bugtraq mailing list - 2007/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2007/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 3	²
³ 15	⁴ 19	⁵ 23	⁶ 16	⁷ 19	⁸ 6	⁹
¹⁰ 38	¹¹ 18	¹² 11	¹³ 17	¹⁴ 8	¹⁵ 7	¹⁶
¹⁷ 18	¹⁸ 22	¹⁹ 11	²⁰ 14	²¹ 10	²² 6	²³
²⁴ 15	²⁵ 2	²⁶ 7	²⁷ 18	²⁸ 9	²⁹ 11	³⁰
³¹ 21

Messages by day:

December 1 (3 messages)

rPSA-2007-0255-1 nss_ldap (rPath Update Announcements <announce-noreply@...th.com>)
DC4420 - London DEFCON chapter Christmas Party - 11th December (Major Malfunction <majormal@...ate-radio.org>)
Realplayer 11 DOS attack when processing a malformed AU file on MS Vista and XP (thesinoda@...mail.com)

December 3 (15 messages)

PR06-08: BEA Plumtree portal internal hostname disclosure vulnerability (research@...checkup.com)
[SECURITY] [DSA 1417-1] New asterisk packages fix SQL injection (Moritz Muehlenhoff <jmm@...ian.org>)
PR06-11: BEA Plumtree portal search facility leaks usernames to unauthenticated users (research@...checkup.com)
[SECURITY] [DSA 1418-1] New cacti packages fix SQL injection (Thijs Kinkhorst <thijs@...ian.org>)
Re: SQL Injection in saphp "showcat.php" (security curmudgeon <jericho@...rition.org>)
[WhitePaper (SecNiche)] Information Prone LDAP Garbage Dumps ("AKS aka (0kn0ck)" <0kn0ck@...niche.org>)
sing (debian) vunlerability? (Milen Rangelov <mrangelov@...bul.bg>)
PR06-09: BEA Plumtree portal full version disclosure vulnerability (research@...checkup.com)
Lotfian Brochure and cataloge Script XSS And SQL Injection (noreply@...a-security.net)
Re: SQL Injection in SaphpLesson2.0 "show.php" (security curmudgeon <jericho@...rition.org>)
McAfee SecurityCenter Privacy Service HTML Execution Vulnerability (DoZ@...kersCenter.com)
Re: PR06-08: BEA Plumtree portal internal hostname disclosure vulnerability ("guiness.stout" <guinness.stout@...il.com>)
Fwd: PR06-08: BEA Plumtree portal internal hostname disclosure vulnerability (imipak <imipak@...il.com>)
SYMSA-2007-014: SQL Injection Vulnerability in Beehive Forum Software (research@...antec.com)
[USN-550-1] Cairo vulnerability (Kees Cook <kees@...ntu.com>)

December 4 (19 messages)

[MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard widgets (Thomas Roessler <tlr@...org>)
[USN-551-1] OpenLDAP vulnerabilities (Jamie Strandboge <jamie@...ntu.com>)
SEC Consult SA-20071204-0 :: SonicWALL Global VPN Client Format String Vulnerability (Bernhard Mueller <research@...-consult.com>)
[USN-549-2] PHP regression (Kees Cook <kees@...ntu.com>)
[ MDKSA-2007:235 ] - Updated apache packages fix vulnerabilities (security@...driva.com)
Snitz2000 SQL Injection: A user can gain admin level (admin@...report.ir)
[ MDKSA-2007:234 ] - Updated vixie-cron packages fix DoS vulnerability (security@...driva.com)
Re: [dns-operations] Web Proxy Auto-Discovery (WPAD) Information Disclosure (fwd) (Gadi Evron <ge@...uxbox.org>)
(Re-post) ATC-08 CFP (atc08@...lf.no)
The first release of SWFIntruder is out ! (Stefano Di Paola <stefano.dipaola@...dedsecurity.com>)
PR07-39: Multiple vulnerabilities on Absolute News Manager.NET 5.1 including file retrieval and SQL injection (research@...checkup.com)
[security bulletin] HPSBMA02293 SSRT071494 rev.1 - HP Select Identity, Remote Unauthorized Access (security-alert@...com)
Some more widgets: Facebook, Hockey, FlickrInterestingNess (Re: [MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard wid… (Thomas Roessler <tlr@...org>)
CORE-2007-1004: VLC Activex Bad Pointer Initialization Vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
Re: Powerschool 404 Admin Exposure (bob@...mail.com)
TIBCO Rendezvous Exploitation Video ("IRM Research" <research@...plc.com>)
RFI and Multiple XSS in PhpMyChat (beenudel1986@...il.com)
[USN-546-2] Firefox regression (Kees Cook <kees@...ntu.com>)
Re: sing (debian) vunlerability? (Moritz Muehlenhoff <jmm@...ian.org>)

December 5 (23 messages)

