bugtraq mailing list - 2009/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2009/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 10	² 14	³ 13	⁴	⁵
⁶ 10	⁷ 18	⁸ 12	⁹ 18	¹⁰ 16	¹¹ 7	¹²
¹³ 9	¹⁴ 9	¹⁵ 12	¹⁶ 18	¹⁷ 25	¹⁸	¹⁹
²⁰ 17	²¹ 12	²² 12	²³ 4	²⁴ 12	²⁵	²⁶
²⁷ 14	²⁸ 17	²⁹ 15	³⁰ 4

Messages by day:

April 1 (10 messages)

VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim (VMware Security team <security@...are.com>)
Secunia Research: UltraISO Image Parsing Buffer Overflow Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: UltraISO Image Name Parsing Format String Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Microsoft Internet Explorer 8 - Anti Spoofing is a Myth (Aditya K Sood <0kn0ck@...niche.org>)
OpenX 2.6.4 multiple vulnerabilities (publists@...blesecurity.com)
Massive exploitation of instant messaging applications proved feasible (Julien TINNES <jt@....org>)
[security bulletin] HPSBUX02418 SSRT090002 rev.1 - HP-UX Running OpenSSL, Remote Unauthorized Access (security-alert@...com)
[ MDVSA-2009:084 ] firefox (security@...driva.com)
Re: Microsoft Internet Explorer 8 - Anti Spoofing is a Myth (Michal Zalewski <lcamtuf@...edump.cx>)
[ MDVSA-2009:083 ] mozilla-thunderbird (security@...driva.com)

April 2 (14 messages)

[SecNiche Whitepaper] Evading Web XSS Filters with Microsoft Word - WAPT Perspective (Aditya K Sood <0kn0ck@...niche.org>)
EUSecWest 2009 CFP (May 27/28, Deadline April 7 2009) (Dragos Ruiu <dr@....net>)
[OPENX-SA-2009-002] OpenX 2.4.11, 2.6.5, 2.8.0 fix multiple vulnerabilities (Matteo Beccati <php@...cati.com>)
OSCommerce Session Fixation Vulnerability (laurent.desaulniers@...il.com)
Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3 (dh@...ereddefense.com)
Remote access vulnerability using File Thingie v2.5.4 (xiashing@...il.com)
Asbru Web Content Management Vulnerabilities (Patrick Webster <patrick@...hack.com>)
Q2 Solutions ConnX - SQL Injection Vulnerability (Patrick Webster <patrick@...hack.com>)
[SECURITY] [DSA 1762-1] New icu packages fix cross site scripting (white@...ian.org (Steffen Joeris))
ContentKeeper - Remote command execution and privilege escalation (Patrick Webster <patrick@...hack.com>)
[TZO-05-2009] Clamav 0.94 and below - Evasion /bypass (Thierry Zoller <Thierry@...ler.lu>)
[TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - see details) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-07-2009] F-PROT ZIP Method evasion (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:085 ] gstreamer0.10-plugins-base (security@...driva.com)

April 3 (13 messages)

Autodesk IDrop ActiveX Control Heap Corruption Vulnerability ("Elazar Broad" <elazar@...hmail.com>)
[SECURITY] [DSA 1761-1] New moodle packages fix file disclosure (Nico Golde <nion@...ian.org>)
glFusion <= 1.1.2 COM_applyFilter()/cookies remote blind sql injection exploit (nospam@...il.it)
Family Connections 1.8.2 Arbitrary File Upload ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
IBM DB2 (Dennis Yurichev <dennis@...us.info>)
Family Connections <= 1.8.2 - Remote Shell Upload Exploit ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
rPSA-2009-0057-1 m2crypto openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200904-02 ] GLib: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200904-03 ] Gnumeric: Untrusted search path (Robert Buchholz <rbu@...too.org>)
Cyber Warfare Conference: Agenda (k g <kgconference@...il.com>)
[ GLSA 200904-01 ] Openfire: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
AST-2009-003: SIP responses expose valid usernames ("Asterisk Security Team" <security@...erisk.org>)
Family Connections 1.8.2 Blind SQL Injection (Correct Version) ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)

April 6 (10 messages)

[ MDVSA-2009:087 ] openssl (security@...driva.com)
[ MDVSA-2009:086 ] gstreamer-plugins (security@...driva.com)
[ GLSA 200904-04 ] WeeChat: Denial of Service (Tobias Heinlein <keytoaster@...too.org>)
VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues (VMware Security Team <security@...are.com>)
Joomla Component com_bookjoomlas SQL Injection Vulnerability ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[Aria-Security.com] vBulletin multiple XSS (dontcontactorspamme@...a-security.com)
Amaya 11.1 XHTML Parser Buffer Overflow (c1c4tr1z@...doo-labs.org)
[TKADV2009-005] xine-lib Quicktime STTS Atom Integer Overflow (Tobias Klein <tk@...pkit.de>)
[ GLSA 200904-05 ] ntp: Certificate validation error (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1763-1] New openssl packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)

