bugtraq mailing list - 2008/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 1	² 6	³ 25	⁴ 11	⁵ 11	⁶
⁷ 24	⁸ 13	⁹ 25	¹⁰ 14	¹¹ 14	¹² 6	¹³
¹⁴ 37	¹⁵ 33	¹⁶ 26	¹⁷ 18	¹⁸ 22	¹⁹ 6	²⁰
²¹ 25	²² 15	²³ 15	²⁴ 17	²⁵ 13	²⁶ 5	²⁷
²⁸ 22	²⁹ 13	³⁰ 15	³¹ 11

Messages by day:

January 1 (1 message)

Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search (Audun Larsen <audun@...io.no>)

January 2 (6 messages)

MODx CMS Source code disclosure, local file inclusion (admin@...report.ir)
XSS Vulnerabilities in Common Shockwave Flash Files ("rich cannings" <rcannings@...il.com>)
phpBB2 2.0.22 Cross Site Scripting Vulnerability (bugtraq@...ncosmo.com)
Multiple vulnerabilities in Georgia SoftWorks SSH2 Server 7.01.0003 (Luigi Auriemma <aluigi@...istici.org>)
Buffer-overflow and format string in White_Dune 0.29beta791 (Luigi Auriemma <aluigi@...istici.org>)
AST-2008-001: Crash from transfer using BYE with Also header (Asterisk Security Team <security@...erisk.org>)

January 3 (25 messages)

Yet another Dialog Spoofing Vulnerability - Firefox Basic Authentication ("avivra" <avivra@...il.com>)
[security bulletin] HPSBGN02301 SSRT071508 rev.2 - HP Software Update Running on Windows, Remote Execution of Arbitrary Code, Gain Privile… (security-alert@...com)
Re: [Full-disclosure] Yet another Dialog Spoofing Vulnerability - Firefox Basic Authentication (Michal Zalewski <lcamtuf@...ne.cc>)
Re: [Full-disclosure] Yet another Dialog Spoofing Vulnerability - Firefox Basic Authentication (avivra <avivra@...il.com>)
xss in w3-msql error page (vivek_infosec@...oo.com)
[ MDVSA-2008:1 ] - Updated wireshark packages fix multiple vulnerabilities (security@...driva.com)
Re: phpBB2 2.0.22 Cross Site Scripting Vulnerability (neothermic@...bb.com)
Re: Cryptome: NSA has real-time access to Hushmail servers (John Simpson <jms1@...1.net>)
Re: Cryptome: NSA has real-time access to Hushmail servers (Lee Dilkie <lee_dilkie@...el.com>)
RE: Latest round of web hacking incidents for 2007 & Project news ("Ofer Shezaf" <ofers@...ach.com>)
RE: Re: Cryptome: NSA has real-time access to Hushmail servers ("M. Burnett" <mb@...o.net>)
RE: Latest round of web hacking incidents for 2007 & Project news ("Memisyazici, Aras" <arasm@...edu>)
[SECURITY] [DSA 1443-1] New tcpreen packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
rPSA-2008-0001-1 dovecot (rPath Update Announcements <announce-noreply@...th.com>)
Re: Latest round of web hacking incidents for 2007 & Project news (Peter Watkins <peterw@....net>)
multiple CAPTCHA automation test bypass digest (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: Re: phpBB2 2.0.22 Cross Site Scripting Vulnerability (admin@...znet.com)
Re: rPSA-2008-0001-1 dovecot (Dominic Hargreaves <dom@...th.li>)
[SECURITY] [DSA 1444-1] New php5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
securityvulns.com russian vulnerabilities digest (3APA3A <3APA3A@...URITY.NNOV.RU>)
[SECURITY] [DSA 1446-1] New wireshark packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1445-1] New maradns packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1447-1] New tomcat5.5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: phpBB2 2.0.22 Cross Site Scripting Vulnerability (neothermic@...bb.com)
rPSA-2008-0004-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)

January 4 (11 messages)

FortiGuard: URL Filtering Application Bypass Vulnerability (Danux <danuxx@...il.com>)
Re: rPSA-2008-0001-1 dovecot ("Steven M. Christey" <coley@...re.org>)
Re: Latest round of web hacking incidents for 2007 & Project news ("s f" <sf@...hankarki.com.np>)
AW: phpBB2 2.0.22 Cross Site Scripting Vulnerability ("Aufmuth Andreas" <Andreas_Aufmuth@...el-medien.de>)
Re: rPSA-2008-0001-1 dovecot (Dominic Hargreaves <dom@...th.li>)
Re: rPSA-2008-0001-1 dovecot (Jonathan Smith <smithj@...th.com>)
Some DoS in some telnet servers (Luigi Auriemma <aluigi@...istici.org>)
Multiple vulnerabilities in yaSSL 1.7.5 (Luigi Auriemma <aluigi@...istici.org>)
Pre-auth buffer-overflow in mySQL through yaSSL (Luigi Auriemma <aluigi@...istici.org>)
Re: FortiGuard: URL Filtering Application Bypass Vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
iDefense Security Advisory 12.24.07: Novell ZENworks Endpoint Security Management Local Privilege Escalation Vulnerabil… (iDefense Labs <labs-no-reply@...fense.c…)