The recent number of unpatched QuickTime flaws is: two (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
rPSA-2007-0257-1 rsync (rPath Update Announcements <announce-noreply@...th.com>)
[ MDKSA-2007:236 ] - Updated openssh packages fix X11 cookie vulnerability (security@...driva.com)
[ MDKSA-2007:237 ] - Updated openssl packages fix DTLS vulnerability (security@...driva.com)
[USN-552-1] Perl vulnerability (Kees Cook <kees@...ntu.com>)
Blind Sql-Injection in Joomla 1.5 RC3 (beenudel1986@...il.com)
Re: 27Mhz based wireless security insecurities - Aka - "We know what you typed last summer" ("Michal Bucko" <michal.bucko@...ytt.com>)
Opera 9.50 beta and prior remote DoS (freeze) (gynvael@...illium.org)
[ECHO_ADV_86$2007] Mambo/Joomla Component rsgallery <= 2.0 beta 5 (catid) Remote SQL Injection Vulnerability (erdc@...o.or.id)
[USN-553-1] Mono vulnerability (Kees Cook <kees@...ntu.com>)
Sql Injection in wordpress 2.3.1 (beenudel1986@...il.com)
Advisory: Cross Site Scripting in CiscoWorks ("Liquidmatrix Security Digest" <disclosure@...uidmatrix.org>)
[SECURITY] [DSA 1419-1] New OpenOffice.org packages fix arbitrary Java code execution (joey@...odrom.org (Martin Schulze))
[ELEYTT] Public Advisory 05-12-2007 ("Michal Bucko" <michal.bucko@...ytt.com>)
[SECURITY] [DSA 1420-1] New zabbix packages fix privilege escalation (Thijs Kinkhorst <thijs@...ian.org>)
Cisco Security Advisory: Cisco Security Agent for Windows System Driver Remote Buffer Overflow Vulnerability (Cisco Systems Product Security Incident Response T…)
Re: Sql Injection in wordpress 2.3.1 (alan@...selogic.net)
Firefox 2.0.0.11 INPUT Denial Of Service (azizov@...efence.ru)
Re: Sql Injection in wordpress 2.3.1 (shino@...ux.homelinux.org)
[ GLSA 200712-02 ] Cacti: SQL injection (Pierre-Yves Rofes <py@...too.org>)
SineCMS <= 2.3.4 Calendar SQL Injection 'n something else.. (kingoftheworld92@...twebnet.it)
ezContents Version 1.4.5 Remote File Disclosure Vulnerability. (p4imi0 <p4imi0@...il.com>)
[ GLSA 200712-01 ] Hugin: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)

December 6 (16 messages)

Aria-Security.Net: PenPals Login and search page SQL Injection (no-reply@...a-Security.net)
Avast! AntiVirus TAR Processing Remote Heap Corruption (Sowhat <smaillist@...il.com>)
[security bulletin] HPSBMA02281 SSRT061261 rev.1 - HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Execution of Arbitrary Co… (security-alert@...com)
[UPDATE]CA BrightStor ARCServe BackUp Message Engine Remote Stack Overflow Vulnerability (cocoruder <cocoruder@...il.com>)
[SECURITY] [DSA 1421-1] New wesnoth packages fix arbitrary file disclosure (joey@...odrom.org (Martin Schulze))
NSFOCUS SA2007-02 : Cisco Security Agent Remote Buffer Overflow Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
SQUID-2007:2, Dec 4, 2007 (Adrian Chadd <adrian@...id-cache.org>)
Re: Re: Aria-Security.net: NetAuctionHelp SQL Injection (NetAuctionHelp Support <support@...auctionhelp.com>)
HITBSecConf2007 Malaysia Videos Now Available (Praburaajan <prabu@...kinthebox.org>)
[XSS] OpenNewsletter v2.5 Multipe XSS Attacks (bugtraq@...kprotocols.net)
UPDATE: [ GLSA 200711-29 ] Samba: Execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[Security Advisorie] OpenNewsletter v2.5 Multipe XSS Attacks (Sarasa <Intrabytes@...rabytes.com>)
[ MDKSA-2007:238 ] - Updated liblcms package fixes buffer overflow (security@...driva.com)
[USN-554-1] teTeX and TeX Live vulnerabilities (Jamie Strandboge <jamie@...ntu.com>)
ZDI-07-071: HP OpenView Network Node Manager Multiple CGI Buffer Overflows (zdi-disclosures@...m.com)
ZDI-07-070: Skype skype4com URI Handler Remote Heap Corruption Vulnerability (zdi-disclosures@...m.com)

December 7 (19 messages)

