bugtraq mailing list - 2008/05

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 14	² 14	³ 21	⁴
⁵ 19	⁶ 21	⁷ 18	⁸ 13	⁹ 10	¹⁰ 6	¹¹
¹² 16	¹³ 14	¹⁴ 20	¹⁵ 9	¹⁶ 5	¹⁷ 6	¹⁸
¹⁹ 13	²⁰ 33	²¹ 27	²² 19	²³ 7	²⁴ 5	²⁵
²⁶ 16	²⁷ 20	²⁸ 13	²⁹ 14	³⁰ 3	³¹ 5

Messages by day:

May 1 (14 messages)

XSS in AstroCam (Steffen Wendzel <cdp_xe@....net>)
iDefense Security Advisory 04.30.08: Akamai Download Manager Arbitrary Program Execution Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 1564-1] New wordpress packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1565-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.DBMS_AQJMS_INTERNAL (DB15) (Team SHATTER <shatter@...secinc.com>)
mjguest 6.7 (ALL VERSION) Xss & Redirection Vuln (irancrash@...il.com)
vlBook 1.21 (ALL VERSION) (irancrash@...il.com)
Team SHATTER Security Advisory: Oracle Database SQL Injection in SYS.DBMS_CDC_UTILITY.LOCK_CHANGE_SET (DB02) (Team SHATTER <shatter@...secinc.com>)
Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11) (Team SHATTER <shatter@...secinc.com>)
[SECURITY] [DSA 1565-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.DBMS_AQJMS_INTERNAL (DB15) (Team SHATTER <shatter@...secinc.com>)
Team SHATTER Security Advisory: Oracle Database SQL Injection in SYS.DBMS_CDC_UTILITY.LOCK_CHANGE_SET (DB02) (Team SHATTER <shatter@...secinc.com>)
mjguest 6.7 (ALL VERSION) Xss & Redirection Vuln (irancrash@...il.com)
php-addressbook v2.0 Multiple Remote Vulnerabilities (LFI/XSS) (irancrash@...il.com)

May 2 (14 messages)

Re: netOffice Dwins 1.3 Remote code execution. (luiswang@...r.sourceforge.net)
[SECURITY] [DSA 1566-1] New cpio packages fix denial of service (Steve Kemp <skx@...ian.org>)
BlackBook v1.0 Multiple XSS Vulnerabilities (irancrash@...il.com)
Lifetype 1.2.7 XSS Vulnerability (irancrash@...il.com)
project alumni v1.0.9 (info.php) SQL Injection Vulnerability (hadihadi_zedehal_2006@...oo.com)
Zomplog 3.8.2 XSS Vulnerability (irancrash@...il.com)
project alumni v1.0.9 (info.php) SQL Injection Vulnerability (hadihadi_zedehal_2006@...oo.com)
Zomplog 3.8.2 XSS Vulnerability (irancrash@...il.com)
Zomplog 3.8.2 XSS Vulnerability (irancrash@...il.com)
[ MDVSA-2008:095 ] - Updated OpenOffice.org packages fix vulnerabilities (security@...driva.com)
chicomas.2.0.4 (hadikiamarsi@...mail.com)
Denial of Service in Call of Duty 4 1.5 (Luigi Auriemma <aluigi@...istici.org>)
rPSA-2008-0157-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
blur6ex-0.3.462 LOCAL FILE INCLUSION Vulnerbility (hadihadi_zedehal_2006@...oo.com)

May 3 (21 messages)

Fixed: LiveCart SQL injection vulnerability fixed since version 1.1.2 (LiveCart <info@...ecart.com>)
[TOOL] SSL Capable NetCat (and more) (GomoR <bt@...or.org>)
Photos and Presentation Materials from HITBSecConf2008 - Dubai Released (Praburaajan <prabu@...kinthebox.org>)
SiteXS CMS Remote File Upload Vulnerability (hadikiamarsi@...mail.com)
Re: GroupWise 7.0 mailto: scheme buffer overflow (hollebcons@....com)
Photos and Presentation Materials from HITBSecConf2008 - Dubai Released (Praburaajan <prabu@...kinthebox.org>)
SiteXS CMS Remote File Upload Vulnerability (hadikiamarsi@...mail.com)
Photos and Presentation Materials from HITBSecConf2008 - Dubai Released (Praburaajan <prabu@...kinthebox.org>)
SiteXS CMS Remote File Upload Vulnerability (hadikiamarsi@...mail.com)
Maian Cart v1.1 XSS Vulnerabilities (irancrash@...il.com)
Maian Greeting v2.1 Multiple Vulnerabilities (XSS/SQL INJECTION) (irancrash@...il.com)
Maian Gallery v2.0 XSS Vulnerability (irancrash@...il.com)
Maian Search v1.1 Multiple Vulnerabilities (XSS/SQL INJECTION) (irancrash@...il.com)
Maian Gallery v2.0 XSS Vulnerability (irancrash@...il.com)
Maian Guestbook v3.2 XSS Vulnerabilities (irancrash@...il.com)
Maian Support v1.3 Xss Vulnerabilities (irancrash@...il.com)
Maian Recipe v1.2 Xss Vulnerabilities (irancrash@...il.com)
Maian Weblog v4.0 XSS Vulnerabilities (irancrash@...il.com)
Maian Links v3.1 XSS Vulnerabilities (irancrash@...il.com)
Multiple vulnerabilities in WebMod 0.48 (Luigi Auriemma <aluigi@...istici.org>)
Maian Music v1.1 Multiple Vulnerabilities (Xss/SQL Injection) (irancrash@...il.com)

