bugtraq mailing list - 2008/08

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 14	² 10	³
⁴ 10	⁵ 4	⁶ 18	⁷ 15	⁸ 38	⁹ 1	¹⁰
¹¹ 10	¹² 25	¹³ 21	¹⁴ 9	¹⁵ 7	¹⁶	¹⁷
¹⁸ 11	¹⁹ 5	²⁰ 4	²¹ 12	²² 15	²³ 2	²⁴
²⁵ 10	²⁶ 10	²⁷ 1	²⁸ 11	²⁹ 5	³⁰ 3	³¹

Messages by day:

August 1 (14 messages)

[ GLSA 200807-16 ] Python: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
CA ARCserve Backup for Laptops and Desktops Server LGServer Service Vulnerability ("Williams, James K" <James.Williams@...com>)
[CVE-2008-2370] Apache Tomcat information disclosure vulnerability (Mark Thomas <markt@...che.org>)
libxslt heap overflow (chris@...ry.beasts.org)
[SECURITY] [DSA 1625-1] New cupsys packages fix arbitrary code execution (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1626-1] New httrack packages fix arbitrary code execution (thijs@...ian.org (Thijs Kinkhorst))
[CVE-2008-1232] Apache Tomcat XSS vulnerability (Mark Thomas <markt@...che.org>)
[USN-634-1] OpenLDAP vulnerability (Kees Cook <kees@...ntu.com>)
eVision 2.0 Sql Injection/Remote File Disclosure/Remote File Upload/IG (r3d.w0rm@...oo.com)
DNS Multiple Race Exploiting Tool ("AR" <ar@...urebits.org>)
[USN-632-1] Python vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-633-1] libxslt vulnerabilities (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 07.31.08: Apple Mac OS X CoreGraphics PDF Type1 Font Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
n.runs-SA-2008.005 - Apple Inc. - CoreServices Framework’s CarbonCore Framework - Arbitrary Code Execution (remote) ("security@...ns.com" <security@...ns.com>)

August 2 (10 messages)

Re: how to request a cve id? ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
Re: Windows Vista Power Management & Local Security Policy ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
[ MDVSA-2008:160 ] libxslt (security@...driva.com)
file upload exploit (win32.exe@...n)
iDefense Security Advisory 08.01.08: Ingres Database for Linux verifydb Insecure File Permissions Modification Vulnerab… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 08.01.08: Ingres Database for Linux libbecompat Stack Based Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
iDefense Security Advisory 08.01.08: Ingres Database for Linux ingvalidpw Untrusted Library Path Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Pligg Auto-Voter Using XSS to Bypass CSRF Protection (michaelbrooks@...ksecurity.com)
Homes 4 Sale Remote XSS Vulnerabilitiy (Ghost hacker <ghost-r00t@...mail.com>)
Server termination in America's Army 2.8.3.1 (Luigi Auriemma <aluigi@...istici.org>)

August 4 (10 messages)

Keld: PHP-MySQL News Script 0.7.1 Remote SQL injection Vulnerability (crimson.loyd@...il.com)
TGS CMS Remote Code Execution Exploit (0in.email@...il.com)
[SECURITY] [DSA 1627-1] New opensc packages fix smart card vulnerability (thijs@...ian.org (Thijs Kinkhorst))
UNAK-CMS Lfi (r3d.w0rm@...oo.com)
[USN-626-2] Devhelp, Epiphany, Midbrowser and Yelp update (Jamie Strandboge <jamie@...onical.com>)
Team SHATTER Security Advisory: SQL Injection in Oracle Application Server (WWEXP_API_ENGINE) (Team SHATTER <shatter@...secinc.com>)
Team SHATTER Security Advisory: Cross-site scripting in Oracle Enterprise Manager (REFRESHCHOICE Parameter) (Team SHATTER <shatter@...secinc.com>)
Team SHATTER Security Advisory: SQL Injection in Oracle Database (DBMS_DEFER_SYS.DELETE_TRAN) (Team SHATTER <shatter@...secinc.com>)
CORE-2008-0716 - Sun xVM VirtualBox Privilege Escalation Vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
Xampp Linux 1.6.7 Multiple Cross Site Scripting Vulnerabilities (irancrash@...il.com)

