bugtraq mailing list - 2008/09

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 6	² 16	³ 20	⁴ 18	⁵ 14	⁶ 3	⁷
⁸ 15	⁹ 19	¹⁰ 23	¹¹ 15	¹² 12	¹³ 2	¹⁴
¹⁵ 7	¹⁶ 15	¹⁷ 12	¹⁸ 10	¹⁹ 13	²⁰ 6	²¹
²² 13	²³ 13	²⁴ 24	²⁵ 15	²⁶ 15	²⁷ 7	²⁸
²⁹ 27	³⁰ 15

Messages by day:

September 1 (6 messages)

Plesk 8.6.0 authentication flaw allows to gain virtual user priviledges (Felix Buenemann <Felix.Buenemann@....de>)
[SECURITY] [DSA 1627-2] New opensc package fix incomplete check (thijs@...ian.org (Thijs Kinkhorst))
Multiple Cross Site Scripting (XSS) Vulnerabilities in vtigerCRM 5.0.4, CVE-2008-3101 (Fabian Fingerle <fabian@...ensalat.eu>)
PoCfix (PoC for Postfix local root vuln - CVE-2008-2936) (Roman Medina-Heigl Hernandez <roman@...labs.com>)
rPSA-2008-0264-1 ruby (rPath Update Announcements <announce-noreply@...th.com>)
[oCERT-2008-014] WordNet stack and heap overflows (Rob Holland <rob@...rt.org>)

September 2 (16 messages)

ToorCon X Lineup & Training Seminars Posted & Pre-Registration Ending (h1kari@...rcon.org)
HPSBUX02354 SSRT080113 rev.1 - HP-UX Running Netscape / Red Hat Directory Server, Remote Cross Site Scripting (XSS) or Remote Denial of Se… (security-alert@...com)
Postfix Linux-only local denial of service (wietse@...cupine.org (Wietse Venema))
[security bulletin] HPSBMA02362 SSRT080044, SSRT080045 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Service (DoS) (security-alert@...com)
[SECURITY] [DSA 1633-1] New slash packages fix multiple vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)
[AJECT] Softalk IMAP Server 8.5.1 DoS vulnerability (João Antunes <jantunes@...fc.ul.pt>)
[SECURITY] [DSA 1634-1] New wordnet packages fix arbitrary code execution (thijs@...ian.org (Thijs Kinkhorst))
CS-Cart <= 1.3.5 SQL Injection (GulfTech Security Research <security@...ftech.org>)
[ MDVSA-2008:182 ] wordnet (security@...driva.com)
[Suspected Spam]New IETF I-D-: Security Assessment of the Internet Protocol version 4 (Fernando Gont <fernando.gont@...il.com>)
[Tool] sqlmap 0.6 released ("Bernardo Damele A. G." <bernardo.damele@...il.com>)
[USN-639-1] tiff vulnerability (Kees Cook <kees@...ntu.com>)
[ MDVSA-2008:183 ] opensc (security@...driva.com)
In search of examples of malicious source code (Steve.Coleman@...apl.edu)
T2´08 Challenge - Free Tickets Available (Tomi Tuominen <tomi.tuominen@...fi>)
Exploit (Admin@...st.ir)

September 3 (20 messages)

Has anyone implemented "double forward DNS"? (Duncan Simpson <dps@...pson.demon.co.uk>)
RUXCON 2008 Final Call For Papers (cfp@...con.org.au)
[Tool] Distack framework for attack detection and traffic analysis (Christoph Mayer <mayer@...uka.de>)
Secunia Research: Novell iPrint Client nipplib.dll "IppCreateServerRef()" Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
TransLucid 1.75 (fckeditor) Remote Arbitrary File Upload (admin@...report.ir)
Google Chrome Automatic File Download (nerex@...e.com)
RES: Google Chrome Automatic File Download ("DIOGO LEAL CHAGAS" <diogo.chagas@....com.br>)
Google Chrome Browser (ver.0.2.149.27) Vulnerability (psy.echo@...il.com)
Re: Google Chrome Automatic File Download ("Razi Shaban" <razishaban@...il.com>)
Cisco Security Advisory: Remote Access VPN and SIP Vulnerabilities in Cisco PIX and Cisco ASA (Cisco Systems Product Security Incident Response Team <psirt@...c…)
Cisco Secure ACS Denial Of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Secure ACS EAP Parsing Vulnerability (Laurent Butti <laurent.butti@...nge-ftgroup.com>)
Re: Has anyone implemented "double forward DNS"? (The Fungi <fungi@...goth.org>)
[ MDVSA-2008:185 ] python-django (security@...driva.com)
RE: Google Chrome Automatic File Download ("James C. Slora Jr." <james.slora@...a.com>)
[ MDVSA-2008:184 ] libtiff (security@...driva.com)
Re: Has anyone implemented "double forward DNS"? (Ansgar Wiechers <bugtraq@...netcobalt.net>)
FreeBSD Security Advisory FreeBSD-SA-08:08.nmount (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: In search of examples of malicious source code (Gabriele Zanoni <gabriele.zanoni@...urenetwork.it>)
Re: Has anyone implemented "double forward DNS"? (Jerry Franz <jfranz@...erun.com>)