May 5 (19 messages)

Re: Re: GroupWise 7.0 mailto: scheme buffer overflow (jplopezy@...il.com)
Microsot DID DISCLOSE potential Backdoor ("J. Oquendo" <sil@...iltrated.net>)
[USN-606-1] CUPS vulnerability (Jamie Strandboge <jamie@...onical.com>)
Re: Lifetype 1.2.7 XSS Vulnerability (securityfocus@....limedaley.com)
Maian Uploader v4.0 XSS Vulnerabilities (irancrash@...il.com)
LifeType 1.2.8 (irancrash@...il.com)
[SECURITY] [DSA 1567-1] New blender packages fix arbitrary code execution (Devin Carraway <devin@...ian.org>)
[ECHO_ADV_90$2008] PostNuke Module pnEncyclopedia <= 0.2.0 (id) Blind Sql Injection Vulnerability (erdc@...o.or.id)
[ECHO_ADV_91$2008] Online Rental Property Script <= 4.5 (pid) Blind Sql Injection Vulnerability (erdc@...o.or.id)
[SECURITY] [DSA 1568-1] New b2evolution packages fix cross site scripting (thijs@...ian.org (Thijs Kinkhorst))
[ECHO_ADV_95$2008] BackLinkSpider (cat_id) Blind Sql Injection Vulnerability (erdc@...o.or.id)
[ECHO_ADV_92$2008] Anserv Auction XL (viewfaqs.php cat) Blind Sql Injection Vulnerability (erdc@...o.or.id)
Scout Portal Toolkit <= 1.4.0 (ParentId) Remote SQL Injection Exploit (sys-project@...mail.com)
[ECHO_ADV_94$2008] Kmita Mail <= 3.0 (file) Remote File Inclusion Vulnerability (erdc@...o.or.id)
[SECURITY] [DSA 1569-1] New cacti packages fix multiple vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
[ECHO_ADV_93$2008] Kmita Tellfriend <= 2.0 (file) Remote File Inclusion Vulnerability (erdc@...o.or.id)
Novell eDirectory unauthenticated access to SOAP interface (Nicob <nicob@...ob.net>)
Novell eDirectory DoS via HTTP headers (Nicob <nicob@...ob.net>)
CORE-2008-0129 - Wonderware SuiteLink Denial of Service vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)

May 6 (21 messages)

[ GLSA 200805-01 ] Horde Application Framework: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200805-02 ] phpMyAdmin: Information disclosure (Pierre-Yves Rofes <py@...too.org>)
Security Advisory for Bugzilla 3.0.3, 3.1.3, 2.22.3, and 2.20.5 (mkanat@...zilla.org)
Advisory SE-2008-02: PHP GENERATE_SEED() Weak Random Number Seed Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
[SECURITY] [DSA 1569-2] New cacti packages fix regression (thijs@...ian.org (Thijs Kinkhorst))
Advisory SE-2008-03: PHP Multibyte Shell Command Escaping Bypass Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
[SECURITY] [DSA 1554-2] New roundup packages fix regression (thijs@...ian.org (Thijs Kinkhorst))
[tool announcement] tmin - a handy fuzzing test case optimizer (Michal Zalewski <lcamtuf@...ne.cc>)
HPSBUX02324 SSRT080034 rev.1 - HP-UX Running Netscape Directory Server (NDS), Local Gain Extended Privileges (security-alert@...com)
RE: Microsot DID DISCLOSE potential Backdoor (Ken Schaefer <Ken@...penStatic.com>)
HPSBUX02332 SSRT080056 rev.1 - HP-UX running Apache with PHP, Remote Denial of Service (DoS), Gain Extended Privileges (security-alert@...com)
[security bulletin] HPSBMA02331 SSRT080000 rev.2 - HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileg… (security-alert@...com)
[USN-607-1] Emacs vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-608-1] KDE vulnerability (Jamie Strandboge <jamie@...onical.com>)
QTOFileManager V 1.0<== Remote File Upload Vulnerability (Cr4zY.CrAcKeR@...mail.com)
Invitation - OWASP AppSec Europe May 19-22 2008 - Belgium ("Sebastien Deleersnyder" <seba@...eersnyder.eu>)
Power Editor LOCAL FILE INCLUSION Vulnerbility (hadihadi_zedehal_2006@...oo.com)
[SECURITY] [DSA 1570-1] New kazehakase packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)
[USN-605-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Sphider 1.3.4 Cross Site Scripting (decoder-bugtraq@...-hero.net)
mvnForum 1.1 Cross Site Scripting (decoder-bugtraq@...-hero.net)