August 5 (4 messages)

Pluck 4.5.2 Multiple Cross Site Scripting Vulnerabilities (irancrash@...il.com)
8e6 Technologies R3000 Internet Filter Bypass with Host Decoy (nnposter@...closed.not)
Plogger <= 3.0 SQL Injection (GulfTech Security Research <security@...ftech.org>)
IGES CMS <=2.0 Multiple Vulnerabilities (admin@...report.ir)

August 6 (18 messages)

[ GLSA 200808-01 ] xine-lib: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200808-02 ] Net-SNMP: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200808-03 ] Mozilla products: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200808-04 ] Wireshark: Denial of Service (Robert Buchholz <rbu@...too.org>)
rPSA-2008-0245-1 cups (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0246-1 gaim (rPath Update Announcements <announce-noreply@...th.com>)
PHP-NUKE module Kleinanzeigen SQL injection (lid) (lovebug@...mail.it)
MyClan Sql Injection (r3d.w0rm@...oo.com)
Re: 8e6 Technologies R3000 Internet Filter Bypass with Host Decoy (jyoung01@...ricafirst.com)
Interesting things at sec-consult.com, DNS-whitepaper available tomorrow (Bernhard Mueller <research@...-consult.com>)
CA Products That Embed Ingres Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Google Notebook and Google Bookmarks Cross Site Scripting Vulnerabilities (alfredo.melloni@...il.com)
Apache HTTP Server mod_proxy_ftp Wildcard Characters Cross-Site Scripting (marc_bevand@...id7.com)
[USN-635-1] xine-lib vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[ GLSA 200808-05 ] ISC DHCP: Denial of Service (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200808-06 ] libxslt: Execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
[security bulletin] HPSBUX02351 SSRT080058 rev.3 - HP-UX Running BIND, Remote DNS Cache Poisoning (security-alert@...com)
[security bulletin] HPSBUX02355 SSRT080023 rev.1 - HP-UX Using libc, Remote Denial of Service (DoS) (security-alert@...com)

August 7 (15 messages)

Re: [funsec] facebook messages worm (Gadi Evron <ge@...uxbox.org>)
OpenVMS fingerd remote stack overflow (Shaun Colley <scolleyuk@...mail.co.uk>)
Endless loop and resources consumption in Halo 1.0.7.0615 (Luigi Auriemma <aluigi@...istici.org>)
Re: [Full-disclosure] [funsec] facebook messages worm (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
facebook messages worm (Gadi Evron <ge@...uxbox.org>)
Whitepaper: DNS zone redelegation (Bernhard Mueller <research@...-consult.com>)
Re: [funsec] facebook messages worm (Gadi Evron <ge@...uxbox.org>)
Re: [funsec] facebook messages worm (Gadi Evron <ge@...uxbox.org>)
[SE-2008-01] J2ME Security Vulnerabilities 2008 (Security Explorations <contact@...urity-explorations.com>)
Re: OpenVMS fingerd remote stack overflow (Alexander Sotirov <alex@...irov.net>)
Re: OpenVMS fingerd remote stack overflow (mlbugtraq@...i.xs4all.nl)
Re: OpenVMS fingerd remote stack overflow ("Kevin Finisterre (lists)" <kf_lists@...italmunition.com>)
e107 <= 0.7.11 Arbitrary Variable Overwriting (GulfTech Security Research <security@...ftech.org>)
Re: [SE-2008-01] J2ME Security Vulnerabilities 2008 (0xjbrown41@...il.com)
[ MDVSA-2008:161 ] rxvt (security@...driva.com)

August 8 (38 messages)