January 5 (11 messages)

rPSA-2008-0006-1 libexif (rPath Update Announcements <announce-noreply@...th.com>)
NetRisk 1.9.7 Remote File Inclusion Vulnerability (erne@...ealizm.us)
INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION EXPLOIT (underwater@...efence.ru)
[SECURITY] [DSA 1449-1] New loop-aes-utils packages fix programming error (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1450-1] New util-linux packages fix programming error (Steve Kemp <skx@...ian.org>)
[ MDVSA-2008:002 ] - Updated squid package fixes remote denial of service (security@...driva.com)
[SECURITY] [DSA 1448-1] New eggdrop packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)
rPSA-2008-0007-1 tetex tetex-afm tetex-dvips tetex-fonts tetex-latex tetex-xdvi (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] [DSA 1448-1] New eggdrop packages fix arbitrary code execution (Steve Kemp <skx@...ian.org>)
Aruba Mobility Controller User Authentication Vulnerability - Aruba Advisory ID: AID-122207 ("Robbie Gill" <rgill@...banetworks.com>)
rPSA-2008-0008-1 cups (rPath Update Announcements <announce-noreply@...th.com>)

January 7 (24 messages)

vBulletin 3.6.8 XSRF/XSS Vulnerability (nbbn@....net)
[HSC] Snitz Forums Multiple Vulnerabilities (DoZ@...kersCenter.com)
netrisk 1.9.7 Multiple Remote Vulnerabilities (sql injection/xss) (hadihadi_zedehal_2006@...oo.com)
eTicket 1.5.5.2 Multiple Vulnerabilities (L4teral <l4teral@...il.com>)
OneCMS Vulnerabilities (admin@...report.ir)
New Web Hacking Incidents at WHID (Ofer Shezaf <ofers@...ach.com>)
[Reversemode Paper] Exploiting WDM Audio Drivers (Reversemode <advisories@...ersemode.com>)
[SECURITY] [DSA 1451-1] New mysql-dfsg-5.0 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Linksys WRT54 GL - Session riding (CSRF) (tomaz.bratusa@...mintell.com)
Re: vBulletin 3.6.8 XSRF/XSS Vulnerability (nbbn@....net)
PostgreSQL 2007-01-07 Cumulative Security Release (Josh Berkus <josh@...iodbs.com>)
SocialURL Login Page Cross-Site Scripting (morin.josh@...il.com)
[SECURITY] [DSA 1452-1] New wzdftpd packages fix denial of service (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1453-1] New tomcat5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
LayerOne 2008 - CFP Released ("Layer One" <layeronecfp@...il.com>)
Million Dollar Script 2.0.14 Remote File Disclosure Vulnerability. (p4imi0 <p4imi0@...il.com>)
[SECURITY] [DSA 1454-1] New freetype packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Linksys WRT54 GL - Session riding (CSRF) (Jan Heisterkamp <janheisterkamp@....de>)
PWDumpX v1.4 - Dumps domain password cache, LSA secrets, password hashes, and password history hashes. ("Reed Arvin" <reedarvin@...il.com>)
CORE-2007-1106: SynCE Remote Command Injection (CORE Security Technologies Advisories <advisories@...esecurity.com>)
Re: Linksys WRT54 GL - Session riding (CSRF) (Jan Heisterkamp <janheisterkamp@....de>)
PWDumpX v1.0 and PWDumpX v1.1 updated - bug fixes ("Reed Arvin" <reedarvin@...il.com>)
RE: [HSC] Snitz Forums Multiple Vulnerabilities ("Aaron Cake" <aaron@...pm.com>)
iDefense Security Advisory 01.07.08: Motorola netOctopus Agent MSR Write Privilege Escalation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

January 8 (13 messages)

VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages (VMware Security team <security@...are.com>)
[ MDVSA-2008:001-1 ] - Updated wireshark packages fix multiple vulnerabilities (security@...driva.com)
[USN-560-1] Tomboy vulnerability (Jamie Strandboge <jamie@...ntu.com>)
sysHotel On Line Remote File Disclosure Vulnerability. (p4imi0 <p4imi0@...il.com>)
VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1 (VMware Security team <security@...are.com>)
Corsaire Security Advisory: Sun J2RE DoS issue ("advisories" <advisories@...saire.com>)
HPSBUX02153 SSRT061181 rev.7 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (security-alert@...com)
HPSBUX02156 SSRT061236 rev.4 - HP-UX Running Thunderbird, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (security-alert@...com)
Level-One WBR-3460A Grants Root Access (anastasiosm@...il.com)
Joomla 1.0.13 CSRF ("J. Carlos Nieto" <xiam@...teslibres.org>)
Re: Joomla 1.0.13 CSRF ("J. Carlos Nieto" <xiam@...teslibres.org>)
[SECURITY] [DSA 1455-1] New libarchive1 packages fix several problems (Steve Kemp <skx@...ian.org>)
ERRATA: [ GLSA 200709-07 ] Eggdrop: Buffer overflow (Robert Buchholz <rbu@...too.org>)

January 9 (25 messages)