TCP Port randomization paper (Fernando Gont <fernando.gont@...il.com>)
[CAID 35724, 35725, 35726]: CA BrightStor ARCserve Backup Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Potential SQL injection vulnerability in Apache::AuthCAS (Matthias Bethke <matthias@...iski.de>)
[SECURITY] [DSA 1422-1] New e2fsprogs packages fix arbitrary code execution (Steve Kemp <skx@...ian.org>)
[ MDKSA-2007:239 ] - Updated heimdal packages fix potential vulnerability (security@...driva.com)
Re: RIG Image Gallery (dir_abs_src) Remote File Include Vulnerability (security curmudgeon <jericho@...rition.org>)
Re: Friend Script 2.5 - 2.4 Remote File İnclude (security curmudgeon <jericho@...rition.org>)
rPSA-2007-0260-1 firefox (rPath Update Announcements <announce-noreply@...th.com>)
Re: BellaBiblio Admin Login Bypass (security curmudgeon <jericho@...rition.org>)
[ISecAuditors Security Advisories] wwwstats is vulnerable to Persistent XSS (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Re: Phorm v3.0 Remote File Upload Vulnerability (security curmudgeon <jericho@...rition.org>)
R7-0031: JFreeChart Image Map Cross-Site Scripting Vulnerabilities (advisory@...id7.com)
[SECURITY] [DSA 1423-1] New sitebar packages fix several vulnerabilities (Steve Kemp <skx@...ian.org>)
Kvaliitti WebDoc 3.0 CMS SQL Injection vulnerability (jaakkoNOSPAM@...PAMritke.fi)
[ MDKSA-2007:240 ] - Updated libnfsidmap packages fix username lookup flaw (security@...driva.com)
Two vulnerabilities in Simple HTTPD 1.38 (Luigi Auriemma <aluigi@...istici.org>)
Limited upload directory traversal in HTTP File Server 2.2a / 2.3 beta (build #146) (Luigi Auriemma <aluigi@...istici.org>)
Multiple vulnerabilities in Firefly Media Server (mt-daapd) 2.4.1 / SVN 1699 (Luigi Auriemma <aluigi@...istici.org>)
Upload directory traversal in Easy File Sharing 4.5 (Luigi Auriemma <aluigi@...istici.org>)

December 8 (6 messages)

Nullsoft Winamp MP4 tags Stack Overflow (gforce@...ramail.com)
Windows media player 6.4 MP4 Stack Overflow 0-day (gforce@...ramail.com)
[SECURITY] [DSA 1425-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Media Player Classic 6.4.9 MP4 Stack Overflow 0-day (gforce@...ramail.com)
[USN-555-1] e2fsprogs vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1426-1] New qt-x11-free packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)

December 10 (38 messages)

webSPELL 4.01.02 (calendar.php, usergallery.php) XSS Vulnerability (brainheadbrainhead@....de)
Two vulnerabilities in SquirrelMail GPG plugin (Tomas Kuliavas <tokul@...rs.sourceforge.net>)
Call for Papers - Security and High Performance Computing System 2008 (shpcs08@...lf.no)
The Cookie Tools v0.3 -- first public release ("michele dallachiesa" <michele.dallachiesa@...il.com>)
Unsanitized scripting in RoundCube webmail (Tomas Kuliavas <tokul@...rs.sourceforge.net>)
Flat PHP Board <= 1.2 Multiple Vulnerabilities (kingoftheworld92@...twebnet.it)
CVE-2007-6205 ("Hanno Böck" <hanno@...eck.de>)
[ GLSA 200712-09 ] Ruby-GNOME2: Format string error (Pierre-Yves Rofes <py@...too.org>)
Bitweaver XSS & SQL Injection Vulnerability (DoZ@...kersCenter.com)
Security and hacking papers (Ork <ork@...il.it>)
bttlxeForum Multiple SQL Injection And Cross Site Scripting (noreply@...a-security.net)
[ GLSA 200712-03 ] GNU Emacs: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-06 ] Firebird: Multiple buffer overflows (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-04 ] Cairo: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-05 ] PEAR::MDB2: Information disclosure (Pierre-Yves Rofes <py@...too.org>)
SQL injection - GestDownV1.00Beta (bebe@...il.com)
Lotfian.com DATABASE DRIVEN TRAVEL SITE Multiple SQL Injection (no-reply@...a-Security.net)
squids ICAP implementation lacks a defer check when reading from ICAP server (Martin Huter <m.huter@...on.com>)
Falt4 CMS Security Report/Advisory (Mesut Timur <mesut@...abs.org>)
Secunia Research: Samba "send_mailslot()" Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[ GLSA 200712-08 ] AMD64 x86 emulation Qt library: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-07 ] Lookup: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)
Advisory: Websense XSS Vulnerability ("Liquidmatrix Security Digest" <disclosure@...uidmatrix.org>)
[SECURITY] Buffer overrun in send_mailslot() ("Gerald (Jerry) Carter" <jerry@...ba.org>)
Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) and vulnerable bz2lib (CAN-2005-0758 & CAN-20… ("Stefan Kanthak" <stefan.kanthak@...go.…)
rPSA-2007-0261-1 samba samba-swat (rPath Update Announcements <announce-noreply@...th.com>)
WordPress Charset SQL injection vulnerability (re-resend) (Abel Cheung <abelcheung@...il.com>)
Re: Media Player Classic 6.4.9 MP4 Stack Overflow 0-day ("Rob Thompson" <my.security.lists@...il.com>)
Multiple vulnerabilities in BarracudaDrive 3.7.2 (Luigi Auriemma <aluigi@...istici.org>)
Multiple vulnerabilities in BadBlue 2.72b (Luigi Auriemma <aluigi@...istici.org>)
Filesystem access in DOSBox 0.72 (Luigi Auriemma <aluigi@...istici.org>)
[USN-550-2] Cairo regression (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1427-1] New samba packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Dell / Dell Financial Services - Contact ("Justin@...oTek" <justin@...otek-nc.com>)
WASC Announcement: The Script Mapping Project Results and Call for Participation (announcements@...appsec.org)
Re: Dell / Dell Financial Services - Contact (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ GLSA 200712-10 ] Samba: Execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
ZDI-07-072: Novell Netmail AntiVirus Agent Multiple Overflow Vulnerabilities (zdi-disclosures@...m.com)