[ MDVSA-2008:162 ] qemu (security@...driva.com)
[ MDVSA-2008:163 ] python (security@...driva.com)
re: [SE-2008-01] J2ME Security Vulnerabilities 2008 (Security Explorations <contact@...urity-explorations.com>)
[ MDVSA-2008:164 ] python (security@...driva.com)
Re: Re: [SE-2008-01] J2ME Security Vulnerabilities 2008 (0xjbrown41@...il.com)
Re: [funsec] facebook messages worm (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
OpenID/Debian PRNG/DNS Cache poisoning advisory ("Ben Laurie" <benl@...gle.com>)
[AJECT] NoticeWare IMAP Email Server 4.6.2 DoS vulnerability (João Antunes <jantunes@...fc.ul.pt>)
Vim: Unfixed Vulnerabilities in Tar Plugin Version 20 ("Jan Minář" <rdancer@...ncer.org>)
Re: [OpenID] OpenID/Debian PRNG/DNS Cache poisoning advisory (Gerald Beuchelt <beuchelt@....com>)
Re: [OpenID] OpenID/Debian PRNG/DNS Cache poisoning advisory ("Ben Laurie" <benl@...gle.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Eric Rescorla <ekr@...workresonance.com>)
[AJECT] WinGate Email Server (IMAP) vulnerability (João Antunes <jantunes@...fc.ul.pt>)
RE: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Dave Korn" <dave.korn@...imi.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Eric Rescorla <ekr@...workresonance.com>)
[ GLSA 200808-07 ] ClamAV: Multiple Denials of Service (Raphael Marichez <falco@...too.org>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Ben Laurie" <benl@...gle.com>)
[ GLSA 200808-08 ] stunnel: Security bypass (Raphael Marichez <falco@...too.org>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Dan Kaminsky <dan@...para.com>)
Re: [OpenID] OpenID/Debian PRNG/DNS Cache poisoning advisory (Dick Hardt <dick@...p.com>)
[DSECRG-08-035] Local File Include Vulnerability in Gallery 1.5.7, 1.6-alpha3 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
[ GLSA 200808-09 ] OpenLDAP: Denial of Service vulnerability (Raphael Marichez <falco@...too.org>)
RE: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Leichter, Jerry" <leichter_jerrold@....com>)
RE: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Dave Korn" <dave.korn@...imi.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (pgut001@...auckland.ac.nz (Peter Gutmann))
New paper: An Illustrated Guide to the Kaminsky DNS Vulnerability (Steve Friedl <steve@...xwiz.net>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Ben Laurie" <benl@...gle.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Perry E. Metzger" <perry@...rmont.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Eric Rescorla <ekr@...workresonance.com>)
Re: OpenVMS fingerd remote stack overflow (Tim Newsham <newsham@...a.net>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Nicolas Williams <Nicolas.Williams@....com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Nicolas Williams <Nicolas.Williams@....com>)
Re: [OpenID] OpenID/Debian PRNG/DNS Cache poisoning advisory ("Ben Laurie" <benl@...gle.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Nicolas Williams <Nicolas.Williams@....com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Leichter, Jerry" <leichter_jerrold@....com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Paul Hoffman <paul.hoffman@...c.org>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Eric Rescorla <ekr@...workresonance.com>)
key blacklisting & file size (was: OpenID/Debian PRNG/DNS Cache poisoning advisory) (Solar Designer <solar@...nwall.com>)

August 9 (1 message)

[security bulletin] HPSBUX02351 SSRT080058 rev.4 - HP-UX Running BIND, Remote DNS Cache Poisoning (security-alert@...com)

August 11 (10 messages)

Kayako SupportSuite < 3.30.00 Multiple Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
[ GLSA 200808-10 ] Adobe Reader: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
Ovidentia Sql Injection (r3d.w0rm@...oo.com)
[SECURITY] [DSA 1627-1] New PowerDNS packages reduce DNS spoofing risk (Florian Weimer <fw@...eb.enyo.de>)
Re: [DSECRG-08-035] Local File Include Vulnerability in Gallery 1.5.7, 1.6-alpha3 (o_0.iahumeil@...oo.com)
K-Links Directory Blind SQL Injection Exploit (hadihadi_zedehal_2006@...oo.com)
Apache Tomcat <= 6.0.18 UTF8 Directory Traversal Vulnerability (emericboit@...oo.fr)
rPSA-2008-0247-1 gvim vim vim-minimal (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0249-1 openldap openldap-clients openldap-servers (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200808-11 ] UUDeview: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)

August 12 (25 messages)