LFI in Tuned Studios Templates ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
[security bulletin] HPSBMA02239 SSRT061260 rev.3 - HP OpenView Operations (OVO) Agents Running Shared Trace Service, Remote Arbitrary Code… (security-alert@...com)
First (Major) web hacking incidents for 2008. Sign of the year to come? (Ofer Shezaf <ofers@...ach.com>)
[INFIGO 2008-01-06]: McAfee E-Business Server Remote Preauth Code Execution / DoS ("infocus" <infocus@...igo.hr>)
Re: First (Major) web hacking incidents for 2008. Sign of the year to come? (Paul Schmehl <pauls@...allas.edu>)
[USN-562-1] opal vulnerability (Kees Cook <kees@...ntu.com>)
[ MDVSA-2008:004 ] - Updated postgresql packages fix denial of service and privilege escalation issues (security@...driva.com)
Privileg escalation in Omegasoft Insel 7 ("MC Iglo" <mc.iglo@...glemail.com>)
[ GLSA 200801-01 ] unp: Arbitrary command execution (Robert Buchholz <rbu@...too.org>)
[ MDVSA-2008:003 ] - Updated clamav packages fix multiple vulnerabilities (security@...driva.com)
Pre-auth remote commands execution in SAP MaxDB 7.6.03.07 (Luigi Auriemma <aluigi@...istici.org>)
[INFIGO-2008-01-06]: McAfee E-Business Server Remote Preauth Code Execution / DoS - Corrected ("infocus" <infocus@...igo.hr>)
[USN-564-1] Net-SNMP vulnerability (Jamie Strandboge <jamie@...ntu.com>)
[USN-561-1] pwlib vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 200801-02 ] R: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ MDVSA-2008:004 ] - Updated postgresql packages fix denial of service and privilege escalation issues (security@...driva.com)
[USN-563-1] CUPS vulnerabilities (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 01.09.08: Novell NetWare Client nicm.sys Local Privilege Escalation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200801-03 ] Claws Mail: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1456-1] New fail2ban packages fix denial of service (Thijs Kinkhorst <thijs@...ian.org>)
[ GLSA 200801-05 ] Squid: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[USN-565-1] Squid vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 200801-04 ] OpenAFS: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[ MDVSA-2008:005 ] - Updated libexif packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1457-1] New dovecot packages fix information disclosure (Thijs Kinkhorst <thijs@...ian.org>)

January 10 (14 messages)

Simple Machines Forum Cross-Site Scripting Vulnerabilities (DoZ@...kersCenter.com)
PR07-06, PR07-07, PR07-08, PR07-09, PR07-10, PR07-12: Several XSS, Cross-domain Redirection and Frame Injection on Sun … (ProCheckUp Research <research@...checku…)
[USN-566-1] OpenSSH vulnerability (Kees Cook <kees@...ntu.com>)
uCon 2008 call for participation - Recife, Brazil (ucon@...bugmagazine.org)
Digital Armaments January-February Hacking Challenge: Special 20.000$ Prize - Windows Vulnerabilities and Exploit (info@...italarmaments.com)
[ GLSA 200801-06 ] Xfce: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
BT Home Flub: Pwnin the BT Home Hub (5) - exploiting IGDs remotely via UPnP ("Adrian P" <unknown.pentester@...il.com>)
Word 2007 Email as PDF path disclosure flaw (ebk_lists@...mail.com)
MTCMS <=2.0 SQL Injection Vulnerbility (hadihadi_zedehal_2006@...oo.com)
Buffer-overflow in Quicktime Player 7.3.1.70 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 1458-1] New openafs packages fix denial of service vulnerability (Noah Meyerhans <noahm@...ian.org>)
[ MDVSA-2008:006 ] - Updated exiv2 packages fix vulnerability (security@...driva.com)
Re: Buffer-overflow in Quicktime Player 7.3.1.70 ("Marcello Barnaba (void)" <vjt@...nssl.it>)
[USN-567-1] Dovecot vulnerability (Kees Cook <kees@...ntu.com>)

January 11 (14 messages)

Re: Re: Buffer-overflow in Quicktime Player 7.3.1.70 (none@...d.gov)
At long last -- Extra Outlooks! ("Thor (Hammer of God)" <thor@...merofgod.com>)
[ MDVSA-2008:007 ] - Updated madwifi-source, wpa_supplicant packages fix vulnerabilities (security@...driva.com)
SecurityReason - Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability (sp3x@...urityreason.com)
Re: Linksys WRT54 GL - Session riding (CSRF) (Florian Weimer <fw@...eb.enyo.de>)
SecurityReason - Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability (sp3x@...urityreason.com)
re-resting of zzuf results ("Hanno Böck" <ml@...eck.de>)
ImageAlbum Remote SQL Injection Vulnerabilities (db@...security.org)
Re: Buffer-overflow in Quicktime Player 7.3.1.70 (str0ke <str0ke@...w0rm.com>)
CFP: EuroSec Workshop (March 31st, 2008) (Stefano Zanero <zanero@...t.polimi.it>)
Member Area System (MAS) Remote File Include Vulnerability (view_func.php) (ship_nx@...oo.com)
Naymz multiple XSS (morin.josh@...il.com)
Re: At long last -- Extra Outlooks! (Alexander Bochmann <ab@...ts.gxis.de>)
Re: Buffer-overflow in Quicktime Player 7.3.1.70 (Luigi Auriemma <aluigi@...istici.org>)

January 12 (6 messages)

Cross site scripting (XSS) in Moodle 1.8.3 ("Hanno Böck" <ml@...eck.de>)
[ MDVSA-2008:010 ] - Updated libxml2 packages fix DoS vulnerability (security@...driva.com)
[ MDVSA-2008:011 ] - Updated rsync packages fix restrictions bypass vulnerabilities (security@...driva.com)
Safari 2 Denial of Service ("S21sec labs" <s21seclabs@...sec.com>)
[ MDVSA-2008:009 ] - Updated autofs packages fix insecure hosts configuration (security@...driva.com)
[ MDVSA-2008:008 ] - Updated kernel packages fix multiple vulnerabilities and bugs (security@...driva.com)

January 14 (37 messages)

