmegacorp.org)
[SECURITY] [DSA 1379-1] New openssl packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
TPTI-07-16: CA BrightStor Hierarchical Storage Manager Buffer Overflow Vulnerabilities (TSRT@...m.com)
TPTI-07-17: CA BrightStor Hierarchical Storage Manager SQL Injection Vulnerabilities (TSRT@...m.com)

October 3 (21 messages)

iDefense Security Advisory 10.02.07: Multiple Vendor X Font Server Multiple Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
rPSA-2007-0203-1 rmake rmake-proxy rmake-repos (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] [DSA 1380-1] New elinks packages fix information disclosure (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1381-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
FLEA-2007-0057-1 pidgin (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[SECURITY] [DSA 1379-1] New quagga packages fix denial of service (Steve Kemp <skx@...ian.org>)
iDefense Security Advisory 10.02.07: Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
RE: CheckPoint Secure Platform Multiple Buffer Overflows ("Tony Reusser" <treusser@...ertel.com>)
0day: mIRC pwns Windows (jinc4fareijj@...mail.com)
International Hacking & Security Conference "POC200" (poc2007@...il.com)
RE: CheckPoint Secure Platform Multiple Buffer Overflows (Hugo van der Kooij <hvdkooij@...derkooij.org>)
Re: Ruby Net::HTTPS library does not validate server certificate CN (Thomas <tom@...ctric-sheep.org>)
Re: BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer) (sathyakrishnadas@...il.com)
DRBGuestbook Remote XSS Vulnerability (gokhankaya@...mail.com)
rPSA-2007-0204-1 qt-x11-free (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0205-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (rPath Update Announcements <announce-noreply@...th.com>)
Re: 0day: mIRC pwns Windows ("Gavin Hanover" <netmunky@...il.com>)
rPSA-2007-0206-1 openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
Re: 0day: mIRC pwns Windows ("Gregory Rubin" <grrubin@...il.com>)
Content Builder 0.7.5 RFI Bug (mehrad1989@...il.com)
FreeBSD Security Advisory FreeBSD-SA-07:08.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)

October 4 (17 messages)

FLEA-2007-0058-1 openssl openssl-scripts (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[RISE-2007003] Firebird Relational Database Multiple Buffer Overflow Vulnerabilities (RISE Security <advisories@...esecurity.org>)
Re[2]: 0day: mIRC pwns Windows (3APA3A <3APA3A@...URITY.NNOV.RU>)
Cart32 Arbitrary File Download Vulnerability ("Paul Craig" <paul.craig@...urity-assessment.com>)
[RISE-2007002] Borland InterBase Multiple Buffer Overflow Vulnerabilities (RISE Security <advisories@...esecurity.org>)
Re: Two buffer-overflow in FSD V2.052 d9 and FSFDT V3.000 d9[EXPLOIT] (weak@...glab.at)
[USN-523-1] ImageMagick vulnerabilities (Kees Cook <kees@...ntu.com>)
FLEA-2007-0059-1 qt qt-tools (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Re: 0day: mIRC pwns Windows (Greg Rubin <grrubin@...il.com>)
Re: iDefense Security Advisory 10.02.07: Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow (ejc@...usandplaces.org)
Re: 0day: mIRC pwns Windows ("Fred Elliot" <thevorsoth@...glemail.com>)
Re: iDefense Security Advisory 10.02.07: Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Re[2]: 0day: mIRC pwns Windows ("Gavin Hanover" <netmunky@...il.com>)
[Aria-Security] Stuffed Tracker Multiple Cross-Site Scripting VULN (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
[ GLSA 200710-01 ] RPCSEC_GSS library: Buffer overflow (Pierre-Yves Rofes <py@...too.org>)
DDIVRT-2007-05 NetSupport Manager Client Buffer Overflow (vulnerabilityresearch@...italdefense.net)

October 5 (13 messages)

[USN-525-1] libsndfile vulnerability (Kees Cook <kees@...ntu.com>)
[USN-526-1] debian-goodies vulnerability (Kees Cook <kees@...ntu.com>)
URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Juergen Schmidt <ju@...sec.de>)
[ MDKSA-2007:193 ] - Updated openssl packages fix vulnerabilities (security@...driva.com)
[USN-524-1] OpenOffice.org vulnerability (Kees Cook <kees@...ntu.com>)
rPSA-2007-0209-1 elinks (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] [DSA 1383-1] New gforge packages fix cross-site scripting (Thijs Kinkhorst <thijs@...ian.org>)
Multiple vulnerabilities in Dropteam 1.3.3 (Luigi Auriemma <aluigi@...istici.org>)
Re: Re: file upload vulnerability in joomla media component (vinodsharma.mimit@...il.com)
Reporting Vulnerable Public Web mail (ivan.sanchez@...lcode.com.ar)
Format string in The Dawn of Time 1.69s beta4 (Luigi Auriemma <aluigi@...istici.org>)
RE: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype ("Roger A. Grimes" <roger@...neretcs.com>)
[SECURITY] [DSA 1384-1] New xen-utils packages fix several vulnerabilities (Steve Kemp <skx@...ian.org>)

October 6 (12 messages)