Re: Team SHATTER Security Advisory: SQL Injection in Oracle Database (DBMS_DEFER_SYS.DELETE_TRAN) (Team SHATTER <shatter@...secinc.com>)
Layered Defense Research Advisory: Alcatel-Lucent OmniSwitch products, Stack Buffer Overflow (dh@...ereddefense.com)
RE: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Clausen, Martin (DK - Copenhagen)" <mclausen@...oitte.dk>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Ben Laurie" <benl@...gle.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Ben Laurie" <benl@...gle.com>)
Re: TGS CMS Remote Code Execution Exploit (lcat <lcat@...il.dp.ua>)
iDefense Security Advisory 08.04.08: Solaris snoop SMB Decoding Multiple Format String Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 08.04.08: Solaris snoop SMB Decoding Multiple Stack Buffer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
[AJECT] hMailServer 4.4.1 DoS vulnerability (João Antunes <jantunes@...fc.ul.pt>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Forrest J. Cavalier III" <mibsoft@...software.com>)
Internet attacks against Georgian web sites (Gadi Evron <ge@...uxbox.org>)
VMSA-2008-0012 Updated VirtualCenter addresses User Account Disclosure Vulnerability (VMware Security Team <security@...are.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Leichter, Jerry" <leichter_jerrold@....com>)
rPSA-2008-0253-1 git gitweb (rPath Update Announcements <announce-noreply@...th.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (hal@...ney.org (\"Hal Finney\"))
VMSA-2008-0013 Updated ESX packages for OpenSSL, net-snmp, perl (VMware Security Team <security@...are.com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory ("Tim Dierks" <tim@...rks.org>)
CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Ben Laurie <ben@...ks.org>)
Surf Jack - HTTPS will not save you (lists@...blesecurity.com)
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory (Florian Weimer <fw@...eb.enyo.de>)
Re: [funsec] Internet attacks against Georgian web sites ("Paul Ferguson" <fergdawg@...zero.net>)
Re: [funsec] Internet attacks against Georgian web sites ("Paul Ferguson" <fergdawg@...zero.net>)
[security bulletin] HPSBUX02356 SSRT080051 rev.1 - HP-UX Running ftpd, Remote Privileged Access (security-alert@...com)

August 13 (21 messages)

ZDI-08-048: Microsoft Excel COUNTRY Record Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-051: Microsoft Internet Explorer Table Layout Memory Corruption Vulnerability (zdi-disclosures@...M.COM)
ZDI-08-049: Microsoft Windows Graphics Rendering Engine PICT Heap Corruption (zdi-disclosures@...m.com)
iDefense Security Advisory 08.12.08: Microsoft Office BMP Input Filter Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Vim: Netrw: FTP User Name and Password Disclosure (Tony Mechelynck <antoine.mechelynck@...il.com>)
[ MDVSA-2008:167 ] kernel (security@...driva.com)
ZDI-08-050: Microsoft Internet Explorer XHTML Rendering Memory Corruption Vulnerability (zdi-disclosures@...m.com)
[ MDVSA-2008:166 ] clamav (security@...driva.com)
[TKADV2008-006] CA HIPS KmxFw.sys Kernel Memory Corruption (Tobias Klein <tk@...pkit.de>)
iDefense Security Advisory 08.12.08: Microsoft Office WPG Image File Heap Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 08.12.08: Microsoft PowerPoint Viewer 2003 Out of Bounds Array Index Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 08.12.08: Microsoft PowerPoint Viewer 2003 Cstring Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Vim: Netrw: FTP User Name and Password Disclosure ("Jan Minář" <rdancer@...ncer.org>)
iDefense Security Advisory 08.12.08: Microsoft Excel Chart AxesSet Invalid Array Index Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 08.12.08: Microsoft Excel FORMAT Record Invalid Array Index Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 08.12.08: Microsoft Windows Color Management Module Heap Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
rPSA-2008-0243-1 idle python (rPath Update Announcements <announce-noreply@...th.com>)
Vim 7.2c.002 Fixes Arbitrary Command Execution when Handling Tar Archives ("Jan Minář" <rdancer@...ncer.org>)
NULL pointer in Ventrilo 3.0.2 (Luigi Auriemma <aluigi@...istici.org>)
[security bulletin] HPSBTU02358 SSRT080058 rev.1 - HP Tru64 UNIX running BIND, Remote DNS Cache Poisoning (security-alert@...com)
CORE-2008-0103: Internet Explorer Zone Elevation Restrictions Bypass and Security Zone Restrictions Bypass (CORE Security Technologies Advisories <advisories@c…)