Garment Center (index.cgi) Local File Inclusion (Smasher@...cciamiilcalzino.it)
[SECURITY] [DSA 1462-1] New hplip packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
what is this? ("crazy frog crazy frog" <i.m.crazy.frog@...il.com>)
Re: what is this? ("crazy frog crazy frog" <i.m.crazy.frog@...il.com>)
RE: Linksys WRT54 GL - Session riding (CSRF) ("Tomaz" <tomaz.bratusa@...mintell.com>)
Re: [Full-disclosure] what is this? (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: [Full-disclosure] what is this? (Nick FitzGerald <nick@...us-l.demon.co.uk>)
F5 BIG-IP Web Management List Search XSS (nnposter@...closed.not)
[SECURITY] [DSA 1460-1] New postgresql-8.1 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: [Full-disclosure] what is this? ("crazy frog crazy frog" <i.m.crazy.frog@...il.com>)
SQID v0.3 - SQL Injection Digger. (Metaeye SG <contact@...aeye.org>)
[ MDVSA-2008:009-1 ] - Updated autofs packages fix insecure hosts configuration (security@...driva.com)
Re: [Full-disclosure] Buffer-overflow in Quicktime Player 7.3.1.70 (Luigi Auriemma <aluigi@...istici.org>)
Re: At long last -- Extra Outlooks! (Casper.Dik@....COM)
RE: At long last - Extra Outlooks! ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: At long last -- Extra Outlooks! ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: At long last -- Extra Outlooks! (Francois Labreque <flabreq@...ibm.com>)
Re: Re: Buffer-overflow in Quicktime Player 7.3.1.70 (snagg@...nssl.it)
Re: what is this? (Jose Nazario <jose@...key.org>)
Re: what is this? ("Robert McArdle" <robertmcardle@...il.com>)
[SECURITY] [DSA 1459-1] New gforge packages fix SQL injection (Thijs Kinkhorst <thijs@...ian.org>)
Re: what is this? ("crazy frog crazy frog" <i.m.crazy.frog@...il.com>)
Re: what is this? ("Robert McArdle" <robertmcardle@...il.com>)
Re: what is this? (admin@...oupa.net)
Re: Buffer-overflow in Quicktime Player 7.3.1.70 (Luigi Auriemma <aluigi@...istici.org>)
Re: Linksys WRT54 GL - Session riding (CSRF) ("J. Oquendo" <sil@...iltrated.net>)
RE: what is this? (Mario Contestabile <marioc@...puter.org>)
Binn SBuilder (nid) Remote Blind Sql Injection Vulnerabily (sys-project@...mail.com)
Re: Garment Center (index.cgi) Local File Inclusion (Smasher@...cciamiilcalzino.it)
Re: Buffer-overflow in Quicktime Player 7.3.1.70 ("Marcello Barnaba (void)" <vjt@...nssl.it>)
Hacking The Interwebs ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
ZDI-08-001: IBM Tivoli Storage Manager Express Backup Server Heap Overflow Vulnerability (zdi-disclosures@...m.com)
[SECURITY] [DSA 1463-1] New postgresql-7.4 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re[2]: [Full-disclosure] what is this? (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: what is this? (Gadi Evron <ge@...uxbox.org>)
[USN-568-1] PostgreSQL vulnerabilities (Jamie Strandboge <jamie@...ntu.com>)
[SECURITY] [DSA 1461-1] New libxml2 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)

January 15 (33 messages)

[security bulletin] HPSBUX02303 SSRT071468 rev.1 - HP-UX Running X Font Server (xfs) Software, Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBST02304 SSRT080003 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-001 to MS08-002 (security-alert@...com)
[ MDVSA-2008:012 ] - Updated python packages fix vulnerabilities (security@...driva.com)
[ MDVSA-2008:013 ] - Updated python packages fix vulnerability in imageop module (security@...driva.com)
FreeBSD Security Advisory FreeBSD-SA-08:01.pty (FreeBSD Security Advisories <security-advisories@...eBSD.org>)
FreeBSD Security Advisory FreeBSD-SA-08:02.libc (FreeBSD Security Advisories <security-advisories@...eBSD.org>)
[USN-569-1] libxml2 vulnerability (Kees Cook <kees@...ntu.com>)
Re: what is this? (Denis <sp23@...ernode.on.net>)
Country by Country ISA Computer Sets ("Thor (Hammer of God)" <thor@...merofgod.com>)
Exploiting the SpamBam plugin for wordpress ("José M. Palazón Romero" <josem.palazon@...il.com>)
Re: Linksys WRT54 GL - Session riding (CSRF) (Jan Heisterkamp <janheisterkamp@....de>)
Re: what is this? ("crazy frog crazy frog" <i.m.crazy.frog@...il.com>)
Re: [Full-disclosure] what is this? (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Re[2]: what is this? (Denis <sp23@...ernode.on.net>)
Re: [Full-disclosure] what is this? ("crazy frog crazy frog" <i.m.crazy.frog@...il.com>)
SecurityReason - Apache (mod_status) Refresh Header - Open Redirector (XSS) (sp3x@...urityreason.com)
Article DashBoard all version SQL Injection Vulnerability (xcross87@...il.com)
Max's File Uploader File Upload Vulnerability (xcross87@...il.com)
MicroNews Admin Direct Access vulnerability (xcross87@...il.com)
Re[2]: what is this? (Denis <sp23@...ernode.on.net>)
Pipe to FOR Crashes CMD ("James C. Slora Jr." <james.slora@...a.com>)
Re: what is this? ("Jamie Riden" <jamie.riden@...il.com>)
Defeating audio captcha systems ("José M. Palazón Romero" <josem.palazon@...il.com>)
RE: what is this? ("Memisyazici, Aras" <arasm@...edu>)
Re: [Full-disclosure] what is this? (Gadi Evron <ge@...uxbox.org>)
Re: [Full-disclosure] what is this? ("crazy frog crazy frog" <i.m.crazy.frog@...il.com>)
Re[2]: what is this? (none <updates@...italis.com.au>)
Re: Linksys WRT54 GL - Session riding (CSRF) (Daniel Weber <dweber@...yptix.com>)
Re: Linksys WRT54 GL - Session riding (CSRF) (Valdis.Kletnieks@...edu)
iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTserver Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTServer Multiple Untrusted Pointer Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTserver Multiple Untrusted Pointer Offset Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTServer Multiple Untrusted Loop Bounds Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)