September 4 (18 messages)

Re: Has anyone implemented "double forward DNS"? (terry white <twhite@...ota.com>)
Re: Has anyone implemented "double forward DNS"? (Glynn Clements <glynn@...ements.plus.com>)
FreeBSD Security Advisory FreeBSD-SA-08:09.icmp6 (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-08:07.amd64 (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Multiple Cross Site Scripting (XSS) and SQL injection Vulnerabilities in XRMS, CVE-2008-3664 (Fabian Fingerle <fabian@...ensalat.eu>)
Marvell Driver EAPoL-Key Length Overflow (Laurent Butti <laurent.butti@...nge-ftgroup.com>)
Marvell Driver Null SSID Association Request Vulnerability (Laurent Butti <laurent.butti@...nge-ftgroup.com>)
[USN-640-1] libxml2 vulnerability (Kees Cook <kees@...ntu.com>)
Re: Google Chrome Automatic File Download (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Atheros Vendor Specific Information Element Overflow (Laurent Butti <laurent.butti@...nge-ftgroup.com>)
Zen Cart <= 1.3.8a SQL Injection (GulfTech Security Research <security@...ftech.org>)
[ GLSA 200809-04 ] MySQL: Privilege bypass (Robert Buchholz <rbu@...too.org>)
[ GLSA 200809-01 ] yelp: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
clamav: Crash with crafted chm, CVE-2008-1389 (Hanno Böck <hanno@...eck.de>)
Re: Has anyone implemented "double forward DNS"? (Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>)
[ GLSA 200809-02 ] dnsmasq: Denial of Service and DNS spoofing (Robert Buchholz <rbu@...too.org>)
[ GLSA 200809-03 ] RealPlayer: Buffer overflow (Robert Buchholz <rbu@...too.org>)
Multiple MicroWorld products insecure directory permissions (Edi Strosar <edi.strosar@...il.com>)

September 5 (14 messages)

[ MDVSA-2008:186 ] python (security@...driva.com)
[security bulletin] HPSBMA02361 SSRT080119 rev.1 - HP OpenView Select Identity Connectors running on Windows, Local Information Disclosure (security-alert@...com)
[security bulletin] HPSBMA02361 SSRT080119 rev.1 - HP OpenView Select Identity Connectors running on Windows, Local Information Disclosure (security-alert@...com)
other google chrome crash (jplopezy@...il.com)
Re: Zen Cart <= 1.3.8a SQL Injection (Ian Wilson <ian@...-cart.com>)
rPSA-2008-0268-1 libtiff (rPath Update Announcements <announce-noreply@...th.com>)
Risky Chrome (The perfect cleartext password offering ) (quakerdoomer@...uy.com)
XCon 2008 Call for Paper (Sowhat <smaillist@...il.com>)
Re: XCon 2008 Call for Paper (Sowhat <smaillist@...il.com>)
Re: XCon 2008 Call for Paper (Sowhat <smaillist@...il.com>)
Re: Has anyone implemented "double forward DNS"? (Steven Bakker <steven.bakker@...-ix.net>)
Google Chrome 0.2.149.27 'SaveAs' Function Buffer Overflow Vulnerability ("Security Vulnerability Research Team" <svrt@...v.com.vn>)
Re: Oracle 10g Dynamic Monitoring Services XSS /servlet/Spy (dstinbox@...il.com)
[ GLSA 200809-05 ] Courier Authentication Library: SQL injection vulnerability (Pierre-Yves Rofes <py@...too.org>)

September 6 (3 messages)

[ MDVSA-2008:188 ] tomcat5 (security@...driva.com)
Re: RES: Google Chrome Automatic File Download (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Google Chrome Auto download exploit .. (security@...or.net)