August 14 (9 messages)

[ MDVSA-2008:170 ] cups (security@...driva.com)
Microsoft Windows Messenger Remote Illegal Access Vulnerability (cocoruder <cocoruder@...il.com>)
[ MDVSA-2008:168 ] stunnel (security@...driva.com)
[ MDVSA-2008:169 ] hplip (security@...driva.com)
[security bulletin] HPSBOV02357 SSRT080058 rev.1 - HP OpenVMS TCP/IP Services running BIND, Remote DNS Cache Poisoning (security-alert@...com)
Postfix local privilege escalation via hardlinked symlinks (wietse@...cupine.org (Wietse Venema))
SYM08-015_SFW_SecurityUpdateBypass ("Mike Prosser" <mprosser@...antec.com>)
ZDI-08-053: Symantec Veritas Storage Foundation Scheduler Service NULL Session Authentication Bypass Vulnerability (zdi-disclosures@...m.com)
Security Assessment of the Internet Protocol (Fernando Gont <fernando.gont@...il.com>)

August 15 (7 messages)

rPSA-2008-0255-1 freetype (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200808-12 ] Postfix: Local privilege escalation vulnerability (Raphael Marichez <falco@...too.org>)
Cisco Security Advisory: Vulnerability in Cisco WebEx Meeting Manager ActiveX Control (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface ("oliver karow" <oliver.karow@....de>)
munky-bliki lfi (r3d.w0rm@...oo.com)
Mambo 4.6.2 Full Version - Multiple Cross Site Scripting - By Khashayar Fereidani (irancrash@...il.com)
FlexCMS <= 2.5 Cross Site Scripting Vulnerability (irancrash@...il.com)

August 18 (11 messages)

[ MDVSA-2008:171 ] postfix (security@...driva.com)
[ MDVSA-2008:172 ] amarok (security@...driva.com)
PHP Live Helper <= 2.0.1 Multiple Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
Nokia 6131 NFC URI/URL Spoofing and DoS Advisory ("Collin R. Mulliner" <collin@...aversion.net>)
Tool: PorkBind v1.3 Nameserver Security Scanner (New Version) (Derek Callaway <super@...u.org>)
Re: ManageEngine Firewall Analyzer arbitrary file disclosure to authorized user (Eder Wentz <phacko@...il.com>)
NewsHOWLER 1.03 Beta Cookie Handling Via Sql injection (r3d.w0rm@...oo.com)
[DSECRG-08-036] Multiple Security Vulnerabilities in Freeway eCommerce 1.4.1.171 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
[security bulletin] HPSBMA02345 SSRT080039 rev.2 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting … (security-alert@...com)
Ovidentia 6.6.5 XSS (index.php)‏ (mostafa_ragab@....com)
[SECURITY] [DSA 1629-1] New postfix packages fix privilege escalation (thijs@...ian.org (Thijs Kinkhorst))

August 19 (5 messages)

[SECURITY] [DSA 1629-2] New postfix packages fix installability problem on i386 (thijs@...ian.org (Thijs Kinkhorst))
[security bulletin] HPSBST02360 SSRT080117 rev.2 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-041 to MS08-051 (security-alert@...com)
SunShop <= 4.1.4 SQL Injection (GulfTech Security Research <security@...ftech.org>)
Vanilla <= 1.1.4 Script Injection/ XSS (GulfTech Security Research <security@...ftech.org>)
[ MDVSA-2008:173 ] kdegraphics (security@...driva.com)

August 20 (4 messages)

[ MDVSA-2008:174 ] kernel (security@...driva.com)
ToorCon 10 Call For Papers ("David Hulton" <0x31337@...il.com>)
Folder Lock <= 5.9.5 Local Password Information Disclosure (glafkos@...osec.org.uk)
[USN-636-1] Postfix vulnerability (Kees Cook <kees@...ntu.com>)