[Aria-Security] Stuffed Tracker Multiple Cross-Site Scripting VULN (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
Re: BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer) (Amit Klein <aksecurity@...il.com>)
RE: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Juergen Schmidt <ju@...sec.de>)
Re[2]: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Thierry Zoller <Thierry@...ler.lu>)
SSHatter 0.6 (Tim Brown <timb@...-dimension.org.uk>)
Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Thierry Zoller <Thierry@...ler.lu>)
CMS Creamotion - Remote File inclusion (security@...or.net)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype ("Geo." <geoincidents@....net>)
Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype (Thierry Zoller <Thierry@...ler.lu>)
idmos-phoenix cms Remote File inclusion (security@...or.net)
Else If cms Multiple Remote vulnerabilities (security@...or.net)
Re: Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype ("Kurt Dillard" <kurtdillard@....com>)

October 8 (9 messages)

[SECURITY] [DSA 1362-2] New lighttpd packages fix buffer overflow (Steve Kemp <skx@...ian.org>)
[ GLSA 200710-04 ] libsndfile: Buffer overflow (Raphael Marichez <falco@...too.org>)
[ GLSA 200710-07 ] Tk: Buffer overflow (Raphael Marichez <falco@...too.org>)
[ GLSA 200710-03 ] libvorbis: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200710-05 ] QGit: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)
new vuln in snewscms.net.ru in lang file (info@...consultation.ru)
[ GLSA 200710-02 ] PHP: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200710-06 ] OpenSSL: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
TorrentTrader Classic Mutiple Remote vulnerabilities (security@...or.net)

October 9 (36 messages)

rPSA-2007-0210-1 xen (rPath Update Announcements <announce-noreply@...th.com>)
[security bulletin] HPSBUX02262 SSRT071447 rev. 1 - HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS) (security-alert@...com)
[security bulletin] HPSBUX01137 SSRT5954 rev.11 - HP-UX Running TCP/IP (IPv4), Remote Denial of Service (DoS) (security-alert@...com)
BT Home Flub: Pwnin the BT Home Hub ("Adrian P" <unknown.pentester@...il.com>)
[security bulletin] HPSBUX02181 SSRT061289 rev.3 - HP-UX Running IPFilter, Remote Denial of Service (DoS) (security-alert@...com)
Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Thierry Zoller <Thierry@...ler.lu>)
[security bulletin] HPSBMA02274 SSRT071445 rev.1 - HP System Management Homepage (SMH) for HP-UX, Remote Cross Site Scripting (XSS) (security-alert@...com)
Re[3]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype (3APA3A <3APA3A@...URITY.NNOV.RU>)
[security bulletin] HPSBMA02275 SSRT071445 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting … (security-alert@...com)
Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Andreas Lindenblatt <azrael@...ution.de>)
Black Hat Tokyo + DC and Europe CfPs now open. (Jeff Moss <jmoss@...ckhat.com>)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype ("Geo." <geoincidents@....net>)
Viart Shopping Cart Directory Transversal Vuln (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
RE: Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype ("Roger A. Grimes" <roger@...neretcs.com>)
rPSA-2007-0212-1 util-linux (rPath Update Announcements <announce-noreply@...th.com>)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype ("Geo." <geoincidents@....net>)
Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Andreas Lindenblatt <azrael@...ution.de>)
DNewsWeb Softwares Cross Site Scripting Vulrnability (DoZ@...kersCenter.com)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype ("Morning Wood" <se_cur_ity@...mail.com>)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype ("KJK::Hyperion" <hackbunny@...tpj.org>)
Vulnerabilities (xoxland@...il.com)
LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues ("Chris Travers" <chris.travers@...il.com>)
Research: Cybercrime and the Electoral System ("Oliver Friedrichs" <oliver_friedrichs@...antec.com>)
RE: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype ("Brett Moore" <brett.moore@...omniasec.com>)
Re: Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype (Glynn Clements <glynn@...ements.plus.com>)
[USN-527-1] xen-3.0 vulnerability (Kees Cook <kees@...ntu.com>)
RE: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype ("Jim Slora" <Jim.Slora@...a.com>)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype ("Geo." <geoincidents@....net>)
NULL pointer crash in World in Conflict 1.000 (Luigi Auriemma <aluigi@...istici.org>)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Valdis.Kletnieks@...edu)
iDefense Security Advisory 10.09.07: Microsoft Windows Mail and Outlook Express NNTP Protocol Heap Overflow (iDefense Labs <labs-no-reply@...fense.com>)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype ("KJK::Hyperion" <hackbunny@...tpj.org>)
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype (gjgowey@....blackberry.net)
The Death of Defence in Depth ? - An invitation to Hack.lu (Thierry Zoller <Thierry@...ler.lu>)
[ GLSA 200710-09 ] NX 2.1: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200710-08 ] KOffice, KWord, KPDF, KDE Graphics Libraries: Stack-based buffer overflow (Pierre-Yves Rofes <py@...too.org>)

October 10 (19 messages)