December 11 (18 messages)

[ MDKSA-2007:242 ] - Updated e2fsprogs packages fix vulnerability (security@...driva.com)
RE: TCP Port randomization paper (Amit Klein <amit.klein@...steer.com>)
[ MDKSA-2007:243 ] - Updated MySQL packages fix multiple vulnerabilities (security@...driva.com)
[ MDKSA-2007:241 ] - Updated tomcat5 packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1481-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
rPSA-2007-0262-1 e2fsprogs (rPath Update Announcements <announce-noreply@...th.com>)
PGMfuzz - a tool for testing Pragmatic General Multicast protocol implementations ("IRM Research" <research@...plc.com>)
SupportSuite 3.11.01~ Multiple file ~ PHP SELF XSS ("imei Addmimistrator" <addmimistrator@...il.com>)
HP notebooks remote code execution vulnerability (multiple series) (porkythepig@...pi.pl)
Black Hat Briefings Call for Papers ("jmoss" <jmoss@...ckhat.com>)
Meridian Prolog Manager Username and Plain Text Password Disclosure ("Prolog Error" <prolog.disclosure@...il.com>)
ZDI-07-073: Microsoft Internet Explorer setExpression Vulnerability (zdi-disclosures@...m.com)
ZDI-07-074: Microsoft Internet Explorer Node Manipulation Memory Corruption (zdi-disclosures@...m.com)
[SECURITY] [DSA 1429-1] New htdig packages fix cross site scripting (Steve Kemp <skx@...ian.org>)
ZDI-07-075: Microsoft Internet Explorer Element Tags Vulnerability (zdi-disclosures@...m.com)
ZDI-07-076: Microsoft Windows Message Queuing Service Stack Overflow Vulnerability (zdi-disclosures@...m.com)
[SECURITY] [DSA 1430-1] New libnss-ldap packages fix denial of service (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1431-1] New ruby-gnome2 packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)

December 12 (11 messages)

[ MDKSA-2007:244 ] - Updated samba packages fix vulnerability (security@...driva.com)
[SECURITY] [DSA 1428-2] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Cpanel Vulnerability? ("Francisco Pecorella" <pecorelf@...il.com>)
Re: TCP Port randomization paper ("Fernando Gont" <fernando.gont@...il.com>)
Re: Cpanel Vulnerability? ("Charles Hardin" <fonestorm@...il.com>)
MS Office 2007: Digital Signature does not protect Meta-Data (poehls@...ormatik.uni-hamburg.de)
Re: Media Player Classic 6.4.9 MP4 Stack Overflow 0-day ("Matthew Leeds" <mleeds@...leeds.net>)
iDefense Security Advisory 12.11.07: Microsoft Internet Explorer JavaScript setExpression Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.c…)
rPSA-2007-0264-1 mod_dav_svn subversion (rPath Update Announcements <announce-noreply@...th.com>)
iDefense Security Advisory 12.11.07: Microsoft DirectX 7 and 8 DirectShow Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Re: Cpanel Vulnerability? (gdfuego@...il.com)

December 13 (17 messages)