April 7 (18 messages)

[security bulletin] HPSBMA02416 SSRT090008 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
TPTI-09-02: VMWare VMnc Codec Open-DML Standard Index dwSize Heap Overflow (dvlabs <dvlabs@...pingpoint.com>)
[ GLSA 200904-07 ] Xpdf: Untrusted search path (Robert Buchholz <rbu@...too.org>)
[ GLSA 200904-08 ] OpenSSL: Denial of Service (Robert Buchholz <rbu@...too.org>)
Secunia Research: IrfanView Formats Plug-in XPM Parsing Integer Overflow (Secunia Research <remove-vuln@...unia.com>)
ZDI-09-016: Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.co…)
[security bulletin] HPSBUX02415 SSRT090023 rev.1 - HP-UX Running PAM Kerberos, Local Privilege Escalation, Unauthorized Access (security-alert@...com)
[USN-753-1] PostgreSQL vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200904-06 ] Eye of GNOME: Untrusted search path (Pierre-Yves Rofes <py@...too.org>)
TPTI-09-01: VMWare VMnc Codec Invalid RFB Message Type Heap Overflow (dvlabs <dvlabs@...pingpoint.com>)
OSSTMM 3 Sample Released (Pete Herzog <lists@...com.org>)
POC - Sun Java System Acccess Manager & Identity Manager Users Enumeration (Marco Mella <marco.mella@...utsecurity.net>)
LayerOne 2009 - Registration Open, Initial Speakers Announced (LayerOne Call For Papers <layeronecfp@...il.com>)
[USN-752-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847] (Tom Yu <tlyu@....EDU>)
MITKRB5-SA-2009-002: ASN.1 decoder frees uninitialized pointer [CVE-2009-0846] (Tom Yu <tlyu@....EDU>)
[USN-754-1] ClamAV vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability (Mark Thomas <markt@...che.org>)

April 8 (12 messages)

rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] [DSA 1764-1] New tunapie packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Adgregate ShopAd widget validation is vulnerable to replay attack (Matthew Dempsky <matthew@...psky.org>)
[SECURITY] [DSA 1765-1] New horde3 packages fix several vulnerabilities (Steffen Joeris <white@...ian.org>)
Re: Adgregate ShopAd widget validation is vulnerable to replay attack (Matthew Dempsky <matthew@...psky.org>)
[Bkis-06-2009] GOM Player Subtitle Buffer Overflow Vulnerability (Bkis <svrt@...v.com.vn>)
Re: [Aria-Security.com] vBulletin multiple XSS (security@...ern0t.net)
[USN-755-1] Kerberos vulnerabilities (Kees Cook <kees@...ntu.com>)
Adgregate ShopAd widget validation is vulnerable to replay attack (Matthew Dempsky <matthew@...psky.org>)
SASPCMS Multiple Vulnerabilities (admin@...report.ir)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Applia… (Cisco Systems Product Security Incident…)
OTSTurntables 1.00.027 (.ofl file) Local universal SOF Exploit (alphanix00@...il.com)

April 9 (18 messages)

Exjune Guestbook v2 Remote Database Disclosure Exploit (alphanix00@...il.com)
net2ftp <= 0.97 Cross-Site Scripting/Request Forgery (c1c4tr1z@...doo-labs.org)
[ GLSA 200904-11 ] Tor: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
FGA-2009-003:EMC RepliStor Buffer Overflow Vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@...tinet.com>)
Geeklog <=1.5.2 'SESS_updateSessionTime()' vulnerability (nospam@...il.it)
[SECURITY] [DSA 1766-1] New krb5 packages fix several vulnerabilities (Nico Golde <nion@...ian.org>)
OpenVAS now beyond 10000 Network Vulnerability Tests (Michael Wiegand <michael.wiegand@...evation.de>)
AdaptBB 1.0 Beta Multiple Remote Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Geeklog <=1.5.2 SEC_authenticate()/PHP_AUTH_USER sql injection exploit (nospam@...il.it)
[security bulletin] HPSBMA02396 SSRT080175 rev.1 - HP OpenView Performance Agent and HP Performance Agent Running on Windows, Remote Execu… (security-alert@...com)
[ GLSA 200904-09 ] MIT Kerberos 5: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
IBM BladeCenter Advanced Management Module Multiple vulnerabilities (Henri Lindberg - Smilehouse Oy <henri.lindberg@...lehouse.com>)
[SECURITY] [DSA 1767-1] New multipath-tools packages fix denial of service (Nico Golde <nion@...ian.org>)
[ GLSA 200904-10 ] Avahi: Denial of Service (Robert Buchholz <rbu@...too.org>)
Secunia Research: Ghostscript jbig2dec JBIG2 Processing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[security bulletin] HPSBMA02420 SSRT071458 rev.1 - HP ProCurve Manager and HP ProCurve Manager Plus, Remote Unauthorized Access to Data (security-alert@...com)
[ MDVSA-2009:088 ] wireshark (security@...driva.com)
Reminder: RAID 2009 CFP (Corrado Leita <corrado_leita@...antec.com>)