May 7 (18 messages)

[ MDVSA-2008:097 ] - Updated kdelibs packages fix vulnerability in start_kdeinit (security@...driva.com)
[ MDVSA-2008:096 ] - Updated emacs packages fix vulnerability in vcdiff (security@...driva.com)
[ MDVSA-2008:098 ] - Updated openssh packages fix vulnerability (security@...driva.com)
Adobe Acrobat Professional Javascript For PDF Security Feature Bypass and Memory Corruption Vulnerabilities (cocoruder <cocoruder@...il.com>)
[Advisory Update]Adobe Reader/Acrobat Remote PDF Print Silently Vulnerability (cocoruder <cocoruder@...il.com>)
rPSA-2008-0157-1 kernel ("narita.hiroo" <narita.hiroo@...a.jp>)
rPSA-2008-0162-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
[USN-609-1] OpenOffice.org vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-610-1] LTSP vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 200805-03 ] Multiple X11 terminals: Local privilege escalation (Tobias Heinlein <keytoaster@...too.org>)
Multiple XSS In TuxCMS All Version (hadikiamarsi@...mail.com)
Re: QTOFileManager V 1.0<== Remote File Upload Vulnerability (Cr4zY.CrAcKeR@...mail.com)
VBZooM <=V1.11 "reply.php" SQL Injection Vulnerability (Cr4zY.CrAcKeR@...mail.com)
RE: Microsot DID DISCLOSE potential Backdoor (Ken Schaefer <Ken@...penStatic.com>)
Re: Microsot DID DISCLOSE potential Backdoor ("J. Oquendo" <sil@...iltrated.net>)
Re: Microsot DID DISCLOSE potential Backdoor ("J. Oquendo" <sil@...iltrated.net>)
Vulnerability in Multiple Web Application (linux0day@...oo.com)
Exploiting Google MX servers as Open SMTP Relays (pablo.ximenes@....edu)

May 8 (13 messages)

iDefense Security Advisory 05.07.08: Multiple Vendor rdesktop iso_recv_msg() Integer Underflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Novell Client <= 4.91 SP4 Local Stack overflow / B.S.O.D (unauthentificated user) (laurent.gaffie@...il.com)
Re: After 6 months - fix available for Microsoft DNS cache poisoning attack (rick.a.cook@...il.com)
[ GLSA 200805-04 ] eGroupWare: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
ZYWALL Referer Header XSS Vulnerability ("Deniz Cevik" <Deniz.Cevik@...ellect.com.tr>)
iDefense Security Advisory 05.07.08: Multiple Vendor rdesktop channel_process() Integer Signedness Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 05.07.08: Multiple Vendor rdesktop process_redirect_pdu() BSS Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
ezContents CMS Version 2.0.0 SQL Injection Vulnerabilities (hadihadi_zedehal_2006@...oo.com)
Re: [ECHO_ADV_91$2008] Online Rental Property Script <= 4.5 (pid) Blind Sql Injection Vulnerability (catalina.danila@...edchim.com)
Re: After 6 months - fix available for Microsoft DNS cache poisoning attack (Amit Klein <aksecurity@...il.com>)
[USN-611-1] Speex vulnerability (Jamie Strandboge <jamie@...onical.com>)
FLEA-2008-0008-1 firefox (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[USN-611-2] vorbis-tools vulnerability (Jamie Strandboge <jamie@...onical.com>)

May 9 (10 messages)

[USN-611-3] GStreamer Good Plugins vulnerability (Jamie Strandboge <jamie@...onical.com>)
Apache Server HTML Injection and UTF-7 XSS Vulnerability ("lament hero" <lament.hero@...il.com>)
[ MDVSA-2008:099 ] - Updated ImageMagick packages fix vulnerabilities (security@...driva.com)
XSS and CSRF vulnerability on Cpanel 11 (Matteo Carli <matteo@...teocarli.com>)
[ GLSA 200805-08 ] InspIRCd: Denial of Service (Robert Buchholz <rbu@...too.org>)
Oracle Application Server 10G ORA_DAV Basic Authentication Bypass Vulnerability ("Deniz Cevik" <Deniz.Cevik@...ellect.com.tr>)
[ GLSA 200805-06 ] Firebird: Data disclosure (Robert Buchholz <rbu@...too.org>)
FInal EUSecWest 2008 Speakers (Dragos Ruiu <dr@....net>)
[ GLSA 200805-07 ] Linux Terminal Server Project: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
SazCart <= 1.5.1 (prodid) Remote SQL Injection Exploit (sys-project@...mail.com)

May 10 (6 messages)

Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (cxib@...urityreason.com)
Re: Exploiting Google MX servers as Open SMTP Relays (Michael Scheidell <scheidell@...nap.net>)
OtherLogic[vocourse.php]SQL Injection Exploit (Breeeeh@...mail.com)
Re: Exploiting Google MX servers as Open SMTP Relays (Gadi Evron <ge@...uxbox.org>)
Re: Exploiting Google MX servers as Open SMTP Relays ("Todd T. Fries" <todd@...es.net>)
Re: Exploiting Google MX servers as Open SMTP Relays ("Todd T. Fries" <todd@...es.net>)

May 12 (16 messages)

Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (yos20053@...il.com)
[ GLSA 200805-09 ] MoinMoin: Privilege escalation (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1573-1] New rdesktop packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
[ MDVSA-2008:100 ] - Updated perl packages fix denial of service vulnerability (security@...driva.com)
Joomla Component xsstream-dm 0.01 Beta SQL Injection (houssamix@...mail.fr)
Re: Exploiting Google MX servers as Open SMTP Relays ("Bojan Zdrnja" <bojan.zdrnja@...il.com>)
[SECURITY] [DSA 1572-1] New php5 packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
Confirmed Program for SyScan'08 Hong Kong ("organiser@...can.org" <organiser@...can.org>)
[SECURITY] [DSA 1573-1] New php5 packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
Re: Exploiting Google MX servers as Open SMTP Relays (Clifton Royston <cliftonr@...a.net>)
[ GLSA 200805-10 ] Pngcrush: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
Re: Exploiting Google MX servers as Open SMTP Relays (Lamont Granquist <lamont@...iptkiddie.org>)
Re: Re: Exploiting Google MX servers as Open SMTP Relays (pablo.ximenes@....edu)
[SECURITY] [DSA 1574-1] New icedove packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBUX02334 SSRT071403 rev.1 - HP-UX Running ftp, Remote Denial of Service (DoS) (security-alert@...com)
Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (cxib@...urityreason.com)

May 13 (14 messages)

[ GLSA 200805-11 ] Chicken: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200805-12 ] Blender: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200805-13 ] PTeX: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[MajorSecurity Advisory #52]ActualAnalyzer family - Cross Site Scripting Issues (admin@...orsecurity.de)
[SECURITY] [DSA 1575-1] New Linux 2.6.18 packages fix denial of service (dann frazier <dannf@...ian.org>)
iDefense Security Advisory 05.12.08: Microsoft Windows I2O Filter Utility Driver (i2omgmt.sys) Local Privilege Escalati… (iDefense Labs <labs-no-reply@...fense.c…)
[SECURITY] [DSA 1571-1] New openssl packages fix predictable random number generator (Florian Weimer <fw@...eb.enyo.de>)
[USN-612-1] OpenSSL vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-612-2] OpenSSH vulnerability (Jamie Strandboge <jamie@...onical.com>)
TPTI-08-04: Microsoft Office Jet Database Engine Column Parsing Stack Overflow Vulnerability (DVLabs <dvlabs@...pingpoint.com>)
ZDI-08-023: Microsoft Office RTF Parsing Engine Memory Corruption Vulnerability (zdi-disclosures@...m.com)
iDefense Security Advisory 05.13.08: Microsoft Word CSS Processing Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200805-14 ] Common Data Format library: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
Cisco BBSM Captive Portal Cross-site Scripting (brad.antoniewicz@...ndstone.com)

May 14 (20 messages)

[SECURITY] [DSA 1577-1] New gforge packages fix insecure temporary files (thijs@...ian.org (Thijs Kinkhorst))
Microsoft Office Publisher PUB File Parsing Remote Memory Corruption Vulnerability (cocoruder <cocoruder@...il.com>)
Malformed Acrobat Distiller 8 .joboptions ("Paul Craig" <paul.craig@...urity-assessment.com>)
[USN-612-4] ssl-cert vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1576-1] New openssh packages fix predictable randomness (Florian Weimer <fw@...eb.enyo.de>)
CFP: European Conference on Computer Network Defense (Stefano Zanero <zanero@...t.polimi.it>)
[USN-612-5] OpenSSH update (Jamie Strandboge <jamie@...onical.com>)
Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@ci…)
Malformed Acrobat Distiller 8 .joboptions ("Paul Craig" <paul.craig@...urity-assessment.com>)
[ GLSA 200805-15 ] libid3tag: Denial of Service (Tobias Heinlein <keytoaster@...too.org>)
[USN-612-4] ssl-cert vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1577-1] New gforge packages fix insecure temporary files (thijs@...ian.org (Thijs Kinkhorst))
Cisco Security Advisory: Cisco Content Switching Module Memory Leak Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Content Switching Module Memory Leak Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@ci…)
Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: Cisco BBSM Captive Portal Cross-site Scripting (Eloy Paris <elparis@...co.com>)
Correction to BID 29112 "Apache Server HTML Injection and UTF-7 XSS Vulnerability" ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
[ GLSA 200805-16 ] OpenOffice.org: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[USN-612-6] OpenVPN regression (Jamie Strandboge <jamie@...onical.com>)