Regarding vulnerability in ViArt Shop (support@...rt.com)
3Com WIFI router remote administration vulnerability. ("Guy Mizrahi" <guy@...king.org.il>)
wmtrssreader joomla component 1.0 Remote File Include Vulnerability (cyber-crime@...ersavascilar.com)
Remote Desktop Command Fixation Attacks ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Several vulnerabilities in CMS Made Simple 1.1.3.1 ("Omid" <omid@...kers.ir>)
Re: iDefense Security Advisory 10.09.07: Microsoft Windows Mail and Outlook Express NNTP Protocol Heap Overflow (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques (Damir Rajnovic <gaus@...co.com>)
0day: Hacking secured CITRIX from outside ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Cisco Security Advisory: Cisco Wireless Control System Conversion Utility Adds Default Password (Cisco Systems Product Security Incident Response Team <psirt@ci…)
[SECURITY] [DSA 1379-2] New openssl packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
Vulnerabilities digest (3APA3A <3APA3A@...URITY.NNOV.RU>)
iDefense Security Advisory 10.10.07: Kaspersky Web Scanner ActiveX Format String Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Remote Desktop Command Fixation Attacks (Steve Shockley <steve.shockley@...ckley.net>)
AST-2007-022: Buffer overflows in voicemail when using IMAP storage (The Asterisk Development Team <asteriskteam@...ium.com>)
Re: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques ("Halvar Flake" <halvar.flake@...re-security.com>)
ZDI-07-055: Microsoft Windows DCERPC Authentication Denial of Service Vulnerability (zdi-disclosures@...m.com)
ZDI-07-056: IBM DB2 DB2JDS Multiple Vulnerabilities (zdi-disclosures@...m.com)
RE: Remote Desktop Command Fixation Attacks ("Thor (Hammer of God)" <thor@...merofgod.com>)
TPTI-07-18: EMC RepliStor Server Heap Overflow Vulnerability (TSRT@...m.com)

October 11 (42 messages)

[ELEYTT] 10PAZDZIERNIK2007 ("Michal Bucko" <michal.bucko@...ytt.com>)
ZDI-07-057: Firebird process_packet() Remote Stack Overflow Vulnerability (zdi-disclosures@...m.com)
IRM Advisory: Cisco IOS LPD Remote Stack Overflow ("Andy Davis" <andy.davis@...plc.com>)
URI handling as the harbinger of interaction errors ("Steven M. Christey" <coley@...re.org>)
RE: Remote Desktop Command Fixation Attacks ("M. Burnett" <mb@...o.net>)
Fwd: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype (merigoth@...il.com)
Re: [Full-disclosure] Remote Desktop Command Fixation Attacks (gboyce <gboyce@...belly.com>)
Re: [Full-disclosure] Remote Desktop Command Fixation Attacks ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
CORE-2007-0928: Stack-based buffer overflow vulnerability in OpenBSD’s DHCP server (Core Security Technologies Advisories <advisories@...esecurity.com>)
[ MDKSA-2007:194 ] - Updated libvorbis packages fix vulnerabilities (security@...driva.com)
October Microsoft Tuesday (Todd Manning <sflist@...italoffense.net>)
RE: [Full-disclosure] Remote Desktop Command Fixation Attacks ("Paul Melson" <pmelson@...il.com>)
M$ will fix URI? ("Memisyazici, Aras" <arasm@...edu>)
Re: RE: CheckPoint Secure Platform Multiple Buffer Overflows (fwadmin@...org.com)
Re: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques ("Halvar Flake" <halvar.flake@...re-security.com>)
Re: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques (Florian Weimer <fw@...eb.enyo.de>)
Re: [Full-disclosure] Remote Desktop Command Fixation Attacks (gjgowey@....blackberry.net)
Joomla! swMenuFree 4.6 Component Remote File Include (Guns@...0.com.ar)
Black Hat Tokyo + DC and Europe CfPs now open. (Jeff Moss <jmoss@...ckhat.com>)
Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype (Thierry Zoller <Thierry@...ler.lu>)
Re: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques ("Halvar Flake" <halvar.flake@...re-security.com>)
Re: Vulnerabilities (sottwell@...twell.com)
Re: [Full-disclosure] The Death of Defence in Depth ? - An invitation to Hack.lu ("Felix 'FX' Lindner" <fx@...urity-labs.com>)
RE: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques ("Andy Davis" <andy.davis@...plc.com>)
Re: Vulnerabilities (Victor Brilon <victor@...torland.com>)
Re: URI handling as the harbinger of interaction errors (Florian Weimer <fw@...eb.enyo.de>)
RE: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques ("Andy Davis" <andy.davis@...plc.com>)
Re: Remote Desktop Command Fixation Attacks ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
[security bulletin] HPSBUX02273 SSRT071476 rev. 1 - HP-UX running Apache, Remote Unauthorized Denial of Service (DoS) (security-alert@...com)
CA BrightStor ARCServe BackUp Message Engine Remote Stack Overflow Vulnerability ("hfli" <hfli@...tinet.com>)
[USN-528-1] MySQL vulnerabilities (Kees Cook <kees@...ntu.com>)
EEYE: CA BrightStor ArcServe Backup Server Arbitrary Pointer Dereference ("eEye Advisories" <eEyeAdvisories@...e.com>)
Re: Remote Desktop Command Fixation Attacks ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
iDefense Security Advisory 10.11.07: Multiple Vendor FLAC Library Multiple Integer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
[security bulletin] HPSBMA02230 SSRT071436 rev.1 - HP Select Identity, Remote Unauthorized Access (security-alert@...com)
[USN-529-1] Tk vulnerability (Kees Cook <kees@...ntu.com>)
Re: URI handling woes in Acrobat Reader, Netscape,Miranda, Skype (Thierry Zoller <Thierry@...ler.lu>)
S21SEC-037-en: OPAL SIP Protocol Remote Denial of Service (S21sec Labs <labs@...sec.com>)
[CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
RE: Remote Desktop Command Fixation Attacks (Jim Harrison <Jim@...tools.org>)
rPSA-2007-0214-1 initscripts (rPath Update Announcements <announce-noreply@...th.com>)
Tikiwiki 1.9.8 exploit ITW (Moritz Naumann <security@...itz-naumann.com>)