January 16 (26 messages)

Re: Defeating audio captcha systems (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: what is this? ("Yousef Syed" <yousef.syed@...il.com>)
[DSECRG-08-003] blogcms 4.2.1b Multiple Security Vulnerabilities ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
RichStrong CMS (showproduct.asp?cat=) Remote SQL Injection Exploit (sys-project@...mail.com)
[SECURITY] [DSA 1464-1] New syslog-ng packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
rPSA-2008-0015-1 cairo (rPath Update Announcements <announce-noreply@...th.com>)
cPanel Hosting Manager (dohtaccess.html) (no-reply@...a-security.net)
rPSA-2008-0016-1 postgresql postgresql-server (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0017-1 libxml2 (rPath Update Announcements <announce-noreply@...th.com>)
[DSECRG-08-002] Local File Include in arias 0.99-6 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
TPTI-08-01: Apple Quicktime Image File IDSC Atom Memory Corruption Vulnerability (DVLabs <dvlabs@...pingpoint.com>)
8e6 Technologies R3000 Internet Filter Bypass by Request Split (nnposter@...closed.not)
[Aria-Security.Net] Real Estate Web SQL Injection (no-reply@...a-security.net)
Cisco Security Advisory: Cisco Unified Communications Manager CTL Provider Heap Overflow (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
iDefense Security Advisory 01.15.08: Apple QuickTime Macintosh Resource Processing Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
mcGuestbook v1.2 Remote File Inc. (gokhankaya@...mail.com)
Peers static overflow in BitTorrent 6.0 and uTorrent 1.7.5 (Luigi Auriemma <aluigi@...istici.org>)
Country by Country Computer Sets now available for ISA 2004 ("Thor (Hammer of God)" <thor@...merofgod.com>)
TPTI-08-02: Cisco Call Manager CTLProvider Heap Overflow Vulnerability (DVLabs <dvlabs@...pingpoint.com>)
SQL scalar function to convert big int to dot notation ("Thor (Hammer of God)" <thor@...merofgod.com>)
[waraxe-2008-SA#062] - Multiple Sql Injections in MyBB 1.2.10 (come2waraxe@...oo.com)
[waraxe-2008-SA#061] - Remote Code Execution in MyBB 1.2.10 (come2waraxe@...oo.com)
Gradman <= 0.1.3 (agregar_info.php?tabla=) Local File Inclusion Exploit (sys-project@...mail.com)
[ MDVSA-2008:014 ] - Updated apache 1.3.x packages fix multiple vulnerabilities (security@...driva.com)
[USN-570-1] boost vulnerabilities (Jamie Strandboge <jamie@...ntu.com>)
[ MDVSA-2008:015 ] - Updated apache 2.0.x packages fix multiple vulnerabilities (security@...driva.com)

January 17 (18 messages)

[security bulletin] HPSBMA02133 SSRT061201 rev.7 - HP Oracle for OpenView (OfO) Critical Patch Update (security-alert@...com)
[SECURITY] [DSA 1465-1] New apt-listchanges packages fix arbitrary code execution (Steve Kemp <skx@...ian.org>)
JoomlaFlash Component Multiple Remote File Inclusion (Smasher@...cciamiilcalzino.it)
PHPEchoCMS Multible remote vulnerabilitis (security@...or.net)
rPSA-2008-0018-1 mysql mysql-bench mysql-server (rPath Update Announcements <announce-noreply@...th.com>)
Re: [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples (linlei99@...mail.com)
[ MDVSA-2008:016 ] - Updated apache 2.2.x packages fix multiple vulnerabilities (security@...driva.com)
rPSA-2008-0021-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] [DSA 1465-2] New apt-listchanges packages fix arbitrary code execution (Steve Kemp <skx@...ian.org>)
Re: Utimaco Safeguard Easy vulnerability (benleavett@...glemail.com)
Clever Copy <=3.0 Multiple Remote Vulnerabilities (hadihadi_zedehal_2006@...oo.com)
[CSNC] OKI C5510MFP Printer Password Disclosure ("Adrian Leuenberger" <adrian.leuenberger@...c.ch>)
RE: Skype videomood XSS ("avivra" <avivra@...il.com>)
CORE-2007-1119: CORE FORCE Kernel Buffer Overflow (CORE Security Technologies Advisories <advisories@...esecurity.com>)
iDefense Security Advisory 01.17.08: Multiple Vendor X Server XInput Extension Multiple Memory Corruption Vulnerabiliti… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 01.17.08: Multiple Vendor X Server TOG-CUP Extension Information Disclosure Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
iDefense Security Advisory 01.17.08: Multiple Vendor X Server EVI and MIT-SHM Extensions Integer Overflow Vulnerabiliti… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 01.17.08: Multiple Vendor X Server XFree86-Misc Extension Invalid Array Index Vulnerability (iDefense Labs <labs-no-reply@...fense.c…)

January 18 (22 messages)