May 15 (9 messages)

Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability ("lament hero" <lament.hero@...il.com>)
Kostenloses Linkmanagementscript SQL Injection Vulnerabilities (hadihadi_zedehal_2006@...oo.com)
Debian generated SSH-Keys working exploit (mm@...dbeef.de)
Aruba Mobility Controller TACACS User Authentication and Cross Site Scripting Vulnerabilities (Aruba Advisory ID: AID-0… ("Robbie (Rupinder) Gill" <rgill@...bane…)
Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (Tom.Donovan@....org)
RE: Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities (UNCLASSIFIED) ("Walker, Theresa A CIV DISA CSD" <theresa.walker@...a.mil>)
SunShop Version 3.5.1 Remote Blind Sql Injection (irvian.info@...il.com)
ZDI-08-024: Symantec Altiris Deployment Solution SQL Injection Vulnerability (zdi-disclosures@...m.com)
ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential Disclosure Vulnerability (zdi-disclosures@...m.com)

May 16 (5 messages)

Hack.lu 2008 CfP (info <info@...k.lu>)
Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (Jon Ribbens <jon+bugtraq2@...quivocal.co.uk>)
[SECURITY] [DSA 1576-2] New openssh packages fix predictable randomness (Noah Meyerhans <noahm@...ian.org>)
[ MDVSA-2008:102 ] - Updated libvorbis packages fix vulnerabilities (security@...driva.com)
[ MDVSA-2008:101 ] - Updated rdesktop packages fix vulnerabilities (security@...driva.com)

May 17 (6 messages)

StanWeb.CMS (default.asp id) Remote SQL Injection Exploit (sys-project@...mail.com)
IOS rootkits (Gadi Evron <ge@...uxbox.org>)
CFP for HITBSecConf2008 - Malaysia now open (Praburaajan <prabu@...kinthebox.org>)
[SECURITY] [DSA 1578-1] New php4 packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
PHP-Nuke Module KuraniKerim [sid] SQL Injection (lovebug@...mail.it)
Re: Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (yos20053@...il.com)

May 19 (13 messages)

Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
Re: Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (Paul Szabo <psz@...hs.usyd.edu.au>)
Cpanel all version >> root access with a reseller account. (a.jasbi@...oo.com)
Re: Apple iPhone 1.1.3 remote DoS exploit (sohotguy@....com)
Smeego CMS vulnerability (0in.email@...il.com)
Insomnia : ISVA-080516.2 - Altiris Deployment Solution - Domain Account Disclosure ("Brett Moore" <brett.moore@...omniasec.com>)
Re: Re: Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (Tom.Donovan@....org)
Wordpress Malicious File Execution Vulnerability (tan_prathan@...mail.com)
Re: Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability (Tim <tim-security@...tinelchicken.org>)
[SECURITY] [DSA 1579-1] New netpbm-free packages fix arbitrary code execution (Devin Carraway <devin@...ian.org>)
DoS attacks using SQL Wildcards - White Paper ("Ferruh Mavituna" <ferruh@...ituna.com>)
Microsoft word javascript execution (jplopezy@...il.com)
Insomnia : ISVA-080516.1 - Altiris Deployment Solution - SQL Injection ("Brett Moore" <brett.moore@...omniasec.com>)

May 20 (33 messages)

Re: Cpanel all version >> root access with a reseller account. (dave@...nel.net)
Mtr - remote and local stack overflow - uncomment situation in libresolv. (pi3@...ec.pl)
[ MDVSA-2008:103 ] - Updated libid3tag packages fix denial of service vulnerability (security@...driva.com)
[security bulletin] HPSBST02336 SSRT080071 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-026 to MS08-029 (security-alert@...com)
ZDI-08-027: CA BrightStor ARCserve Backup Arbitrary File Writing Vulnerability (zdi-disclosures@...m.com)
AppServ Open Project < = 2.5.10 Remote XSS Vulnerability (tan_prathan@...mail.com)
An account of the Estonian Internet War (Gadi Evron <ge@...uxbox.org>)
[USN-612-7] OpenSSH update (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1580-1] New phpgedview packages fix privilege escalation (thijs@...ian.org (Thijs Kinkhorst))
eCMS-v0.4.2 (SQL/PB) Multiple Remote Vulnerabilities (hadihadi_zedehal_2006@...oo.com)
Vulnerability Advisory on GnuTLS (josh@...enomicon.com)
CA ARCserve Backup caloggerd and xdr Functions Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Vbulletin 3.7.0 Gold >> Sql injection on faq.php (a.jasbi@...oo.com)
Secunia Research: Foxit Reader "util.printf()" Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
ZDI-08-026: CA BrightStor ARCserve Backup Remote Buffer Overflow (zdi-disclosures@...m.com)
Starsgames Control Panel <= 4.6.2 Remote XSS Vulnerability (tan_prathan@...mail.com)
[security bulletin] HPSBUX02335 SSRT071454 rev.1 - HP-UX Running useradd(1M), Local Unauthorized Access (security-alert@...com)
[security bulletin] HPSBUX02332 SSRT080056 rev.2 - HP-UX Running Apache With PHP, Remote Denial of Service (DoS), Gain Extended Privileges (security-alert@...com)
[SECURITY] [DSA 1581-1] New gnutls13 packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)
Mantis Bug Tracker 1.1.1 Multiple Vulnerabilities (ascii <ascii@...amail.com>)
RE: An account of the Estonian Internet War ("Viktor Larionov" <viktor.larionov@...va.ee>)
[ GLSA 200805-17 ] Perl: Execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
[SECURITY] [DSA 1582-1] New peercast packages fix arbitrary code execution (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1583-1] New gnome-peercast packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1581-1] New gnutls13 packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1582-1] New peercast packages fix arbitrary code execution (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1583-1] New gnome-peercast packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
[ GLSA 200805-17 ] Perl: Execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
[SECURITY] [DSA 1583-1] New gnome-peercast packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
CORE-2008-0415: Borland Interbase 2007 Integer Overflow (CORE Security Technologies <advisories@...esecurity.com>)
[ GLSA 200805-19 ] ClamAV: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200805-18 ] Mozilla products: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
RE: An account of the Estonian Internet War (Gadi Evron <ge@...uxbox.org>)