October 12 (10 messages)

Re: Joomla! swMenuFree 4.6 Component Remote File Include (sean@...enupro.com)
Re: Tikiwiki 1.9.8 exploit ITW (3APA3A <3APA3A@...URITY.NNOV.RU>)
OpenSSL Security Advisory (Ben Laurie <ben@...ks.org>)
SEC Consult SA-20071012-0 :: Madwifi xrates element remote DOS (Bernhard Mueller <research@...-consult.com>)
Re: Remote Desktop Command Fixation Attacks (hvdkooij@...derkooij.org)
Re: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques (Roman Medina-Heigl Hernandez <roman@...labs.com>)
RE: [Full-disclosure] Remote Desktop Command Fixation Attacks ("Pete Simpson" <Pete.Simpson@...arswift.com>)
RE: Remote Desktop Command Fixation Attacks ("Thor (Hammer of God)" <thor@...merofgod.com>)
[USN-530-1] hplip vulnerability (Kees Cook <kees@...ntu.com>)
Re: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques ("Mark Senior" <senatorfrog@...il.com>)

October 13 (8 messages)

[ GLSA 200710-11 ] X Font Server: Multiple Vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200710-13 ] Ampache: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1381-2] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
[ GLSA 200710-14 ] DenyHosts: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200710-10 ] SKK Tools: Insecure temporary file creation (Raphael Marichez <falco@...too.org>)
VImpX ActiveX (VImpX.ocx v. 4.7.3.0) Remote (saw_xyz@...oo.com)
[ GLSA 200710-12 ] T1Lib: Buffer overflow (Pierre-Yves Rofes <py@...too.org>)
playing for fun with <=IE7 (laurent.gaffie@...il.com)

October 15 (21 messages)

Clients buffer-overflow in Live for Speed 0.5X10 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 1386-2] New wesnoth packages fix denial of service (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1386-1] New wesnoth packages fix denial of service (joey@...odrom.org (Martin Schulze))
[ GLSA 200710-16 ] X.Org X server: Composite local privilege escalation (Pierre-Yves Rofes <py@...too.org>)
RE: [Full-disclosure] Remote Desktop Command Fixation Attacks ("Alex Everett" <alex.everett@....edu>)
Re: [Full-disclosure] Remote Desktop Command Fixation Attacks (gjgowey@....blackberry.net)
Re: [Full-disclosure] Tikiwiki 1.9.8 exploit ITW (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: Remote Desktop Command Fixation Attacks ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
RE: playing for fun with <=IE7 ("James C. Slora Jr." <james.slora@...a.com>)
SYMSA-2007-010: Microsoft ActiveSync 4.x Weak Password Obfuscation (research@...antec.com)
InnovaShop® (mgs.jps) Cross Siting Scripting (jose luis góngora fernández <sys-project@...mail.com>)
Stringbeans (Portal) - Lang Parameter Cross-Site Scripting Vulnerability (jose luis góngora fernández <sys-project@...mail.com>)
Third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling) available ("KJK::Hyperion" <hackbunny@...tpj.org>)
Re: [Full-disclosure] Remote Desktop Command Fixation Attacks ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
RE: playing for fun with <=IE7 ("Roger A. Grimes" <roger@...neretcs.com>)
Xcomputer - Lang Parameter Cross-Site Scripting Vulnerability (jose luis góngora fernández <sys-project@...mail.com>)
[SECURITY] [DSA 1387-1] New librpcsecgss packages fix arbitrary code execution (Florian Weimer <fw@...eb.enyo.de>)
[ GLSA 200710-15 ] KDM: Local privilege escalation (Pierre-Yves Rofes <py@...too.org>)
eXtremail(ly easy) remote roots (mu-b <mu-b@...it-labs.org>)
HTML Injection Vuln in nssboard (kcghost@...il.com)
Re: RE: playing for fun with <=IE7 (jason.gerfen@...il.com)

October 16 (20 messages)

CVE-2007-4600 - Mathcad Protect Worksheet Vulnerability (bugtraq@...ewraith.co.uk)
about phpMyAdmin setup.php XSS vulnerability (Marc Delisle <Marc.Delisle@...epsherbrooke.qc.ca>)
RE: playing for fun with <=IE7 ("avivra" <avivra@...il.com>)
IRM Vendor Alerts: Six critical remote vulnerabilities in TIBCO SmartPGM FX ("Andy Davis" <andy.davis@...plc.com>)
FW: [Dailydave] Canada's Response to Black Hat - SecTor 2007 ("Taylor, Gord" <gord.taylor@....com>)
WWWISIS <= 7.1 (IsisScript) Multiple Vulnerabilities (jose luis góngora fernández <sys-project@...mail.com>)
[ MDKSA-2007:198 ] - Updated util-linux packages fix vulnerability (security@...driva.com)
Secunia Research: IrfanView Palette File Importing Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
SSH attacks - anyone else seen these? (Tim <secnews@...r1t.de>)
[security bulletin] HPSBMA02230 SSRT071436 rev.2 - HP Select Identity, Remote Unauthorized Access (security-alert@...com)
[security bulletin] HPSBST02280 SSRT071480 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-055 to MS07-060 (security-alert@...com)
[ MDKSA-2007:197 ] - Updated tar packages prevent buffer overflow (security@...driva.com)
[security bulletin] HPSBTU02276 SSRT071472 rev.1 - HP Tru64 UNIX Running Apache Tomcat, Remote Unauthorized Access, Remote Denial of Servi… (security-alert@...com)
[ MDKSA-2007:196 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)
[security bulletin] HPSBUX02277 SSRT071453 rev.1 - HP-UX Running OpenSSL, Local Denial of Service (DoS) (security-alert@...com)
RE: Cisco PSIRT response on IRM Demonstrates Multiple Cisco IOS Exploitation Techniques ("Andy Davis" <andy.davis@...plc.com>)
Re: SSH attacks - anyone else seen these? (Gayathri Swaminathan <gayathri@...edu>)
Re: SSH attacks - anyone else seen these? ("Mark R. Bowyer" <Mark.Bowyer@....COM>)
[ MDKSA-2007:195 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)
Re: SSH attacks - anyone else seen these? (Jose Nazario <jose@...key.org>)