August 21 (12 messages)

[ MDVSA-2008:175 ] yelp (security@...driva.com)
Null Byte Local file Inclusion in FAR - PHP Project version:1.0 (beenudel1986@...il.com)
IMF 2008 - Call for Participation (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
[ MDVSA-2008:176 ] mtr (security@...driva.com)
CORE-2008-0624: Anzio Web Print Object Buffer Overflow (CORE Security Technologies Advisories <advisories@...esecurity.com>)
CORE-2008-0813 - vBulletin Cross Site Scripting Vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
rPSA-2008-0259-1 postfix (rPath Update Announcements <announce-noreply@...th.com>)
UPDATE: [ GLSA 200804-22 ] PowerDNS Recursor: DNS Cache Poisoning (Robert Buchholz <rbu@...too.org>)
[ MDVSA-2008:177 ] xine-lib (security@...driva.com)
[ MDVSA-2008:178 ] xine-lib (security@...driva.com)
TimeTrex Time and Attendance Cookie Theft (DoZ@...kersCenter.com)
[SECURITY] [DSA 1630-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)

August 22 (15 messages)

RE: TimeTrex Time and Attendance Cookie Theft ("Alex Eden" <Alex.Eden@...et-int.com>)
Contest: Best Advances for OpenVAS Network Vulnerability Tests (Michael Wiegand <michael.wiegand@...evation.de>)
Vim: Arbitrary Code Execution in Commands: K, Control-], g] ("Jan Minář" <rdancer@...ncer.org>)
Call For Papers - Hackers 2 Hackers Conference 5th Edition - Brazil (cfp@...c.com.br)
Apple OSX Leopard (10.5+), inadequate ACL insight can create vuln (bgtrq.tryfixingit@...ichef.net)
PR08-20: Bypassing ASP .NET "ValidateRequest" for Script Injection Attacks (ProCheckUp Research <research@...checkup.com>)
[ MDVSA-2008:179 ] metisse (security@...driva.com)
[ MDVSA-2008:180 ] libxml2 (security@...driva.com)
Secunia Research: Trend Micro Products Web Management Authentication Bypass (Secunia Research <remove-vuln@...unia.com>)
Fedora confirms: Our servers were breached (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Re: Null Byte Local file Inclusion in FAR - PHP Project version:1.0 (William McAfee <sec-community@...goodhacker.com>)
[oCERT-2008-008] multiple heap overflows in xine-lib (Will Drewry <redpig@...rt.org>)
[SECURITY] [DSA 1631-1] New libxml2 packages fix denial of service (Steve Kemp <skx@...ian.org>)
Re: RE: TimeTrex Time and Attendance Cookie Theft (hi@...com)
Re: Fedora confirms: Our servers were breached (Dragos Ruiu <dr@....net>)

August 23 (2 messages)

Re: TimeTrex Time and Attendance Cookie Theft (Mike <ipso@...ppymail.ca>)
OneNews Beta 2 Multiple Vulnerabilities (crimson.loyd@...il.com)

August 25 (10 messages)

Secunia Research: Novell iPrint Client ActiveX Control "GetFileList()" Information Disclosure (Secunia Research <remove-vuln@...unia.com>)
RE: Arbitrary Code Execution in Commands: K, Control-], g] ("Michael Wojcik" <Michael.Wojcik@...roFocus.com>)
[DSECRG-08-038] Multiple Local File Include Vulnerabilities in ezContents CMS 2.0.3 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
Secunia Research: Calendarix Basic Two SQL Injection Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Novell iPrint Client ActiveX Control Multiple Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
[DSECRG-08-037] Multiple Local File Include Vulnerabilities in Pluck CMS 4.5.2 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
[IVIZ-08-006] DiskCryptor Security Model bypass exploiting wrong BIOS API usage ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
[IVIZ-08-009] Grub Legacy Security Model bypass exploiting wrong BIOS API usage ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
SECOBJADV-2008-03.2: PartyGaming PartyPoker Malicious Update Vulnerability (Security Objectives Corporation <advisories@...urity-objectives.com>)
Crafty Syntax Live Help <= 2.14.6 SQL Injection (GulfTech Security Research <security@...ftech.org>)