September 8 (15 messages)

phpAdultSite CMS flaws (SmOk3 <smok3f00@...il.com>)
[ GLSA 200809-06 ] VLC: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
Re: [WEB SECURITY] PR08-20: Bypassing ASP .NET "ValidateRequest" for Script Injection Attacks (ProCheckUp Research <research@...checkup.com>)
[scip_Advisory 3808] D-Link DIR-100 long url filter evasion (Marc Ruef <maru@...p.ch>)
DEFCON London - DC4420 - September meet this Thursday 11th (Major Malfunction <majormal@...ate-radio.org>)
Re: Re: SECURITY ADVISORY - Level Platforms, Inc. Service Center Install Data HTTP Vulnerability (prenaud@...elplatforms.com)
xoops-1.3.10 shell command execute vulnerability ( causing snoopy class ) (geinblues@...il.com)
Sagem Router F@ST 2404 Remote Denial Of Service Exploit (zigma@...erz0ne.net)
Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit (Rotem Kerner <rotem@...sec.com>)
WASC Announcement: 2007 Web Application Security Statistics Published (statistics@...appsec.org)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit (a@b.c)
[ GLSA 200809-07 ] libTIFF: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit (Mike Duncan <Mike.Duncan@...a.gov>)
[ GLSA 200809-08 ] Amarok: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit ("Wellington Wagner F. Sarmento" <wwagner33@...il.com>)

September 9 (19 messages)

Re: Sagem Router F@ST 2404 Remote Denial Of Service Exploit ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit (gynvael@...illium.org)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit ("Razi Shaban" <razishaban@...il.com>)
[USN-641-1] Racoon vulnerabilities (Kees Cook <kees@...ntu.com>)
Stash v1.0.3 Admin bypass / Remote File Disclosure (r3d.w0rm@...oo.com)
Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit (Rotem Kerner <rotem@...sec.com>)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit ("Razi Shaban" <razishaban@...il.com>)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit (Mike Duncan <Mike.Duncan@...a.gov>)
Re: Sun M-class hardware denial of service ("B 650" <dunc.on.usenet@...glemail.com>)
ZDI-08-055: Microsoft Windows GDI+ BMP Parsing Code Execution Vulnerability (zdi-disclosures@...m.com)
ZDI-08-056: Microsoft Windows GDI+ GIF Parsing Code Execution Vulnerability (zdi-disclosures@...m.com)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Re: Sun M-class hardware denial of service ("B 650" <dunc.on.usenet@...glemail.com>)
ZDI-08-058: Apple QuickTime Panorama PDAT Atom Parsing Buffer Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-059: Apple QuickTime STSZ Atom Parsing Heap Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-060: Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability (zdi-disclosures@...m.com)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
SQL Smuggling (douglen@...mail.com)

September 10 (23 messages)

[SECURITY] CVE-2008-2938 - Apache Tomcat information disclosure vulnerability - Updated (Mark Thomas <markt@...che.org>)
DeepSec 2008 - Conference Schedule (DeepSec Conference Vienna <deepsec@...psec.net>)
Re: SQL Smuggling (Marco Ivaldi <raptor@...iaservice.net>)
RE: Sun M-class hardware denial of service ("Michael Wojcik" <Michael.Wojcik@...roFocus.com>)
Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit (Julien Stuby <julien.stuby@...eam-vision.net>)
Re: Sun M-class hardware denial of service ("Micheal Patterson" <micheal@...cq.com>)
ZDI-08-061: Apple QuickTime Player H.264 Parsing Heap Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-062: Apple QuickTime MDAT Frame Parsing Memory Corruption Vulnerability (zdi-disclosures@...m.com)
Re: Sun M-class hardware denial of service (Bob Beck <beck@...berta.ca>)
Insomnia : ISVA-080910.1 - MS Office OneNote URL Handling Vulnerability ("Brett Moore" <brett.moore@...omniasec.com>)
Re: SQL Smuggling (Tim <tim-security@...tinelchicken.org>)
iDefense Security Advisory 09.09.08: Apple QuickTime PICT Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Multiple Vulnerabilities: LedgerSMB < 1.2.15 ("Chris Travers" <chris.travers@...il.com>)
[ MDVSA-2008:189 ] clamav (security@...driva.com)
iDefense Security Advisory 09.09.08: Microsoft Windows GDI+ Gradient Fill Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Windows GDI+ GIF memory corruption ("Ivan Fratric" <ifsecure@...il.com>)
[oCERT-2008-012] Horde, Popoon frameworks common input sanitization errors (XSS) (Will Drewry <redpig@...rt.org>)
Re: E-Php B2B Trading Marketplace(cid) Remote SQL Injection Vulnerability (packet@...ketstormsecurity.org)
Re: Sun M-class hardware denial of service (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2008:190 ] postfix (security@...driva.com)
ZDI-08-057: Apple QuickTime IV32 Codec Parsing Stack Overflow Vulnerability (zdi-disclosures@...m.com)
Re: Sun M-class hardware denial of service (terry white <twhite@...ota.com>)
[SECURITY] [DSA 1635-1] New freetype packages fix multiple vulnerabilities (Steve Kemp <skx@...ian.org>)