October 17 (18 messages)

[ GLSA 200710-17 ] Balsa: Buffer overflow (Raphael Marichez <falco@...too.org>)
Multiple CSRF in SimplePHPBlog (deme@...kish.eu)
Multiple SQL Injection Flaws in Oracle CTX_DOC package ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Oracle RDBMS TNS Data packet DoS ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Oracle TNS Listener DoS and/or remote memory inspection ("NGSSoftware Insight Security Research" <nisr@...software.com>)
AST-2007-023 - SQL Injection Vulnerabilty in cdr_addon_mysql (Asterisk Security Team <security@...erisk.org>)
Oracle audit issue with XMLDB ftp service ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Re: RE: CheckPoint Secure Platform Multiple Buffer Overflows (hvazquez@...test.es)
Re: Third-party patch for CVE-2007-3896, UPDATE NOW ("KJK::Hyperion" <hackbunny@...tpj.org>)
Cisco Security Advisory: Multiple Vulnerabilities in Firewall Services Module (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: SSH attacks - anyone else seen these? (James Lay <jlay@...ve-tothe-box.net>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco PIX and ASA Appliances (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Unified Communications Web-based Management Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Re: Netgear FVG318 is vunerable to DOS attack (NetGear@...nbergers.plus.com)
SQL Injection Flaw in Oracle Workspace Manager ("David Litchfield" <davidl@...software.com>)
Re: SSH attacks - anyone else seen these? (pand0ra <pand0ra.usa@...il.com>)
[ MDKSA-2007:199 ] - Updated phpMyAdmin packages fix multiple vulnerabilities (security@...driva.com)
SYMSA-2007-011: Microsoft WM5 PocketPC Phone Ed SMS Handler Issue (research@...antec.com)

October 18 (25 messages)

Microsoft Windows XP/2003 Macrovision SecDrv.sys privilege escalation (0day) (Reversemode <advisories@...ersemode.com>)
Nortel UNIStim IP Softphone Buffer-Overflow (daniel.stirnimann@...c.ch)
Nortel IP Phone Surveillance Mode (daniel.stirnimann@...c.ch)
Nortel IP Phone Flooding Denial of Service (daniel.stirniman@...c.ch)
Latest web hacking incidents ("Ofer Shezaf" <OferS@...ach.com>)
Nortel Telephony Server Denial of Service (daniel.stirnimann@...c.ch)
[SECURITY] [DSA 1388-1] New dhcp packages fix arbitrary code execution (Steve Kemp <skx@...ian.org>)
[security bulletin] HPSBUX02273 SSRT071476 rev.2 - HP-UX Running Apache, Remote Unauthorized Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBMA02274 SSRT071445 rev.2 - HP System Management Homepage (SMH) for HP-UX, Remote Cross Site Scripting (XSS) (security-alert@...com)
[CORRECTED] Microsoft Windows XP SP2/2003 - Macrovision SecDrv.sys privilege escalation (0day) (Reversemode <advisories@...ersemode.com>)
CFP C H A S E - 2 0 0 7 Lahore Pakistan (chase <lists@...se.org.pk>)
Re: SSH attacks - anyone else seen these? (Tim <secnews@...r1t.de>)
Re: Multiple CSRF in SimplePHPBlog ("Hanno Böck" <ml@...eck.de>)
Re[2]: [Full-disclosure] The Death of Defence in Depth ? - An invitation to Hack.lu (Thierry Zoller <Thierry@...ler.lu>)
rPSA-2007-0219-1 libpng (rPath Update Announcements <announce-noreply@...th.com>)
Nortel IP Phone forced re-authentication (daniel.stirnimann@...c.ch)
[SECURITY] [DSA 1389-1] New zoph packages fix SQL injection (Moritz Muehlenhoff <jmm@...ian.org>)
Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Softwin's anti-virus BitDefender contains vulnerable zlib (CA-2007-07) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Official Windows binaries of "curl" contain vulnerable zlib 1.2.2 (CAN-2005-2096) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Serious holes affecting SiteBar 3.3.8 (Tim Brown <timb@...-dimension.org.uk>)
[ GLSA 200710-18 ] util-linux: Local privilege escalation (Raphael Marichez <falco@...too.org>)
[ GLSA 200710-19 ] The Sleuth Kit: Integer underflow (Raphael Marichez <falco@...too.org>)
S21SEC-038-en: Alcatel Omnivista 4760 Cross-Site Scripting (S21sec Labs <labs@...sec.com>)
[ MDKSA-2007:200 ] - Updated tk packages fix vulnerabilities (security@...driva.com)

October 19 (6 messages)