QK SMTP Server 3 - Denial of service (jplopezy@...il.com)
[security bulletin] HPSBUX02296 SSRT071504 rev.1 - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code (security-alert@...com)
RE: [Full-disclosure] Fwd: Websense 6.3.1 Filtering Bypass ("Hubbard, Dan" <dhubbard@...sense.com>)
OpenOffice: Duplicated, Unprotected Certificate Information shown in Signed ODF Documents (poehls@...ormatik.uni-hamburg.de)
[security bulletin] HPSBUX02294 SSRT071451 rev.1 - HP-UX Running DCE, Remote Denial of Service (DoS) (security-alert@...com)
SQL MKPortal M1.1 Rc1 (Sw33t.h4cK3r@...mail.com)
Fwd: Websense 6.3.1 Filtering Bypass ("The Security Community" <thesecuritycommunity@...il.com>)
Hosting Controller - Multiple Security Bugs (Extremely Critical) (admin@...report.ir)
AW: MS Office 2007: Digital Signature does not protect Meta-Data ("Naujoks, Hans-Dietmar" <Hans-Dietmar.Naujoks@...v-sued.de>)
MS Office 2007: Target of Hyperlinks not covered by Digital Signatures (poehls@...ormatik.uni-hamburg.de)
[USN-550-3] Cairo regression (Kees Cook <kees@...ntu.com>)
SECURITY: 1.4.12 Package Compromise (Jon Angliss <jon@...irrelmail.org>)
[ GLSA 200712-11 ] Portage: Information disclosure (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-12 ] IRC Services: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[ MDKSA-2007:245 ] - Updated wpa_supplicant package fixes remote denial of service (security@...driva.com)
+ Trivantis CourseMill Enterprise Learning Management System - SQL Injection - CVE-2007-6338 (swhite@...urestate.com)
Re: AW: MS Office 2007: Digital Signature does not protect Meta-Data ("webmaster@...workdefense.biz" <webmaster@...workdefense.biz>)

December 14 (8 messages)

PHP MySQL Banner Exchange 2.2.1 remote mysql database bug (arsalan1991@...il.com)
Re: MS Office 2007: Digital Signature does not protect Meta-Data ("Henrich C. Poehls" <poehls@...ormatik.uni-hamburg.de>)
HPSBUX02296 SSRT071504 rev.2 - HP-UX Running OpenSSL, Remote Execution of Arbitrary Code (security-alert@...com)
AW: MS Office 2007: Digital Signature does not protect Meta-Data ("Naujoks, Hans-Dietmar" <Hans-Dietmar.Naujoks@...v-sued.de>)
[ISR] - Novell Groupwise client remote stack overflow silently patched. ("ISR-noreply" <noreply@...obyte.com.ar>)
[ MDKSA-2007:246 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
ANNOUNCE: SquirrelMail 1.4.13 Released (Jon Angliss <jon@...dork.net>)
POC for samba send_mailslot() ("x 86" <asmx86@...il.com>)

December 15 (7 messages)

Phpay - Local File Inclusion (th3.r00k.nospam@...k.gmail.com)
[security bulletin] HPSBGN02298 SSRT071502 rev.1 - HP Quick Launch Button (QLB) Running on Windows, Remote Execution of Arbitrary Code, Ga… (security-alert@...com)
Anon Proxy Server - Remote Code Execution (th3.r00k.nospam@...k.gmail.com)
Oreon/Centreon - Multiple Remote File Inclusion (th3.r00k.nospam@...k.gmail.com)
PHP RPG - Sql Injection and Session Information Disclosure. (th3.r00k.nospam@...k.gmail.com)
Wordpress - Broken Access Control (th3.r00k.nospam@...k.gmail.com)
ClubHack2007: Presentation are online now ("`ClubHack `" <seclist@...bhack.com>)

December 17 (18 messages)

ZSA-2007-029: syslog-ng Denial of Service (Balazs Scheidler <bazsi@...abit.hu>)
Re: [syslog-ng] ZSA-2007-029: syslog-ng Denial of Service (Balazs Scheidler <bazsi@...abit.hu>)
Re: PHP MySQL Banner Exchange 2.2.1 remote mysql database bug (theredc0ders@...il.com)
PHP Security Framework: Vuln and Security Bypass (gmdarkfig@...il.com)
neuron news1.0 Multiple Remote Vulnerabilities (sql injection/xss) (hadihadi_zedehal_2006@...oo.com)
jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow (gforce@...ramail.com)
[SECURITY] [DSA 1432-1] New link-grammar packages fix execution of code (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1433-1] New centericq packages fix execution of code (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1434-1] New mydns packages fix denial of service (Thijs Kinkhorst <thijs@...ian.org>)
release uhooker v1.3 ("Hernan Ochoa" <hernan@...il.com>)
Re: Wordpress - Broken Access Control (otto@...odestruct.com)
Heap overflow in PeerCast 0.1217 (Luigi Auriemma <aluigi@...istici.org>)
rPSA-2007-0266-1 tetex tetex-afm tetex-dvips tetex-fonts tetex-latex tetex-xdvi (rPath Update Announcements <announce-noreply@...th.com>)
RaidenHTTPD 2.0.19 ulang cmd exec poc exploit (retrog@...ce.donotspam.it)
SurgeMail v.38k4 webmail Host header crash (retrog@...ce.donotspam.it)
Uber Uploader <= 5.3.6 Remote File Upload Vulnerability (sys-project@...mail.com)
Apple OS X Software Update Remote Command Execution (Moritz Jodeit <moritz@...eit.org>)
rPSA-2007-0268-1 kdebase (rPath Update Announcements <announce-noreply@...th.com>)

December 18 (22 messages)