ZDI-08-002: Citrix Presentation Server IMA Service Heap Overflow Vulnerability (zdi-disclosures@...m.com)
IMF 2008 - Call for Papers (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
[FIXED] Remote Denial of Service for SSH service at Dell DRAC4 (maybe Mocana SSH) (Robert Scheck <scheck@...s.de>)
[USN-571-1] X.org vulnerabilities (Kees Cook <kees@...ntu.com>)
Agares PhpAutoVideo 2.21(XSS/RFI) Multiple Remote Vulnerabilities (houssamix@...mail.fr)
common dns misconfiguration can lead to "same site" scripting (Tavis Ormandy <taviso@....lonestar.org>)
New search engine for exploits ("Security Basic" <security.basic@...il.com>)
Re: Member Area System (MAS) Remote File Include Vulnerability (view_func.php) (m3venge@...oo.com)
Making big money... (<jmacaranas@...d.com>)
SocksCap Stack Overflow (<= 2.40-051231) (azizov@...efence.ru)
Re: Country by Country ISA Computer Sets (The Fungi <fungi@...goth.org>)
Re: Country by Country ISA Computer Sets (GomoR <bt@...or.org>)
SinFP fingerprinting tool online demo (GomoR <bt@...or.org>)
RE: Country by Country ISA Computer Sets ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: mcGuestbook v1.2 Remote File Inc. (the.tiger100@...il.com)
Re: Article DashBoard all version SQL Injection Vulnerability (hey@...com)
RE: Country by Country ISA Computer Sets ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: Country by Country ISA Computer Sets ("Richard Powell" <bugtraq@...khawk.net>)
Re: Tiger Team: New TV series about pen testers airing on CourtTV Dec 25 11 pm (michael.lambie@...il.com)
MyBB 1.2.11 Multiple XSRF Vulnerabilities (nbbn@....net)
Re: Re: Utimaco Safeguard Easy vulnerability (joachim.schneider@...maco.de)
RE: Country by Country ISA Computer Sets ("Thor (Hammer of God)" <thor@...merofgod.com>)

January 19 (6 messages)

[USN-572-1] apt-listchanges vulnerability (Kees Cook <kees@...ntu.com>)
[USN-571-2] X.org regression (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1466-2] New xorg-server packages fix regression (Moritz Muehlenhoff <jmm@...ian.org>)
BitDefender Update Server - Unauthorized Remote File Access Vulnerability ("oliver karow" <oliver.karow@....de>)
[SECURITY] [DSA 1467-1] New mantis packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
Re: common dns misconfiguration can lead to "same site" scripting (Kurt Grutzmacher <grutz@...gojango.net>)

January 21 (25 messages)

RE: Country by Country ISA Computer Sets ("Thor (Hammer of God)" <thor@...merofgod.com>)
Bloofox CMS SQL Injection (Authentication bypass) , Source code disclosure (admin@...report.ir)
[SECURITY] [DSA 1468-1] New tomcat5.5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Php Search Remote Inclusion (effectiveness63@...il.com)
AXIGEN 5.0.x AXIMilter Format String Exploit ("hempel" <hempel@....com.br>)
MegaBBS ASP Forum Cross-Site Scripting (grossman@...oo.com)
Re: common dns misconfiguration can lead to "same site" scripting (Florian Weimer <fweimer@....de>)
WifiZoo v1.3 released (minor release) ("Hernan Ochoa" <hernan@...il.com>)
Flaw in Alice gate2 pluswifi adsl modem (wargame89@...oo.it)
boastMachine <=3.1 SQL Injection Vulnerbility (hadihadi_zedehal_2006@...oo.com)
[ GLSA 200801-09 ] X.Org X server and Xfont library: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
Pass-The-Hash Toolkit v1.2 released. ("Hernan Ochoa" <hernan@...il.com>)
Call Jacking: Phreaking the BT Home Hub ("Adrian P" <unknown.pentester@...il.com>)
[SECURITY] [DSA 1470-1] New horde3 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1469-1] New flac packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Belkin Wireless G Plus MIMO Router F5D9230-4 Authentication Bypass Vulnerability (gmdarkfig@...il.com)
[ GLSA 200801-07 ] Adobe Flash Player: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200801-08 ] libcdio: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[waraxe-2008-SA#063] - Information Leakage in Kayako SupportSuite 3.11.01 (come2waraxe@...oo.com)
[ MDVSA-2008:017 ] - Updated MySQL packages fix multiple vulnerabilities (security@...driva.com)
[waraxe-2008-SA#064] - Sql Injection in MyBB 1.2.11 (come2waraxe@...oo.com)
BLOG:CMS 4.2.1.c (DIR_PLUGINS) Multiple Remote File Include (رومانسي هكر <rxhr@...mail.com>)
[SECURITY] [DSA 1471-1] New libvorbis packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1472-1] New xine-lib packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Re: 8e6 Technologies R3000 Internet Filter Bypass by Request Split (mparker@....com)

January 22 (15 messages)

PR07-38: XSS on sIFR (ProCheckUp Research <research@...checkup.com>)
[ MDVSA-2008:019 ] - Updated cairo packages fix vulnerability (security@...driva.com)
Some hashes for the record ("Sergio 'shadown' Alvarez" <shadown@...il.com>)
Troopers 08 Security Conference, Call for Papers (Enno Rey <erey@...w.de>)
RE: Country by Country ISA Computer Sets (Jim Harrison <Jim@...tools.org>)
Re: common dns misconfiguration can lead to "same site" scripting (Florian Weimer <fweimer@....de>)
[SECURITY] [DSA 1473-1] New scponly packages fix arbitrary code execution (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2008:018 ] - Updated gFTP packages fix vulnerabilities (security@...driva.com)
Re: common dns misconfiguration can lead to "same site" scripting (David Malone <dwmalone@...hs.tcd.ie>)
PacerCMS Multiple Vulnerabilities (XSS/SQL) (db@...security.org)
Belong Site Builder 0.1b Bypass Admincp (رومانسي هكر <rxhr@...mail.com>)
DeluxeBB 1.1 XSS Vulnerabilitie (nbbn@....net)
Re: PR07-38: XSS on sIFR (bugs+securityfocus@...emberborn.net)
XSRF under Dean’s Permalinks Migration 1.0 (g30rg3_x <g30rg3x@...il.com>)
Apache mod_negotiation Xss and Http Response Splitting (Minded Security Research Labs <research@...dedsecurity.com>)