[ GLSA 200710-20 ] PDFKit, ImageKits: Buffer overflow (Raphael Marichez <falco@...too.org>)
rPSA-2007-0220-1 ImageMagick (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] [DSA 1390-1] New t1lib packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
A-Cart SQL Injection And Cross-Site Scripting (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
[CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability ("Williams, James K" <James.Williams@...com>)
[SECURITY] [DSA 1391-1] New icedove packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)

October 20 (5 messages)

[Aria-Security.Net] SearchSimon Lite Cross-Site Scripting Vuln. (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
[SECURITY] [DSA 1392-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) (farion42@...oo.de)
Simple Machines Forum multiple sql injection flaws with exploit code. (th3.r00k.spammenot@...il.com)
ReloadCMS Vulnerable (sekuru@...il.ua)

October 22 (21 messages)

[ GLSA 200710-21 ] TikiWiki: Arbitrary command execution (Raphael Marichez <falco@...too.org>)
[ GLSA 200710-22 ] TRAMP: Insecure temporary file creation (Raphael Marichez <falco@...too.org>)
Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
PacSec 2007 Agenda (Tokyo 11-29/30) (Dragos Ruiu <dr@....net>)
[Aria-Security.Net] dmcms.0.7.0 SQL Injection (Advisory@...a-Security.net, "[No Reply]"@securityfocus.com)
Simple PHP Blog (sphpblog) <= 0.5.1 Multiple Vulnerabilities (gmdarkfig@...il.com)
[ELEYTT] Public Advisory 20-10-2007 ("Michal Bucko" <michal.bucko@...ytt.com>)
[USN-532-1] nagios-plugins vulnerability (Kees Cook <kees@...ntu.com>)
[USN-534-1] OpenSSL vulnerability (Kees Cook <kees@...ntu.com>)
Cracking the iPhone (5 article series) (H D Moore <sflist@...italoffense.net>)
[USN-533-1] util-linux vulnerability (Kees Cook <kees@...ntu.com>)
Folder Access bypass (hack2prison@...oo.com)
simple dns rebinding protection with dnsmasq ("Collin R. Mulliner" <collin@...aversion.net>)
[USN-531-1] dhcp vulnerability (Kees Cook <kees@...ntu.com>)
[TOOL] w3af - Web Application Attack and Audit Framework ("Andres Riancho" <andres.riancho@...il.com>)
Hackish XSS in shoutbox/blocco.php (deme@...kish.eu)
Jeebles Directory Local File Inclusion (hack2prison@...oo.com)
Camino release 1.5.2 fixes several vulnerabilities (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ GLSA 200710-23 ] Star: Directory traversal vulnerability (Raphael Marichez <falco@...too.org>)
Corsaire Security Advisory - Citrix Access Gateway session ID disclosure issue ("advisories" <advisories@...saire.com>)
[USN-501-2] Ghostscript vulnerability (Kees Cook <kees@...ntu.com>)

October 23 (23 messages)

[ MDKSA-2007:201 ] - Updated hplip packages fix vulnerabilities (security@...driva.com)
[USN-535-1] Firefox vulnerabilities (Kees Cook <kees@...ntu.com>)
CFP for HITBSecConf2008 - Dubai now open (Praburaajan <prabu@...kinthebox.org>)
[ GLSA 200710-24 ] OpenOffice.org: Heap-based buffer overflow (Raphael Marichez <falco@...too.org>)
Airscanner Mobile Security Advisory #07101401: Mobile-spy Victim/User Phone/SMS/URL Log Spoofing and Persistent XSS Injection (Seth Fogie <seth@...scanner.com>)
[vuln.sg] IBM Lotus Notes Attachment Viewer Buffer Overflow Vulnerabilities (vulnpost-remove@...n.sg)
SYMSA-2007-012: Microsoft Windows CE IGMP Denial of Service (research@...antec.com)
[Vulz] Seeblick 1.0 Beta File Upload Vulz (pete.houston.17187@...il.com)
[Vulz] Japanese PHP Gallery Hosting File Upload Vulz (pete.houston.17187@...il.com)
[Vulz] eLouai's Download Script Remote File Download Vulnerability (pete.houston.17187@...il.com)
[Vulz] eFileMan 7.x Multiple Vulnerabilities by Xcross87 (pete.houston.17187@...il.com)
[ MDKSA-2007:202 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
Korean GHBoard Multiple Vulnerabilities by Xcross87 (pete.houston.17187@...il.com)
[Vulz] PHP Basic Multiple Vulnerabilities by Xcross87 & Alucar (pete.houston.17187@...il.com)
SYMSA-2007-013: Lotus Notes Memory Mapped Files Vulnerability (research@...antec.com)
[SECURITY] [DSA 1393-1] New xfce4-terminal packages fix arbitrary command execution (Steve Kemp <skx@...ian.org>)
3proxy 0.5.3j released (bugfix) (3APA3A <3APA3A@...URITY.NNOV.RU>)
[SECURITY] [DSA 1372-2] New ktorrent packages fix directory traversal (Steve Kemp <skx@...ian.org>)
[USN-531-2] dhcp vulnerability (Kees Cook <kees@...ntu.com>)
[Vulz] PHP Basic Multiple Vulnerabilities by Xcross87 & Alucar (<pete.houston.17187@...il.com>)
[USN-536-1] Thunderbird vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-537-1] gnome-screensaver vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1394-1] New reprepro packages fix authentication bypass (Thijs Kinkhorst <thijs@...ian.org>)

October 24 (12 messages)