Rosoft Media Player 4.1.7 crash (jplopezy@...il.com)
Multiple xss in mambo 4.6.2 (beenudel1986@...il.com)
iMesh <= 7.1.0.x IMWebControl Class (IMWeb.dll 7.0.0.x) remote exploit (retrog@...ce.it)
Re: Wordpress - Broken Access Control (th3.r00k.nospam@...k.gmail.com)
ZDI-07-079: Hewlett-Packard HP-UX swagentd Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-07-078: St. Bernard Open File Manager Heap Overflow Vulnerability (zdi-disclosures@...m.com)
SyScan'08 Call For Paper/Training ("organiser@...can.org" <organiser@...can.org>)
Re: Re: PHP MySQL Banner Exchange 2.2.1 remote mysql database bug (arsalan1991@...il.com)
Re: SineCMS <= 2.3.4 Calendar SQL Injection 'n something else.. (carlo.feller@...il.com)
ZDI-07-077: Trend Micro ServerProtect StRpcSrv.dll Insecure Method Exposure Vulnerability (zdi-disclosures@...m.com)
Re: RE: TCP Port randomization paper (Amit Klein <amit.klein@...steer.com>)
[security bulletin] HPSBST02299 SSRT071506 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-063 to MS07-069 (security-alert@...com)
[USN-556-1] Samba vulnerability (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 12.18.07: ClamAV libclamav MEW PE File Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
rPSA-2007-0269-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
iDefense Security Advisory 12.17.07: Apple Mac OS X mount_smbfs Stack Based Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Tiger Team: New TV series about pen testers airing on CourtTV Dec 25 11 pm (<blackredyellow@...hmail.com>)
Google Toolbar Dialog Spoofing Vulnerability ("avivra" <avivra@...il.com>)
AST-2007-027 - Database matching order permits host-based authentication to be ignored (Security Officer <security@...erisk.org>)
Re: Uber Uploader <= 5.3.6 Remote File Upload Vulnerability (recklessb@...rs.sourceforge.net)
[ GLSA 200712-13 ] E2fsprogs: Multiple buffer overflows (Robert Buchholz <rbu@...too.org>)
[ GLSA 200712-14 ] CUPS: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)

December 19 (11 messages)

Re: MS Office 2007: Digital Signature does not protect Meta-Data ("Henrich C. Poehls" <poehls@...ormatik.uni-hamburg.de>)
[USN-557-1] GD library vulnerability (Jamie Strandboge <jamie@...ntu.com>)
smbfs and apache+php source code disclosure ("Maciej Gąsiorowski" <gonsiore@...il.com>)
Cisco Security Advisory: Application Inspection Vulnerability in Cisco Firewall Services Module (Cisco Systems Product Security Incident Response Team <psirt@ci…)
SYMSA-2007-015 (research@...antec.com)
Array overflow in id3lib (devel CVS) (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 1435-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
HP laptops Software Update tool vulnerability (porkythepig@...pi.pl)
Re: Wordpress - Broken Access Control (Abel Cheung <abelcheung@...il.com>)
xeCMS 1.x.x Remote File Disclosure Vulnerability. (p4imi0 <p4imi0@...il.com>)
Re: Wordpress - Broken Access Control (otto@...odestruct.com)

December 20 (14 messages)

Black Hat Briefings Call for Papers and Happy Happy Joy Joy ("jmoss" <jmoss@...ckhat.com>)
iSupport v1.8 Local file include vulnerability (ahcrew@...il.com)
Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability (mj@...rockies.net)
[Aria-Security.net] ABI Version 3.7.9.17 Remote SQL Injection (The-0utl4w-noreply@...a-security.net)
[security bulletin] HPSBTU02300 SSRT071452 rev.1 - HP Tru64 UNIX running FFM, Local Denial of Service (Dos) (security-alert@...com)
SiteScape Forum TCL injection ("lolo lolo" <lolofon@...il.com>)
[security bulletin] HPSBUX02295 SSRT071333 rev.1 - HP-UX Running rpc.yppasswdd, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBUX02284 SSRT071483 rev.4 - HP-UX Running Java JRE and JDK, Remote Unauthorized Access (security-alert@...com)
PHP iCalendar <= 2.24 - Cross-Site Scripting Vulnerability (sys-project@...mail.com)
Re: Morcego CMS <= 0.9.6 Remote File Inclue Vulnerability (antonio@...oniocortes.com)
Re: Morcego CMS <= 0.9.6 Remote File Inclue Vulnerability (antonio@...oniocortes.com)
Woltlab Burning Board 1.0.2 SQL-Injection Vulnerability (nbbn@....net)
[SECURITY] [DSA 1436-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Re: Design flaw in AS3 socket handling allows port probing (fukami <fukami@...tioneins.de>)

December 21 (10 messages)