September 11 (15 messages)

[USN-642-1] Postfix vulnerabilities (Kees Cook <kees@...ntu.com>)
Ezphotogallery 2.1 Multiple Vulnerabilities ( Xss/Login Bypass/Sql injection Exploit/File Disclosure) (irancrash@...il.com)
Re: Sun M-class hardware denial of service (Brett Lymn <blymn@...systems.com.au>)
Re: Sun M-class hardware denial of service (Curtis Maloney <cmaloney@...dgate.net>)
ZoneAlarm Security Suite buffer overflow (jplopezy@...il.com)
PhpWebGallery 1.3.4 Multiple Vulnerabilities (XSS/LFI) (irancrash@...il.com)
sqlvdir.dll ActiveX Remote Buffer Overflow Exploit (beenudel1986@...il.com)
PhsBlog v0.2 Bypass Sql injection Filtering Exploit (irancrash@...il.com)
minb Remote Code Execution Exploit (r3d.w0rm@...oo.com)
[security bulletin] HPSBOV02364 SSRT080078 rev.1 - HP OpenVMS SMGRTL Run Time Library, Local Authorized User, Gain Privileged Access (security-alert@...com)
Nooms 1.1 (irancrash@...il.com)
Advisory 04/2008: Joomla Weak Random Password Reset Token Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
RE: SQL Smuggling (Gary Oleary-Steele <GaryO@...-1.com>)
[SECURITY] [DSA 1636-1] New Linux 2.6.24 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
[TKADV2008-007] Linux Kernel SCTP-AUTH API Information Disclosure Vulnerability and NULL Pointer Dereferences (Tobias Klein <tk@...pkit.de>)

September 12 (12 messages)

[ MDVSA-2008:191 ] rsh (security@...driva.com)
Advisory 05/2008: Wordpress user_login Column SQL Truncation Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
Re: OpenWiki<--v0.78 Cross-Site Scripting (DJeep@...nWiki.com)
Secunia Research: Trend Micro OfficeScan "cgiRecvFile.exe" Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[USN-643-1] FreeType vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-644-1] libxml2 vulnerabilities (Kees Cook <kees@...ntu.com>)
Server termination in the Unreal engine 3 (Luigi Auriemma <aluigi@...istici.org>)
Clients format strings in the Unreal engine (Luigi Auriemma <aluigi@...istici.org>)
[ MDVSA-2008:192 ] libxml2 (security@...driva.com)
Avant Browser <= 11.7 Build 9 Integer Denial Of Service Exploit (Guns@...0.com.ar)
community real-time BGP hijack notification service (Gadi Evron <ge@...uxbox.org>)
[scip_Advisory 3809] Pro2col StingRay FTS login username cross site scripting (Marc Ruef <maru@...p.ch>)

September 13 (2 messages)

CORE-2008-0126: iPhone Safari JavaScript alert Denial of Service (Core Security Technologies Advisories <advisories@...esecurity.com>)
Baidu Hi IM software parsing plaintext stack overflow ("Li Gen" <superligen@...il.com>)

September 15 (7 messages)

[ MDVSA-2008:193 ] kolab-server (security@...driva.com)
[ MDVSA-2008:194 ] apache2 (security@...driva.com)
[ MDVSA-2008:195 ] apache (security@...driva.com)
Baidu Hi IM client software DoS bug, div zero make client crash ("Li Gen" <superligen@...il.com>)
Microsoft Windows WRITE_ANDX SMB command handling Kernel DoS (j.v.vallejo@...il.com)
[SECURITY] [DSA 1637-1] New git-core packages fix buffer overflow (Devin Carraway <devin@...ian.org>)
Critical Vulnerability in Apple Quicktime’s Indeo Codec (NGSSoftware Insight Security Research <nisr@...software.com>)

September 16 (15 messages)