August 26 (10 messages)

Hopeless comments regarding the pointless "HP System Management Homepage (SMH) Unspecified XSS" ("Luca.carettoni" <luca.carettoni@...isoft.com>)
ZoneMinder Multiple Vulnerabilities (filip.palian@...stk.edu.pl)
Mini-NUKE v2.3 Freehost (tr) Multiple Remote SQL Injection Vulnerabilities (byccc@...e.com)
ToorCon X CFP Closing and Workshops and Seminars discounted until Friday! ("David Hulton" <0x31337@...il.com>)
[SECURITY] [DSA 1632-1] New tiff packages fix arbitrary code execution (thijs@...ian.org (Thijs Kinkhorst))
Multiple Vulnerabilities in AWStats Totals (Elliot Kendall <elliot.kendall@...ry.edu>)
[SECURITY] [DSA 1631-1] New libxml2 packages fix denial of service (Steve Kemp <skx@...ian.org>)
White Wolf Labs #080826-1: Kyocera Mita Scanner File Utility (Multiple) (Seth Fogie <seth@...tewolfsecurity.com>)
PacSec 2008 CFP (Deadline Sept. 1, Conference Nov. 12/13) and BA-Con 2008 Speakers (Sept .30/ Oct. 1) (Dragos Ruiu <dr@....net>)
[ MDVSA-2008:180-1 ] libxml2 (security@...driva.com)

August 27 (1 message)

[security bulletin] HPSBMA02363 SSRT080106 rev.1 - HP Enterprise Discovery Running on Windows, Remote Authorized User, Gain Extended Privi… (security-alert@...com)

August 28 (11 messages)

[IVIZ-08-008] LILO Security Model bypass exploiting wrong BIOS API usage ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
[USN-638-1] Yelp vulnerability (Kees Cook <kees@...ntu.com>)
[IVIZ-08-007] DriveCrypt Security Model bypass exploiting wrong BIOS API usage ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
[IVIZ-08-003] TrueCrypt Security Model bypass exploiting wrong BIOS API usage ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
[IVIZ-08-004] Intel BIOS Plain Text Password Disclosure ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
XSS and Data Manipulation attacks found in CMS PHPCart. ("vaibhav aher" <vaibhavaher@...il.com>)
[IVIZ-08-002] Hewlett-Packard BIOS Plain Text Password Disclosure ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
[security bulletin] HPSBUX02365 SSRT080118 rev.1 - HP-UX Running Apache, Remote Cross Site Scripting (XSS) or Denial of Service (DoS) (security-alert@...com)
[IVIZ-08-005] IBM Lenovo BIOS Plain Text Password Disclosure ("iViZ Security Advisories" <advisories@...ztechnosolutions.com>)
reviving the botnets@ mailing list: a new statregy in fighting cyber crime (Gadi Evron <ge@...uxbox.org>)
ZDI-08-054: Multiple Vendor libpurple MSN Protocol SLP Message Heap Overflow Vulnerability (zdi-disclosures@...m.com)

August 29 (5 messages)

[Advisory] Invision Power Board <= 2.3.5 Multiple Vulnerabilities and Security Bypass (gmdarkfig@...il.com)
[scip_Advisory 3807] Dreambox DM500 webserver long URL request denial of service (Marc Ruef <maru@...p.ch>)
[ MDVSA-2008:181 ] ipsec-tools (security@...driva.com)
[Exploit] Invision Power Board <= 2.3.5 Multiple Vulnerabilities (gmdarkfig@...il.com)
Re: [Exploit] Invision Power Board <= 2.3.5 Multiple Vulnerabilities (gmdarkfig@...il.com)

August 30 (3 messages)

VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information … (VMware Security team <security@...are.c…)
Re: [Advisory] Invision Power Board <= 2.3.5 Multiple Vulnerabilities and Security Bypass (gmdarkfig@...il.com)
[SECURITY] [DSA-1597-2] New mt-daapd package fix regression (Devin Carraway <devin@...ian.org>)

271 messages

Powered by blists - more mailing lists