CFP CISIS '08 (hjan <hjan@...ero.it>)
[USN-559-1] MySQL vulnerabilities (Jamie Strandboge <jamie@...ntu.com>)
Moodle SQL Injection (root@...icker.it)
Cryptome: NSA has real-time access to Hushmail servers (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
RE: Cryptome: NSA has real-time access to Hushmail servers (Jim Harrison <Jim@...tools.org>)
RE: Cryptome: NSA has real-time access to Hushmail servers ("Thor (Hammer of God)" <thor@...merofgod.com>)
Buffer-overflow in WinUAE 1.4.4 (Luigi Auriemma <aluigi@...istici.org>)
[CAID 35970]: CA Products That Embed Ingres Authentication Vulnerability ("Williams, James K" <James.Williams@...com>)
HPSBGN2301 SSRT071508 rev.1 - HP Software Update Running on Windows, Remote Execution of Arbitrary Code, Gain Privileged Access (security-alert@...com)
Word 2003 denial of service (jplopezy@...il.com)

December 22 (6 messages)

America Online AOL Instant Messenger AIM6.0 or 6.5 or higher XSS remote execution (evanchik@...il.com)
Microsoft Office Publisher (jplopezy@...il.com)
My Blog Rfi (beenudel1986@...il.com)
Re: Moodle SQL Injection (foo@....com)
[HSC] Dokeos Multiple Cross-Site Scripting Vulnerabilities (DoZ@...kersCenter.com)
Re: Re: Moodle SQL Injection (bar@....com)

December 24 (15 messages)

Logaholic Web Analytics Software (malibu.r@...mail.com)
[ISecAuditors Security Advisories] Tikiwiki CMS is vulnerable to path traversal attack (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Tikiwiki 1.9.8.3 tiki-special_chars.php XSS Vulnerability (Mesut Timur <mesut@...abs.org>)
Re: [HSC] Dokeos Multiple Cross-Site Scripting Vulnerabilities (yannick.warnier@...eos.com)
pdflib long filename multiple bufferoverflows (poplix <poplix@...uasia.org>)
Jupiter Cms Multiple Vulnerabilities (admin@...report.ir)
[waraxe-2007-SA#060] - Sensitive info disclosure in CuteNews <= 1.4.5 (come2waraxe@...oo.com)
PHP <= 5.2.5 Safe Mode Bypass (admin@...report.ir)
[CVE-2007-5342] Apache Tomcat's default security policy is too open (Mark Thomas <markt@...che.org>)
SimpleForum <= 4.6.2 - Cross-Site Scripting Vulnerability (sys-project@...mail.com)
Update: Clients buffer-overflow in Live for Speed 0.5X10 (Luigi Auriemma <aluigi@...istici.org>)
Re: PHP <= 5.2.5 Safe Mode Bypass (shsuff@...mail.com)
Buffer-overflow and format string in VideoLAN VLC 0.8.6d (Luigi Auriemma <aluigi@...istici.org>)
Double directory traversal in ImgSvr 0.6.21 (Luigi Auriemma <aluigi@...istici.org>)
Unicode buffer-overflow in Zoom Player 6.00b2 (Luigi Auriemma <aluigi@...istici.org>)

December 25 (2 messages)

Multiple vulnerabilities in RUNCMS 1.6 by DSecRG (Digital Security Research Group <research@...c.ru>)
TotalPlayer 3.0 .m3u crash (david130490@...mail.com)

December 26 (7 messages)

Confixx Professional RFİ (erne@...ealizm.us)
[SECURITY] [DSA 1437-1] New cupsys packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Re: PHP <= 5.2.5 Safe Mode Bypass (Alireza Hassani <trueend5@...oo.com>)
Re: Microsoft Office Publisher (fagian@...il.com)
Bid 24744 ? (balrog@...il.com)
RE: Cryptome: NSA has real-time access to Hushmail servers (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
RE: Cryptome: NSA has real-time access to Hushmail servers ("M. Burnett" <mb@...o.net>)

December 27 (18 messages)

Blakord Portal <= Beta 1.3.A (all modules) Blind Sql Injection (sys-project@...mail.com)
XZero Community Classifieds <= v4.95.11 LFI & SQL Injection (office@...zone.org)
IPortalX Forums Cross-Site Scripting Vulnerability (DoZ@...kersCenter.com)
Re: TotalPlayer 3.0 .m3u crash (Luigi Auriemma <aluigi@...istici.org>)
[security bulletin] HPSBGN02298 SSRT071502 rev.2 - HP Quick Launch Button (QLB) Running on Windows, Remote Execution of Arbitrary Code, Ga… (security-alert@...com)
Latest round of web hacking incidents for 2007 & Project news ("Ofer Shezaf" <ofers@...ach.com>)
Re: TotalPlayer 3.0 .m3u crash (Luigi Auriemma <aluigi@...istici.org>)
Re: Tiger Team: New TV series about pen testers airing on CourtTV Dec 25 11 pm (<blackredyellow@...hmail.com>)
Re: Cryptome: NSA has real-time access to Hushmail servers (Valdis.Kletnieks@...edu)
PHP -> set_time_limit (brancohat@...il.com)
Re: Multiple xss in mambo 4.6.2 ("Hanno Böck" <ml@...eck.de>)
Re: Re: TotalPlayer 3.0 .m3u crash (david130490@...mail.com)
Multiple vulnerabilities in Feng 0.1.15 (Luigi Auriemma <aluigi@...istici.org>)
Multiple vulnerabilities in libnemesi 0.6.4-rc1 (Luigi Auriemma <aluigi@...istici.org>)
Re: Re: Re: TotalPlayer 3.0 .m3u crash (david130490@...mail.com)
Re: Cryptome: NSA has real-time access to Hushmail servers ("Kurt Buff" <kurt.buff@...il.com>)
Re: Cryptome: NSA has real-time access to Hushmail servers (Steve Shockley <steve.shockley@...ckley.net>)
Buffer-overflow in Extended Module Player 2.5.1 (Luigi Auriemma <aluigi@...istici.org>)