TPTI-08-06: Landesk QIP Server Service Heal Packet Buffer Overflow (dvlabs <dvlabs@...pingpoint.com>)
[ MDVSA-2008:196 ] mplayer (security@...driva.com)
Security flaw in Airtel DSL modems (shr@...miwal.net)
[ MDVSA-2008:182-1 ] wordnet (security@...driva.com)
[ MDVSA-2008:197 ] koffice (security@...driva.com)
InstallShield Update Agent - Downloads and executes "Rule Scripts" insecurely. ("Brian Dowling" <bjd@...plicity.net>)
Failed assertion in the Unreal engine (Luigi Auriemma <aluigi@...istici.org>)
Team SHATTER Security Advisory: Security Vulnerability in CLR stored procedure deployment from IBM Database Add-Ins for Visual … (Shatter <shatter@...secinc.com>)
Team SHATTER Security Advisory: IBM DB2 UDB - Buffer overrun in XMLQUERY and XMLEXISTS (Shatter <shatter@...secinc.com>)
[SECURITY] [DSA 1638-1] New openssh packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)
[NOBYTES.COM: #12] osCommerce 2.2rc2a - Information Disclosure ("John Cobb" <johnc@...ytes.com>)
[Suspected Spam][CVE-2008-4042] Postfix Linux-only local denial of service - PoC (Albert Sellarès <whats@...k.net>)
[ MDVSA-2008:198 ] R-base (security@...driva.com)
[ECHO_ADV_101$2008] Attachmax Dolphin <= 2.1.0 Multiple Vulnerabilities (adv@...dc.org)
[NOBYTES.COM: #14] Quick.Cms.Lite v2.1 Freeware - Cross Site Scripting ("John Cobb" <johnc@...ytes.com>)

September 17 (12 messages)

[NOBYTES.COM: #13] Quick.Cart v3.1 Freeware - Cross Site Scripting ("John Cobb" <johnc@...ytes.com>)
[ MDVSA-2008:197-1 ] koffice (security@...driva.com)
Skype IM Client Password Disclosure Vulnerability. (Aditya K Sood <0kn0ck@...niche.org>)
Miranda IM Client Password Disclosure Vulnerability. (Aditya K Sood <0kn0ck@...niche.org>)
Pidgin IM Client Password Disclosure Vulnerability. (Aditya K Sood <0kn0ck@...niche.org>)
[AJECT] SurgeMail IMAP 3.9e vulnerability (João Antunes <jantunes@...fc.ul.pt>)
Microsoft Internet Explorer DoS in Rendering Malicious PNG Files. (Aditya K Sood <0kn0ck@...niche.org>)
ShmooCon 2009 CFP (Bruce Potter <gdead@...oo.com>)
[security bulletin] HPSBMA02369 SSRT080115 rev.1 - HP ProLiant Essentials Rapid Deployment Pack (RDP) Running Symantec Altiris Deployment … (security-alert@...com)
rPSA-2008-0278-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0276-1 mercurial mercurial-hgk (rPath Update Announcements <announce-noreply@...th.com>)
[ MDVSA-2008:189-1 ] clamav (security@...driva.com)

September 18 (10 messages)

RE: Pidgin IM Client Password Disclosure Vulnerability. ("Quark IT - Hilton Travis" <Hilton@...rkIT.com.au>)
Sama XSS Bug (Lagon666@...oo.com)
[security bulletin] HPSBOV02364 SSRT080078 rev.2 - HP OpenVMS SMGRTL Run Time Library, Local Authorized User, Gain Privileged Access (security-alert@...com)
Hi Two Points to consider (Aditya K Sood <adi_ks@...niche.org>)
Re: Pidgin IM Client Password Disclosure Vulnerability. (Aditya K Sood <0kn0ck@...niche.org>)
menalto gallery: Session hijacking vulnerability, CVE-2008-3662 (Hanno Böck <hanno@...eck.de>)
Re: Pidgin IM Client Password Disclosure Vulnerability. (Siim Põder <siim@...rad-teel.net>)
cyask 3.x Local File Inclusion Vulnerability (xuanmumu@...il.com)
RE: Pidgin IM Client Password Disclosure Vulnerability. ("Memisyazici, Aras" <arasm@...edu>)
vi can run arbitrary commands via 'tags' file (Eli the Bearded <*@....users.panix.com>)

September 19 (13 messages)