January 23 (15 messages)

SDL_Image 1.2.6 and prior GIF handling buffer overflow ("Gynvael Coldwind" <gynvael@...illium.org>)
PHP 5.2.5 cURL safe_mode bypass (cxib@...urityreason.com)
[security bulletin] HPSBUX02306 SSRT071463 rev.1 - HP-UX Running ARPA Transport, Remote Denial of Service (DoS) (security-alert@...com)
UPDATED VMSA-2008-0001.1 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages (VMware Security team <security@...are.co…)
Web Wiz Forums Directory traversal (admin@...report.ir)
Web Wiz Rich Text Editor Directory traversal + HTM/HTML file creation on the server (admin@...report.ir)
Web Wiz NewsPad Directory traversal (admin@...report.ir)
[ MDVSA-2008:020 ] - Updated xine-lib packages fix remote code execution vulnerabilities (security@...driva.com)
Cisco Security Advisory: Cisco PIX and ASA Time-to-Live Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Default Passwords in the Application Velocity System (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Syhunt: HFS (HTTP File Server) Template Cross-Site Scripting and Information Disclosure Vulnerabilities ("Felipe M. Aragon" <felipe@...unt.com>)
Syhunt: HFS (HTTP File Server) Log Arbitrary File/Directory Manipulation and Denial-of-Service Vulnerabilities ("Felipe M. Aragon" <felipe@...unt.com>)
Syhunt: HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability ("Felipe M. Aragon" <felipe@...unt.com>)
RE: Cisco Security Advisory: Cisco PIX and ASA Time-to-Live Vulnerability ("Eric Davis" <eric@...l.rockefeller.edu>)
Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability (nbbn@....net)

January 24 (17 messages)

[SECURITY] [DSA 1474-1] New exiv2 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200801-10 ] TikiWiki: Multiple vulnerabilities (Raphaël Marichez <raphael.marichez@...ytechnique.org>)
[SECURITY] [DSA 1444-2] New php5 packages fix regression (Moritz Muehlenhoff <jmm@...ian.org>)
PIX Privilege Escalation Vulnerability (tbbunn@....net)
[ MDVSA-2008:025 ] - Updated x11-server-xgl packages fix multiple vulnerabilities (security@...driva.com)
ImageShack Toolbar FileUploader Class insecurities (retrog@...ce.it)
[ MDVSA-2008:021 ] - Updated XFree86 packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:022 ] - Updated xorg-x11 packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:023 ] - Updated x11-server packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:024 ] - Updated libxfont packages fix font handling vulnerability (security@...driva.com)
Tiger PHP News System SQL Injection (0in.email@...il.com)
Re: PIX Privilege Escalation Vulnerability (Eloy Paris <elparis@...co.com>)
iDefense Security Advisory 01.23.08: IBM AIX pioout BSS Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
rPSA-2008-0029-1 bind bind-utils (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0030-1 CherryPy (rPath Update Announcements <announce-noreply@...th.com>)
iDefense Security Advisory 01.22.08: IBM Tivoli PMfOSD HTTP Request Method Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
phpBB 2.0.22 Remote PM Delete XSRF Vulnerability (nbbn@....net)

January 25 (13 messages)

Re: Re: PIX Privilege Escalation Vulnerability (tbbunn@....net)
Pre Hotel and Resorts reservation portal login bypass (milad_sa2007@...oo.com)
E-SMART CART bypass (milad_sa2007@...oo.com)
Pre Dynamic Institution bypass (milad_sa2007@...oo.com)
[CandyPress] eCommerce suite (SQL Injection + XSS + Path Disclosure) (Admin@...Report.IR)
gdb bug (digit2004@...online.net)
C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Authentication Vulnerability ("Eyal Udassin" <eyal.udassin@...security.com>)
C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow ("Eyal Udassin" <eyal.udassin@...security.com>)
C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Arbitrary File Upload and Execution ("Eyal Udassin" <eyal.udassin@...security.com>)
Re: PIX Privilege Escalation Vulnerability (Aaron Collins <collinsa@...waii.gov>)
Re: Peers static overflow in BitTorrent 6.0 and uTorrent 1.7.5 (Luigi Auriemma <aluigi@...istici.org>)
[ MDVSA-2008:026 ] - Updated icu packages fix vulnerabilities (security@...driva.com)
Two vulnerabilities for PatchLink Update Client for Unix. (lcashdol@...il.com)

January 26 (5 messages)

[ MDVSA-2008:027 ] - Updated pulseaudio packages fix local root vulnerability (security@...driva.com)
[SECURITY] [DSA 1475-1] new gforge packages fix cross site scripting (thijs@...ian.org (Thijs Kinkhorst))
Tool availability - browser DOM Checker (Michal Zalewski <lcamtuf@...ne.cc>)
F5 BIG-IP Web Management ASM Security Report XSS (nnposter@...closed.not)
PhPress-0.3.0 Read All Sql Information For Config (r2t@...mail.it)