December 28 (9 messages)

OpenBiblio 0.5.2-pre4 and prior multiple vulnerabilities ("Juan Galiana" <jgaliana@...il.com>)
FAQMasterFlexPlus multiple vulnerabilities ("Juan Galiana" <jgaliana@...il.com>)
2z-project 0.9.6.1 Multiple Security Vulnerabilities ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
[SECURITY] [DSA 1438-1] New tar packages fix several vulnerabilities (Florian Weimer <fw@...ian.org>)
[SECURITY] [DSA 1405-3] New zope-cmfplone packages fix regression (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 1439-1] New typo3-src packages fix SQL injection (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 1440-1] New inotify-tools packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1441-1] New peercast packages fix arbitrary code execution (Thijs Kinkhorst <thijs@...ian.org>)
Buffer-overflow in CoolPlayer 217 (Luigi Auriemma <aluigi@...istici.org>)

December 29 (11 messages)

[ GLSA 200712-15 ] libexif: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-16 ] Exiv2: Integer overflow (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-17 ] exiftags: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200712-18 ] Multi-Threaded DAAP Daemon: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[SECURITY] [DSA 1442-2] New libsndfile packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200712-19 ] Syslog-ng: Denial of Service (Robert Buchholz <rbu@...too.org>)
[ GLSA 200712-20 ] ClamAV: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200712-21 ] Mozilla Firefox, SeaMonkey: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
TK53 Advisory #2: Multiple vulnerabilities in ClamAV ("Lolek of TK53" <lolek1337@...glemail.com>)
CuteNews Arbitrary File Download AllVersion (pawel2827@...il.com)
CCMS v3.1 Demo <= SQL Injection Vulnerability 0day (pawel2827@...il.com)

December 31 (21 messages)

[ GLSA 200712-23 ] Wireshark: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200712-24 ] AMD64 x86 emulation GTK+ library: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200712-25 ] OpenOffice.org: User-assisted arbitrary code execution (Pierre-Yves Rofes <py@...too.org>)
Bitweaver source code disclosure, arbitrary file upload (admin@...report.ir)
Fingerprints in Astaro Security Gateway v7.1 (morin.josh@...il.com)
[ GLSA 200712-22 ] Opera: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
Re: Re: Cryptome: NSA has real-time access to Hushmail servers (gb@...hates.the.constitution.gov)
milliscripts (dir.php) Cross-Site Scripting Vulnerability (sys-project@...mail.com)
LiveCart Multiple Cross-Site Scripting Vulnerabilities (DoZ@...kersCenter.com)
Instant Softwares DatingSite SQL Injection (The-0utl4w-noreply@...a-security.net)
RE: Cryptome: NSA has real-time access to Hushmail servers (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: Cryptome: NSA has real-time access to Hushmail servers (Seth <sethb@...ix.com>)
Re: TalkBack 2.2.7 Multiple Remote File Inclusion Vulnerabilities (oldguy@...guy.us)
RE: Cryptome: NSA has real-time access to Hushmail servers ("Kevin Reiter" <KReiter@...idefsi.net>)
Re: Cryptome: NSA has real-time access to Hushmail servers ("J. Oquendo" <sil@...iltrated.net>)
Re: Cryptome: NSA has real-time access to Hushmail servers (mark seiden-via mac <mis@...den.com>)
[HSC Security Group] Multiple CSRF in Joomla all versions - Complete compromise (zinho@...kerscenter.com)
RE: Cryptome: NSA has real-time access to Hushmail servers ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: Cryptome: NSA has real-time access to Hushmail servers ("Craig Wright" <Craig.Wright@....com.au>)
Re: Cryptome: NSA has real-time access to Hushmail servers (Jay Hennigan <jay@...t.net>)
Re: Cryptome: NSA has real-time access to Hushmail servers ("Rob Thompson" <my.security.lists@...il.com>)

364 messages

Powered by blists - more mailing lists