VMSA-2008-0015 Updated ESXi and ESX 3.5 packages address critical security issue in openwsman (VMware Security Team <security@...are.com>)
LooYu Web IM 2008 Cross-Site Scripting Vulnerabilities (xsp <xisigr@...il.com>)
PHP pro bid v 6.04 SQL injection ("Jan van Niekerk" <jvnkrk@...il.com>)
Re: Pidgin IM Client Password Disclosure Vulnerability. (John Bailey <rekkanoryo@...kanoryo.org>)
Re: Pidgin IM Client Password Disclosure Vulnerability. (Steve Shockley <steve.shockley@...ckley.net>)
[USN-646-1] rdesktop vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
RE: Pidgin IM Client Password Disclosure Vulnerability. ("Memisyazici, Aras" <arasm@...edu>)
RE: Pidgin IM Client Password Disclosure Vulnerability. ("Quark IT - Hilton Travis" <Hilton@...rkIT.com.au>)
Re: Pidgin IM Client Password Disclosure Vulnerability. (John Bailey <rekkanoryo@...kanoryo.org>)
Annutel - Annuaire T�l�phonique v1.0 Sensetive Files (MDP) (sn0oPy.team@...il.com)
[SECURITY] [DSA 1639-1] New twiki packages execution of arbitrary code (Steve Kemp <skx@...ian.org>)
[ GLSA 200809-09 ] Postfix: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[ MDVSA-2008:199 ] wireshark (security@...driva.com)

September 20 (6 messages)

[SECURITY] [DSA 1640-1] New python-django packages fix cross site request forgery (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1641-1] New phpmyadmin packages fix several issues (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1642-1] New horde3 packages fix cross site scripting (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1634-2] New wordnet packages fix regression (thijs@...ian.org (Thijs Kinkhorst))
Advanced Electron Forum <= 1.0.6 Remote Code Execution (GulfTech Security Research <security@...ftech.org>)
MyFWB 1.0 Remote SQL Injection (Guns@...0.com.ar)

September 22 (13 messages)

[security bulletin] HPSBUX02370 SSRT071459 rev.1 - HP-UX Running rpcbind, Remote Denial of Service (DoS) (security-alert@...com)
drupal: Session hijacking vulnerability, CVE-2008-3661 (Hanno Böck <hanno@...eck.de>)
MapCal - The Mapping Calendar (v. 0.1) Remote SQL Injection (Guns@...0.com.ar)
Blue Coat xss (jplopezy@...il.com)
"Exploit creation - The random approach" or "Playing with random to build exploits" ("Nelson Brito" <nbrito@...ure.org>)
[ GLSA 200809-10 ] Mantis: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200809-11 ] HAVP: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
Directory traversal in the webadmin of Unreal Tournament 3 1.3 (Luigi Auriemma <aluigi@...istici.org>)
[MajorSecurity Advisory #53]BLUEPAGE CMS - Cross Site Scripting and Session Fixation Issues (admin@...orsecurity.de)
[MajorSecurity Advisory #54]xt:Commerce - Cross Site Scripting and Session Fixation Issues (admin@...orsecurity.de)
[SECURITY] [DSA-1619-2] New python-dns package fixes regression (Devin Carraway <devin@...ian.org>)
Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02, CVE-2008-3098 (Fabian Fingerle <fabian@...ensalat.eu>)
Re: [MajorSecurity Advisory #54]xt:Commerce - Cross Site Scripting and Session Fixation Issues (admin@...orsecurity.de)

September 23 (13 messages)

[ GLSA 200809-12 ] Newsbeuter: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200809-13 ] R: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)
[ MDVSA-2008:200 ] ed (security@...driva.com)
[ MDVSA-2008:201 ] pan (security@...driva.com)
Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 (Hanno Böck <hanno@...eck.de>)
Aruba Mobility Controller Shared Default Certificate (nnposter@...closed.not)
Xss In Datalife Engine CMS 7.2 (hadikiamarsi@...mail.com)
[ MDVSA-2008:202 ] phpMyAdmin (security@...driva.com)
Re: Aruba Mobility Controller Shared Default Certificate - Response from Aruba Networks ("Robbie (Rupinder) Gill" <rgill@...banetworks.com>)
[ MDVSA-2008:203 ] awstats (security@...driva.com)
menalto gallery: Session hijacking vulnerability, CVE-2008-3102 (Hanno Böck <hanno@...eck.de>)
Re: [MajorSecurity Advisory #54]xt:Commerce - Cross Site Scripting and Session Fixation Issues (Philipp Hagemeister <phihag@...hag.de>)
Re: Blue Coat xss (Hugo van der Kooij <hvdkooij@...derkooij.org>)