Aria-Security.Net [Web based alpha tabbed address book SQL Injection] (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
HPSBMA02279 SSRT071298 rev.1 - HP OpenView Configuration Management (CM) Infrastructure (Radia) and Client Configuration Manager (CCM) Run… (security-alert@...com)
Aleris Software Systems Web Publisher Calendar SQL injection (Joseph.giron13@...il.com)
[Aria-Security.Net] CodeWidgets.Com Online Event Registration Multiple login SQL Injection (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
[GS07-02] RSA Keon Multiple Cross-Site Scripting Vulnerabilities (Fatih Ozavci <securitylists@...onita.gamasec.net>)
Novell OpenSUSE SWAMP multiple XSS (morin.josh@...il.com)
rPSA-2007-0222-1 cpio tar (rPath Update Announcements <announce-noreply@...th.com>)
Bosdev Multiple vulnerabilities (Joseph.giron13@...il.com)
OSI CODES - PHP Live! Remote File Inclusion (Advisory@...a-Security.Net, "[ NO REPLY ]"@securityfocus.com)
iDefense Security Advisory 10.23.07: IBM Lotus Domino IMAP Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.23.07: IBM Lotus Notes Client TagAttributeListCopy Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200710-25 ] MLDonkey: Privilege escalation (Raphael Marichez <falco@...too.org>)

October 25 (22 messages)

[ GLSA 200710-26 ] HPLIP: Privilege escalation (Raphael Marichez <falco@...too.org>)
[ GLSA 200710-27 ] ImageMagick: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
[SECURITY] [DSA 1389-2] New zoph packages fix SQL injection (Thijs Kinkhorst <thijs@...ian.org>)
Flatnuke3 Remote Cookie Manipoulation / Privilege Escalation (kingoftheworld92@...twebnet.it)
HPSBMA02133 SSRT061201 rev.6 - HP Oracle for OpenView (OfO) Critical Patch Update (security-alert@...com)
[SECURITY] [DSA 1395-1] New xen-utils packages fix file truncation (Steve Kemp <skx@...ian.org>)
rPSA-2007-0221-1 php php-mysql php-pgsql (rPath Update Announcements <announce-noreply@...th.com>)
Re: Re: RE: playing for fun with <=IE7 (laurent.gaffie@...il.com)
Re: A-Cart SQL Injection And Cross-Site Scripting (laurent.gaffie@...il.com)
i-Gallery 3.4 bug crack password! (hackerbinhphuoc@...oo.com)
First ever ModSecurity public training at OWASP/WASC conf in SJ ("Ofer Shezaf" <OferS@...ach.com>)
[PoC] DNS Recursion bandwidth amplification (Shadow <chemshadow@...il.com>)
iDefense Security Advisory 10.25.07: Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
usd250 helpdesk XSS vulnerabily. (Joseph.giron13@...il.com)
Directory traversal flaw in shttp ("digineo Advisories" <bugtraq@...ineo.co.uk>)
IRM Discover More Vulnerabilities in Cisco IOS ("Andy Davis" <andy.davis@...plc.com>)
TikiWiki <= 1.9.8.1 Cross Site Scripting / Local File Inclusion (L4teral <l4teral@...il.com>)
Multi Host Forum Pro phpbb & ipb Multiple Sql Injection (kingoftheworld92@...twebnet.it)
[Trick] VigileCMS All Versions DataMining Remote Hash Disclosure (kingoftheworld92@...twebnet.it)
[ GLSA 200710-28 ] Qt: Buffer overflow (Raphael Marichez <falco@...too.org>)
[USN-538-1] libpng vulnerabilities (Kees Cook <kees@...ntu.com>)
[ GLSA 200710-29 ] Sylpheed, Claws Mail: User-assisted remote execution of arbitrary code (Raphael Marichez <falco@...too.org>)

October 26 (6 messages)

RealNetworks RealPlayer/RealOne Player/Helix Player Remote Heap Corruption ("Piotr Bania" <bania.piotr@...il.com>)
Micro Login System v1.0 (userpwd.txt) Password Disclosure Vulnerability (Guns@...0.com.ar)
RealNetworks RealPlayer/RealOne Player/Helix Player Remote Memory Corruption ("Piotr Bania" <bania.piotr@...il.com>)
FLEA-2007-0060-1 initscripts (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Re: Novell OpenSUSE SWAMP multiple XSS (test@....com)
rPSA-2007-0225-1 firefox (rPath Update Announcements <announce-noreply@...th.com>)

October 27 (2 messages)

[SECURITY] [DSA 1396-1] New iceweasel packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-538-1] libpng vulnerabilities (Kees Cook <kees@...ntu.com>)

October 29 (28 messages)