January 28 (22 messages)

phpIP 4.3.2 - Numerous SQL Injection Vulnerablities ("Charles Hooper" <hoop2w1@...il.com>)
Metasploit Framework v3.1 Released (H D Moore <sflist@...italoffense.net>)
[SECURITY] [DSA 1476-1] New pulseaudio packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS (admin@...report.ir)
[ GLSA 200801-14 ] Blam: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200801-11 ] CherryPy: Directory traversal vulnerability (Robert Buchholz <rbu@...too.org>)
Facebook security contact (Alexander Sotirov <alex@...irov.net>)
ClanSphere 2007.4.4 Remote File Disclosure Vulnerability. (p4imi0 <p4imi0@...il.com>)
[SECURITY] [DSA 1477-1] New yarssr packages fix arbitrary shell command execution (Moritz Muehlenhoff <jmm@...ian.org>)
eTicket 'index.php' Cross Site Scripting Path Vulnerability (Alessandro Tanasi <alessandro@...erunners.net>)
Re: Simple Machines Forum Cross-Site Scripting Vulnerabilities (dev@...l.org)
Re: OneCMS Vulnerabilities (webmaster@...anevisions.com)
[ GLSA 200801-13 ] ngIRCd: Denial of Service (Robert Buchholz <rbu@...too.org>)
[ GLSA 200801-12 ] xine-lib: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
ASPired2Protect bypass (milad_sa2007@...oo.com)
WoltLab Burning Board 3.x.x Private Message Delete XSRF Vulnerability (nbbn@....net)
CORE-2007-1219: Firebird Remote Memory Corruption (Core Security Technologies Advisories <advisories@...esecurity.com>)
VB Marketing "tseekdir.cgi" Local File Inclusion (Sw33t.h4cK3r@...mail.securityfocus.com, com@...urityfocus.com)
Uninformed Journal Release Announcement: Volume 9 (Uninformed Journal <sflist@...italoffense.net>)
[SECURITY] [DSA 1478-1] New mysql-dfsg-5.0 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Exploit in IE6,7 (r2t@...mail.it)
Re: Exploit in IE6,7 (Nick FitzGerald <nick@...us-l.demon.co.uk>)

January 29 (13 messages)

Advisory: Tripwire Enterprise/Server XSS Vulnerability ("Liquidmatrix Security Digest" <disclosure@...uidmatrix.org>)
Re: C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow (pete.sage@...com)
Re: C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Arbitrary File Upload and Execution (pete.sage@...com)
Re: C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Authentication Vulnerability (pete.sage@...com)
[ GLSA 200801-15 ] PostgreSQL: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
PHPKIT 1.6.4 PL1 2 XSRF Vulnerabilities (nbbn@....net)
CSRF/XSS in Sungard Banner (banner@...n.org)
Remote File Disclosure in phpCMS 1.2.2 (Digital Security Research Group <research@...c.ru>)
Nucleus 3.31 XSS in path (Digital Security Research Group <research@...c.ru>)
Re: Remote File Disclosure in phpCMS 1.2.2 (3APA3A <3APA3A@...URITY.NNOV.RU>)
[!!FIX Information ] Nucleus 3.31 XSS in path (Digital Security Research Group <research@...c.ru>)
AmpJuke-0.7.0 (index.php) Xss VuLn. (g0rk3m-31@...mail.com)
Insecure Use of RC4 in LSrunasE and Supercrypt (CVE-2007-6340) (Daniel Roethlisberger <daniel.roethlisberger@...c.ch>)

January 30 (15 messages)

Recent Web Hacks: WHID update for Janury 30th 2008 (Ofer Shezaf <ofers@...ach.com>)
tinyBB v0.2 Message Board Remote File Inc. (g0rk3m-31@...mail.com)
[waraxe-2008-SA#065] - Remote Shell Command Execution in Coppermine 1.4.14 (come2waraxe@...oo.com)
Webspell 4.01.02 2 Vulnerabilites (nbbn@....net)
[ GLSA 200801-16 ] MaraDNS: CNAME Denial of Service (Raphael Marichez <falco@...too.org>)
[ GLSA 200801-17 ] Netkit FTP Server: Denial of Service (Raphael Marichez <falco@...too.org>)
[ MDVSA-2008:028 ] - Updated MySQL packages fix multiple vulnerabilities (security@...driva.com)
Yeşil Koridor Ziyareti Defteri (index.php) SqL. inj. (g0rk3m-31@...mail.com)
RE: Recent Web Hacks: WHID update for Janury 30th 2008 ("Michael Wojcik" <Michael.Wojcik@...roFocus.com>)
Cisco Security Advisory: Cisco Wireless Control System Tomcat mod_jk.so Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
PeteFinnigan.com Limited advisory for Oracle January 2008 CPU (Pete Finnigan <pete@...efinnigan.com>)
rPSA-2008-0032-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200801-18 ] Kazehakase: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200801-20 ] libxml2: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200801-19 ] GOffice: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)

January 31 (11 messages)

[ GLSA 200801-21 ] Xdg-Utils: Arbitrary command execution (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200801-22 ] PeerCast: Buffer overflow (Pierre-Yves Rofes <py@...too.org>)
contactforms "cforms-css.php" Remote File Inclusion (Sw33t.h4cK3r@...mail.securityfocus.com, com@...urityfocus.com)
[ MDVSA-2008:029 ] - Updated ruby packages fix possible man-in-the-middle attack (security@...driva.com)
[DSECRG-08-007] OpenBSD BGPD daemon Web Interface XSS. (Digital Security Research Group <research@...c.ru>)
[waraxe-2008-SA#066] - Multiple Vulnerabilities in Coppermine 1.4.14 (come2waraxe@...oo.com)
Re: [DSECRG-08-007] OpenBSD BGPD daemon Web Interface XSS. (Digital Security Research Group <research@...c.ru>)
Attackers can SkypeFind you ("avivra" <avivra@...il.com>)
sflog! 0.96 remote file disclosure vulnerabilities ("muuratsalo experimental hack lab" <muuratsalo@...il.com>)
[USN-573-1] PulseAudio vulnerability (Jamie Strandboge <jamie@...ntu.com>)
nilson's blogger 0.11 remote file disclosure vulnerabilities ("muuratsalo experimental hack lab" <muuratsalo@...il.com>)

443 messages

Powered by blists - more mailing lists