September 24 (24 messages)

mantis CVE-2008-3102 (Re: menalto gallery: Session hijacking vulnerability, CVE-2008-3102) (Hanno Böck <hanno@...eck.de>)
[ GLSA 200809-14 ] BitlBee: Security bypass (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200809-15 ] GNU ed: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
Advisory : Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos. (Aditya K Sood <0kn0ck@...niche.org>)
[USN-645-1] Firefox and xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-645-2] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Internet Information Service remote set password (hamedata@...il.com)
IAS Helper COM Component (iashlpr.dll) activex remote DOS (hamedata@...il.com)
Internet Information Service (adsiis.dll) activex remote DOS (hamedata@...il.com)
Cisco Security Advisory: Cisco IOS Software Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability (Cisco Systems Product Security Incident Response…)
Cisco Security Advisory: Vulnerability in Cisco IOS While Processing SSL Packet (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco 10000, uBR10012, uBR7200 Series Devices IPC Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Cisco Security Advisory: Cisco IOS MPLS Forwarding Infrastructure Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@…)
Cisco Security Advisory: Cisco IOS NAT Skinny Call Control Protocol Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Firewall Application Inspection Control Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@…)
Re: Advisory : Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos. ("LIUDIEYU dot COM" <liudieyu.com@...il.com>)
Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerabilit… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco uBR10012 Series Devices SNMP Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Multiple Multicast Vulnerabilities in Cisco IOS Software (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS MPLS VPN May Leak Information (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS IPS Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[ MDVSA-2008:204 ] blender (security@...driva.com)
Drupal Brilliant Gallery module SQL injection vulnerability ("Justin C. Klein Keane" <Justin@...Irish.net>)
Drupal Ajax Checklist Module SQL Injection Vulnerability ("Justin C. Klein Keane" <Justin@...Irish.net>)

September 25 (15 messages)

Cisco Security Advisory: Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Response Team…)
php create_function commond injection vulnerability (root@...ec.com)
[security bulletin] HPSBOV02364 SSRT080078 rev.3 - HP OpenVMS SMGRTL Run Time Library, Local Authorized User, Gain Privileged Access (security-alert@...com)
[security bulletin] HPSBST02372 SSRT080133 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-052 to MS08-055 (security-alert@...com)
Google Docs (HTML code) Multiple Cross Site Scripting Vulnerabilities (alfredo.melloni@...il.com)
Re: php create_function commond injection vulnerability (lmfao@...mail.com)
C4 Security Advisory - ABB PCU400 4.4-4.6 Remote Buffer Overflow (Idan Ofrat <idan.ofrat@...security.com>)
Cross Site Scripting (XSS) Vulnerabilitiy in flatpress 0.804, CVE-2008-4120 (Fabian Fingerle <fabian@...ensalat.eu>)
adnforum <= 1.0b / Insecure Cookie Handling Vulnerability (Pepelux <pepelux@...e-sec.org>)
Fwd: Returned post for bugtraq@...urityfocus.com ("Jose Luis" <pepeluxx@...il.com>)
[USN-645-3] Firefox and xulrunner regression (Jamie Strandboge <jamie@...onical.com>)
SQL Injection in EasyRealtorPRO 2008 (SmOk3 <smok3f00@...il.com>)
[ GLSA 200809-16 ] Git: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200809-17 ] Wireshark: Multiple Denials of Service (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200809-18 ] ClamAV: Multiple Denials of Service (Pierre-Yves Rofes <py@...too.org>)

September 26 (15 messages)

[ MDVSA-2008:205 ] mozilla-firefox (security@...driva.com)
CA Service Desk Multiple Cross-Site Scripting Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Linksys/Cisco WRT350N 1.0.3.7 Insecure Samba Static Configuration ("Teh Kotak" <kotak.teh@...il.com>)
[USN-647-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Estonian Cyber Security Strategy document -- now available online (Gadi Evron <ge@...uxbox.org>)
DATAC RealWin 2.0 SCADA Software - Remote PreaAuth Exploit (Reversemode <advisories@...ersemode.com>)
RPG.Board <= 0.0.8Beta2 Remote SQL Injection (Guns@...0.com.ar)
The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability (Pepelux <pepelux@...e-sec.org>)
multiple vendor ftpd - Cross-site request forgery (cxib@...urityreason.com)
Crux Gallery <= 1.32 / Insecure Cookie Handling Vulnerability (Pepelux <pepelux@...e-sec.org>)
Crashing ZoneAlarm 8.0.020.000 by Checkpoint (Component : TrueVector) (quakerdoomer@...uy.com)
Re: [Full-disclosure] [IVIZ-08-010] McAfee SafeBoot Device Encryption Plain Text Password Disclosure (v4, Build 4750 and b… ("Kenneth Ng" <kenneth.d.ng@...il.com>)
FtitzBox (biglowbird@...glemail.com)
[ MDVSA-2008:206 ] mozilla-thunderbird (security@...driva.com)
Re: "Exploit creation - The random approach" or "Playing with random to build exploits" (Stefano Zanero <zanero@...t.polimi.it>)