May 21 (27 messages)

Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php (martin.meredith@...lletin.com)
[ MDVSA-2008:105 ] - Updated kernel packages fix vulnerabilities (security@...driva.com)
[DSECRG-08-023] SAP Web Application Server XSS Security Vulnerability (Digital Security Research Group <research@...c.ru>)
[DSECRG-08-020] Alcatel OmniPCX Office Remote Comand Execution (Digital Security Research Group <research@...c.ru>)
Re: mjguest 6.7 (ALL VERSION) Xss & Redirection Vuln (alighieri_m@...ero.it)
[ MDVSA-2008:105 ] - Updated kernel packages fix vulnerabilities (security@...driva.com)
Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php (martin.meredith@...lletin.com)
Cisco Security Advisory: Cisco IOS Secure Shell Denial of Service (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: Re: Re: Exploiting Google MX servers as Open SMTP Relays (pablo.ximenes@....edu)
[DSECRG-08-020] Alcatel OmniPCX Office Remote Comand Execution (Digital Security Research Group <research@...c.ru>)
Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php (martin.meredith@...lletin.com)
[USN-613-1] GnuTLS vulnerabilities (Kees Cook <kees@...ntu.com>)
[ MDVSA-2008:105 ] - Updated kernel packages fix vulnerabilities (security@...driva.com)
[USN-613-1] GnuTLS vulnerabilities (Kees Cook <kees@...ntu.com>)
[DSECRG-08-020] Alcatel OmniPCX Office Remote Comand Execution (Digital Security Research Group <research@...c.ru>)
Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php (martin.meredith@...lletin.com)
[ MDVSA-2008:105 ] - Updated kernel packages fix vulnerabilities (security@...driva.com)
Cisco Security Advisory: Cisco Voice Portal Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Voice Portal Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Voice Portal Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[USN-612-8] openssl-blacklist update (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1584-1] New libfissound packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)
Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php (Matias Blanco <blue@...est.com>)
CORE-2008-0126: Multiple vulnerabilities in iCal (Core Security Technologies Advisories <advisories@...esecurity.com>)
iDefense Security Advisory 05.21.08: Multiple Vendor Snort IP Fragment TTL Evasion Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
www file share pro 5.30 insecure multiple (output@...il.it)
CORE-2008-0126: Multiple vulnerabilities in iCal (Core Security Technologies Advisories <advisories@...esecurity.com>)

May 22 (19 messages)

MDAP ANTs PWNAGE: dumping the admin password of the BT Home Hub ("Adrian Pastor" <ap@...citizen.org>)
[ GLSA 200805-20 ] GnuTLS: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
ZDI-08-028: IBM Lotus Sametime Community Services Multiplexer Stack Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-029: Trillian AIM.DLL Long HTML Font Parameter Stack Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-030: Trillian Multiple Protocol XML Parsing Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-031: Trillian MSN MIME Header Stack-Based Overflow Vulnerability (zdi-disclosures@...m.com)
PHPFreeForum <= 1.0 RC2 Remote XSS Vulnerability (tan_prathan@...mail.com)
phpSQLiteCMS Multiple Remote XSS Vulnerability (tan_prathan@...mail.com)
[security bulletin] HPSBUX02337 SSRT080072 rev.1 - HP-UX Running HP-UX Secure Shell, Local Unauthorized Access and Denial of Service (DoS) (security-alert@...com)
Exteen Blog XSS Remote Cookie Disclosure Exploit (tan_prathan@...mail.com)
BMForum Remote 5.6 Miltiple XSS Vulnerability (tan_prathan@...mail.com)
PHPFreeForum <= 1.0 RC2 Remote XSS Vulnerability (tan_prathan@...mail.com)
/home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based syst… ("Asterisk Security Team" <security@...e…)
rPSA-2008-0174-1 gnutls (rPath Update Announcements <announce-noreply@...th.com>)
IRM Security Advisory : Barracuda Networks Spam Firewall Cross-Site Scripting Vulnerability ("Mark Crowther" <mark.crowther@...plc.com>)
abledating 2.4 >> Sql injection and cross site scripting on search_results.php (a.jasbi@...oo.com)
[SECURITY] [DSA 1586-1] New xine-lib packages fix several vulnerabilities (Devin Carraway <devin@...ian.org>)
Re: /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based system… (Florian Weimer <fw@...eb.enyo.de>)
Re: /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based system… (Florian Weimer <fw@...eb.enyo.de>)