Smart-Shop Shopping Cart Cross-Site Scripting Vulrnability (DoZ@...kersCenter.com)
teatro 1.6 ( basePath ) Remote File Include Vulnerability (alkomandoz-hacker@...mail.com)
[waraxe-2007-SA#059] - XSS in WordPress 2.3 (come2waraxe@...oo.com)
Webroot Desktop Firewall <=5.5.10.20 DNS recursion (komarov@...efence.ru)
Advisory SE-2007-01: TikiWiki Remote PHP Code Evaluation Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
Team SHATTER Alert: Oracle Database Buffer overflow vulnerability in function MDSYS.SDO_CS.TRANSFORM (Team SHATTER <shatter@...secinc.com>)
Team SHATTER Alert: Oracle Database Buffer overflow vulnerability in procedure DBMS_AQADM_SYS.DBLINK_INFO (Team SHATTER <shatter@...secinc.com>)
How to subvert Oracle Database Vault (Joxean Koret <joxeankoret@...oo.es>)
Final Call for Papers for Security Track at ApacheCon Europe 2008 (Lars Eilebrecht <lars@...che.org>)
FLEA-2007-0061-1 sun-jre sun-jdk (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
FLEA-2007-0062-1 firefox (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Omnistar Live Software Cross-Site Scripting Vulrnability (DoZ@...kersCenter.com)
Secunia Research: IBM Tivoli Storage Manager Client CAD Service Script Insertion (Secunia Research <remove-vuln@...unia.com>)
AGTC-Membership system v1.1a (adduser) Remote Add Admin Exploit (Guns@...0.com.ar)
Security Briefings (angelo@...iello.org)
SAXON version 5.4 XSS Attack Vulnerability (securityresearch@...vigilance.com)
SAXON version 5.4 Multiple Path Disclosure Vulnerabilities (securityresearch@...vigilance.com)
SAXON version 5.4 SQL Injection Vulnerability (securityresearch@...vigilance.com)
[SECURITY] [DSA 1388-3] New dhcp packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
rPSA-2007-0225-2 firefox thunderbird (rPath Update Announcements <announce-noreply@...th.com>)
Comments re ISC's announcement on bind9 security ("Network Protocol Security" <netprotosec@...il.com>)
Heap overflow in RealPlayer ID3 tag parser (NGSSoftware Insight Security Research <nisr@...software.com>)
Untrusted Java applet can connect to localhost (NGSSoftware Insight Security Research <nisr@...software.com>)
Memory overwrites in JVM via malformed TrueType font (NGSSoftware Insight Security Research <nisr@...software.com>)
Windows binary of "Virtual Floppy Drive 2.1" contains vulnerable zlib (CAN-2005-2096) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Holes in the firewall of Mac OS X Leopard (Juergen Schmidt <ju@...sec.de>)
Re: Holes in the firewall of Mac OS X Leopard ("Brandon S. Allbery KF8NH" <allbery@....cmu.edu>)

October 30 (20 messages)

RFIDIOt release - version 0.1q (Adam Laurie <adam@...roup.co.uk>)
Siebel Security Basics (Jonathan Katz <jon@...world.com>)
Secunia Research: IPSwitch IMail Server IMail Client Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Re: Holes in the firewall of Mac OS X Leopard (Juergen Schmidt <ju@...sec.de>)
Django 0.96 (stable) Admin Panel CSRF ("J. Carlos Nieto" <xiam@...m.be>)
Airkiosk/formlib application is XSS vuln (skienlab@...il.com)
DeepSec 2007 Registration: hurry up, seats are filling fast (Stefano Zanero <zanero@...t.polimi.it>)
iDefense Security Advisory 10.30.07: IBM AIX swcons Local Arbitrary File Access Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.30.07: IBM AIX dig dns_name_fromtext Integer Underflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.30.07: IBM AIX lqueryvg Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.30.07: IBM AIX 5.2 crontab BSS Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Firefox / IE6 crash on javascript nested loops (thabob <thabob@...il.com>)
iDefense Security Advisory 10.30.07: IBM AIX lquerypv Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.30.07: IBM AIX ftp domacro Parameter Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.30.07: IBM AIX bellmail Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Firefox / IE6 crash on javascript nested loops (Jan Heisterkamp <janheisterkamp@....de>)
[ GLSA 200710-31 ] Opera: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
ILIAS <= 3.8.3 Cross Site Scripting (L4teral <l4teral@...il.com>)
[ GLSA 200710-30 ] OpenSSL: Remote execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
In Memoriam: Jun-ichiro Hagino (Dragos Ruiu <dr@....net>)

October 31 (12 messages)

Secunia Research: CUPS IPP Tags Memory Corruption Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: McAfee E-Business Server Auth Packet Handling Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
SEC Consult SA-20071031-0 :: Perdition IMAP Proxy Format String Vulnerability (Bernhard Mueller <research@...-consult.com>)
Re: [gentoo-announce] [ GLSA 200710-30 ] OpenSSL: Remote execution of arbitrary code (Steffan Baron <sbaron@...n-source-consultants.de>)
Re: Comments re ISC's announcement on bind9 security (Shane Kerr <Shane_Kerr@....org>)
iDefense Security Advisory 10.31.07: Macrovision InstallShield Update Service ActiveX Unsafe Method Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 10.31.07: Symantec Altiris Deployment Solution TFTP/MTFTP Service Directory Traversal Vulner… (iDefense Labs <labs-no-reply@...fense.c…)
[security bulletin] HPSBMA02236 SSRT061260 rev.2 - HP OpenView Performance Manager (OVPM) Running Shared Trace Service on HP-UX, Solaris, … (security-alert@...com)
[security bulletin] HPSBMA02237 SSRT061260 rev.2 - HP OpenView Performance Agent (OVPA) Running Shared Trace Service, Remote Arbitrary Cod… (security-alert@...com)
[security bulletin] HPSBMA02238 SSRT061260 rev.2 - HP OpenView Reporter Running Shared Trace Service, Remote Arbitrary Code Execution (security-alert@...com)
(tool announcement) bunny the fuzzer (Michal Zalewski <lcamtuf@...ne.cc>)
rPSA-2007-0227-1 cups (rPath Update Announcements <announce-noreply@...th.com>)

456 messages

Powered by blists - more mailing lists