September 27 (7 messages)

xss in hackmeeting.org (wiky <indirizzo_sicuro@...istici.org>)
Novell ZENWorks for Desktops Version 6.5 Remote (Heap-Based) PoC (Satan_HackerS@...oo.com)
ASP News Remote Password Disclouse Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
csphonebook 1.02 Remote XSS Vulnerabilitiy (Ghost hacker <ghost-r00t@...mail.com>)
shoutbox Remote Password Disclouse Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
hyBook Remote Password Disclouse Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
Login Password Sample Remote Password Disclouse Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)

September 29 (27 messages)

PHP Calendar Script Remote XSS (Permanent) Vulnerabilities (tan_prathan@...mail.com)
ParsaWeb CMS SQL Injection (admin@...report.ir)
Verizon FIOS (and DSL?) wireless access point insecure default WEP key (Paul <paul14075@...il.com>)
Re: php create_function commond injection vulnerability (bzhbfzj3001@...akemail.com)
RE: Verizon FIOS (and DSL?) wireless access point insecure default WEP key ("Larry Seltzer" <larry@...ryseltzer.com>)
Re: php create_function commond injection vulnerability (mnapier@...s.indiana.edu)
[oCERT-2008-013] MPlayer Real demuxer heap overflow (Andrea Barisani <lcars@...rt.org>)
Advisory: Mozilla Firefox User Interface Null Pointer Dereference Dispatcher Crash and Remote Denial of Service. (Aditya K Sood <0kn0ck@...niche.org>)
Advisory : Opera Window Object Suppressing Remote Denial of Service (Aditya K Sood <0kn0ck@...niche.org>)
Re: php create_function commond injection vulnerability ("Steven M. Christey" <coley@...re.org>)
[security bulletin] HPSBMA02373 SSRT071467 rev.1 - HP Insight Diagnostics, Remote Unauthorized Access to Files (security-alert@...com)
Re: Sun M-class hardware denial of service (Florian Weimer <fw@...eb.enyo.de>)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Re: Sun M-class hardware denial of service (Florian Weimer <fw@...eb.enyo.de>)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Re: Sun M-class hardware denial of service (Brett Lymn <blymn@...systems.com.au>)
[ MDVSA-2008:207 ] openafs (security@...driva.com)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Re: Sun M-class hardware denial of service (Brett Lymn <blymn@...systems.com.au>)
Re: Sun M-class hardware denial of service (Brett Lymn <blymn@...systems.com.au>)
Re: Sun M-class hardware denial of service (Brett Lymn <blymn@...systems.com.au>)
Re: Sun M-class hardware denial of service (Brett Lymn <blymn@...systems.com.au>)
MS Internet Explorer 7 Denial Of Service Exploit (UniquE@...quE-Key.ORG)
Re: Sun M-class hardware denial of service (Theo de Raadt <deraadt@....openbsd.org>)
Advisory: Google Chrome Window Object Suppressing Remote Denial of Service. (Aditya K Sood <0kn0ck@...niche.org>)

September 30 (15 messages)

[MajorSecurity Advisory #56]moziloWiki - Directory Traversal, XSS and SessionFixation Issues (admin@...orsecurity.de)
White Wolf Labs #080922-1: Exploitation Through ActiveSync 4.x (Seth Fogie <seth@...tewolfsecurity.com>)
rPSA-2008-0286-1 mono (rPath Update Announcements <announce-noreply@...th.com>)
Re: Advisory: Mozilla Firefox User Interface Null Pointer Dereference Dispatcher Crash and Remote Denial of Service. (Philippe Devallois <phdevallois@...ego.com…)
[ MDVSA-2008:208 ] pam_mount (security@...driva.com)
Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit (ipsdix@...il.com)
Re: MS Internet Explorer 7 Denial Of Service Exploit ("Jan van Niekerk" <jvnkrk@...il.com>)
Re: Sun M-class hardware denial of service (Bob Beck <beck@...berta.ca>)
MySQL command-line client HTML injection vulnerability (Thomas Henlich <thomas@...lich.de>)
Remote File Inclusion Vulnerability (Pepelux <pepelux@...e-sec.org>)
International Hacking & Security Conference "POC2008" (pocadm@...il.com)
WordPress MU < 2.6 wpmu-blogs.php Crose Site Scrpting vulnerability (Juan Galiana <jgaliana@...il.com>)
Re: Advisory: Google Chrome Window Object Suppressing Remote Denial of Service. (ian@...omium.org)
Re: Advisory: Google Chrome Window Object Suppressing Remote Denial of Service. (redb0ne@...h.com)
[USN-648-1] nasm vulnerability (Kees Cook <kees@...ntu.com>)

355 messages

Powered by blists - more mailing lists