May 23 (7 messages)

Re: Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php (andy.huang@...lletin.com)
[DSECRG-08-024] Multiple Security Vulnerabilities (RFI,LFI,XSS) in QuateCMS (Digital Security Research Group <research@...c.ru>)
e107 Plugin BLOG Engine v2.2 (macgurublog.php/uid) Blind SQL Injection Vulnerability (hadihadi_zedehal_2006@...oo.com)
[DSECRG-08-025] Local File Include in OneCMS 2.5 (Digital Security Research Group <research@...c.ru>)
PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN 'my.logon.php3' server-side script ("Ricardo Martins - Chief Security Officers"…)
rPSA-2008-0176-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-ima… (rPath Update Announcements <announce-no…)
xt:Commerce possible DoS (decoder-bugtraq@...-hero.net)

May 24 (5 messages)

[ MDVSA-2008:106 ] - Updated gnutls packages fix denial of service vulnerabilities (security@...driva.com)
vuln in WordPress plugin Upload File(UP) (my@...rg.ru)
dzoic handshakes sql injection >> index.php on $fname (a.jasbi@...oo.com)
Re: BosNews v4.0 Remote add user admin (sales@...dev.com)
PCPIN Chat 6: potential XSS vulnerability in URL redirection script (admin@...in.com)

May 26 (16 messages)

Ablespace 1.0 'cat_id' Parameter SQL Injection Vulnerability (a.jasbi@...oo.com)
Re: IOS rootkits (fwd) (Gadi Evron <ge@...uxbox.org>)
Re: vuln in WordPress plugin Upload File(UP) (none@...e.com)
Excuse Online (pwd) SQL Injection Vulnerability (unohope@...oot.org)
phpFix v2 Multiple SQL Injection Vulnerability (unohope@...oot.org)
function sleep() in all versions of PHP (gogulas@...pl)
Class System v2.3 Multiple Remote Vulnerabilities (unohope@...oot.org)
Campus Bulletin Board v3.4 Multiple Remote Vulnerabilities (unohope@...oot.org)
SECOBJADV-2008-01: Lenovo SystemUpdate SSL Certificate Issuer Spoofing Vulnerability ("Security Objectives, Inc." <advisories@...urity-objectives.com>)
Advisory - Rsyncrypto maybe affected from Debian OpenSSL reduced entropy problem (Aviram Jenik <aviram@...ondsecurity.com>)
Zina 1.0rc3 Remote Directory Traversal Vulnerability & XSS Vulnerability (irancrash@...il.com)
Mini-CWB <= 2.1.1 Remote XSS Vulnerability (tan_prathan@...mail.com)
Repair Online v1.2 (sentout) Create Admin Vulnerability (unohope@...oot.org)
[SECURITY] [DSA 1587-1] New mtr packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)
Re: function sleep() in all versions of PHP (Mark Sanders <mark@...nox.nl>)
T2'08: Call for Papers 2008 (Helsinki / Finland) (Tomi Tuominen <tomi.tuominen@...fi>)

May 27 (20 messages)

Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php (skyline@...oo.com)
[security bulletin] HPSBUX02335 SSRT071454 rev.2 - HP-UX Running useradd(1M), Local Unauthorized Access (security-alert@...com)
RoomPHPlanning 1.5 (weekview.php) SQL Injection Vulnerability (hadihadi_zedehal_2006@...oo.com)
IOS Rookit: the sky isn't falling (yet) (Nicolas FISCHBACH <nicolist@...urite.org>)
Re: CORE-2008-0126: Multiple vulnerabilities in iCal (security curmudgeon <jericho@...rition.org>)
Re: function sleep() in all versions of PHP (Juan Miguel - Prisma Virtual - <jmiguel@...smavirtual.com>)
Security, Open Source Style (Josh Bressers <bressers@...hat.com>)
Re: MDAP ANTs PWNAGE: dumping the admin password of the BT Home Hub ("Adrian Pastor" <ap@...citizen.org>)
Re: function sleep() in all versions of PHP (cxib@...urityreason.com)
[SECURITY] [DSA 1588-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Re: function sleep() in all versions of PHP ("Charles Morris" <cmorris@...odu.edu>)
Re: function sleep() in all versions of PHP ("Michael G. Reed" <reed@...t.org>)
rPSA-2008-0177-1 emacs emacs-leim (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200805-21 ] Roundup: Permission bypass (Tobias Heinlein <keytoaster@...too.org>)
Re: IOS Rookit: the sky isn't falling (yet) ("Felix 'FX' Lindner" <fx@...urity-labs.com>)
[ GLSA 200805-21 ] Roundup: Permission bypass (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200805-21 ] Roundup: Permission bypass (Tobias Heinlein <keytoaster@...too.org>)
iDefense Security Advisory 05.27.08: EMC AlphaStor Server Agent Multiple Stack Buffer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 05.27.08: EMC AlphaStor Library Manager Arbitrary Command Execution Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
ZDI-08-033: Motorola RAZR JPG Processing Stack Overflow Vulnerability (zdi-disclosures@...m.com)

May 28 (13 messages)

rPSA-2008-0178-1 php php-mysql php-pgsql (rPath Update Announcements <announce-noreply@...th.com>)
Re: function sleep() in all versions of PHP (Glynn Clements <glynn@...ements.plus.com>)
RE: function sleep() in all versions of PHP ("Michael Wojcik" <Michael.Wojcik@...roFocus.com>)
[NSG_28-5-08] CA Internet Security Suite 2008 (UmxEventCli.dll/SaveToFile()) remote file corruption poc (ipsdix@...il.com)
Re: CORE-2008-0126: Multiple vulnerabilities in iCal ("Steven M. Christey" <coley@...us.mitre.org>)
[SAMBA] CVE-2008-1105 - Boundary failure when parsing SMB responses ("Gerald (Jerry) Carter" <jerry@...ba.org>)
rPSA-2008-0105-1 evolution (rPath Update Announcements <announce-noreply@...th.com>)
Cisco Security Advisory: CiscoWorks Common Services Arbitrary Code Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
[security bulletin] HPSBUX02334 SSRT071403 rev.2 - HP-UX Running ftp, Remote Denial of Service (DoS) (security-alert@...com)
Vulnerability Advisory on OpenSSL (josh@...enomicon.com)
[ MDVSA-2008:107 ] - Updated openssl package fixes denial of service vulnerabilities (security@...driva.com)
Bypassing URL Authentication and Authorization with HTTP Verb Tampering ("Arshan Dabirsiaghi" <arshan.dabirsiaghi@...ectsecurity.com>)
Calcium web calendar: Reflected XSS (Marvin Simkin <Marvin.Simkin@....edu>)

May 29 (14 messages)

Secunia Research: Samba "receive_smb_raw()" Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: imlib2 PNM and XPM Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
FlashBlog Remote File Upload Vulnerability (mefisto@...kermail.com)
[ GLSA 200805-22 ] MPlayer: User-assisted execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200805-23 ] Samba: Heap-based buffer overflow (Tobias Heinlein <keytoaster@...too.org>)
Re: [HV-INFO] Enova hardware encryption: false sense of security (rwann@...vatech.com)
Flash Blog Sql Injection (16.her0@...il.com)
[ MDVSA-2008:108 ] - Updated samba packages fix arbitrary code execution vulnerability (security@...driva.com)
RE: Bypassing URL Authentication and Authorization with HTTP Verb Tampering (Jim Harrison <Jim@...tools.org>)
Re: [HV-INFO] Enova hardware encryption: false sense of security (rwann@...vatech.com)
dvbbs8.2(access/sql)version login.asp remote sql injection (hackerb@...mail.com)
Flash Blog Sql Injection (16.her0@...il.com)
Re: [HV-INFO] Enova hardware encryption: false sense of security (rwann@...vatech.com)
XEROX DocuShare URL XSS Injection Vulnerabilities (DoZ@...kersCenter.com)

May 30 (3 messages)

Dot Net Nuke (DNN) <= 4.8.3 XSS Vulnerability (Admin@...report.ir)
VMSA-2008-0008 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion resolve critical security issues (VMware Security team <security@...are.c…)
[SECURITY] [DSA 1590-1] New samba packages fix arbitrary code execution (Florian Weimer <fw@...eb.enyo.de>)

May 31 (5 messages)

[SECURITY] [DSA 1588-2] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
VisualSentinel 0.7 Cross Agent Scripting Vulnerability (bugtraq@...ncosmo.com)
LokiCMS Multiple Vulnerabilities through Authorization weakness (Alireza Hassani <trueend5@...oo.com>)
SQL Injection leading to authorization bypass in Torrent Trader Classic v1.08 and earlier ("Charles Vaughn" <cvaughn@...il.com>)
Re: VisualSentinel 0.7 Cross Agent Scripting Vulnerability (m.morcote@...mail.com)

381 messages

Powered by blists - more mailing lists