April 10 (16 messages)

[SECURITY] [DSA 1754-1] New roundup packages fix privilege escalation (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2009:089 ] opensc (security@...driva.com)
[DSECRG-09-035] Chance-i DiViS DVR ActiveX - Heap Overflow (DSecRG <research@...crg.com>)
Bid 34130 Invalid (vpandey@...il.com)
PHP 5.2.9 curl safe_mode & open_basedir bypass (cxib@...urityreason.com)
PHP-agenda <= 2.2.5 Remote File Overwriting ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Summer Camp Garrotxa 2009 event (Gerardo García Peña <gerardo@...g-foo.dhs.org>)
Loggix Project 9.4.5 Blind SQL Injection ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[SECURITY] [DSA 1768-1] New openafs packages potential code execution (Florian Weimer <fw@...eb.enyo.de>)
[DSECRG-09-036] Chance-i Techno Vision Security System - Directory Traversal File Download (DSecRG <research@...crg.com>)
[ GLSA 200904-12 ] Wicd: Information disclosure (Tobias Heinlein <keytoaster@...too.org>)
Dynamic Flash Forum 1.0 Beta Multiple Remote Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Re: Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3 (prabhup@...isayampark.com)
VMSA-2009-0006 VMware Hosted products and patches for ESX and ESXi resolve a critical security vulnerability (VMware Security Team <security@...are.com>)
[ MDVSA-2009:090 ] php (security@...driva.com)
Opening Intranets to attack by using Internet Explorer [paper] (Cesar <cesarc56@...oo.com>)

April 11 (7 messages)

[Full-disclosure] [ GLSA 200904-12 ] Wicd: Information disclosure (Tobias Heinlein <keytoaster@...too.org>)
[BMSA 2009-04] Remote DoS in Internet Explorer (Nam Nguyen <namn@...emoon.com.vn>)
In Response to Bid 34130 Invalid (Aditya K Sood <0kn0ck@...niche.org>)
[SECURITY] [DSA 1769-1] New openjdk-6 packages fix arbitrary code execution (Florian Weimer <fw@...eb.enyo.de>)
HP Deskjet 6800 XSS in Web Interface (mcyr2@....com)
ftpdmin v. 0.96 RNFR remote buffer overflow exploit (nospam@...il.it)
Re: In Response to Bid 34130 Invalid (vpandey@...il.com)

April 13 (9 messages)

[ MDVSA-2009:091 ] mod_perl (security@...driva.com)
Hacker Space Fest 2009 CFP: Call For Paper (Philippe Mailinglist <philippe.mailinglist@...il.com>)
Re: Critical SQL Injection PHPNuke <= 7.8 - Your_Account module (mefuentes61@...mail.com)
[SECURITY] [DSA 1770-1] New imp4 packages fix cross-site scripting (white@...ian.org (Steffen Joeris))
[Suspected Spam][Positive Technologies SA 2009-01] PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities ("Valery Marchuk" <tecklord@...uritylab.ru>)
OpenBSD 4.3 up to OpenBSD-current: PF null pointer dereference - remote DoS (kernel panic) (rembrandt <rembrandt@...ith.net>)
[USN-756-1] ClamAV vulnerability (Jamie Strandboge <jamie@...onical.com>)
[ MDVSA-2009:092 ] ntp (security@...driva.com)
Re: PHP-Revista Multiple vulnerabilities (marianiscc@...mail.com)

April 14 (9 messages)

BugCON '09, Mexico: Call For Papers (Carlos Augusto <vend3tta@...oo.fr>)
MonGoose 2.4 Directory Traversal Vulnerability (ew1zz@...mail.com)
Re: [NOBYTES.COM: #12] osCommerce 2.2rc2a - Information Disclosure (Anonymous@...il.com)
Re: OSCommerce Session Fixation Vulnerability (tech107@...il.com)
[DSECRG-09-037] abk-soft AbleSpace CMS 1.0 - Multiple security vulnerabilities (DSecRG <research@...crg.com>)
iDefense Security Advisory 04.14.09: Microsoft Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
ZDI-09-017: Oracle Applications Server 10g Format String Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ GLSA 200904-13 ] Ventrilo: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200904-14 ] F-PROT Antivirus: Denial of Service (Pierre-Yves Rofes <py@...too.org>)

April 15 (12 messages)

Zervit Webserver Buffer Overflow (ewizz@...cansecurity.com)
Microsoft Office Excel Remote Memory Corruption Vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@...tinet.com>)
Secunia Research: SAP GUI KWEdit ActiveX Control "SaveDocumentAs()" Insecure Method (Secunia Research <remove-vuln@...unia.com>)
[USN-757-1] Ghostscript vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Secunia Research: Oracle BEA WebLogic Server Plug-ins Integer Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: DivX Web Player Stream Format Chunk Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
HITBSecConf2009 - Malaysia: Call for Papers ("S. Praburaajan" <prabu@...kinthebox.org>)
SEC Consult SA-20090415-0 :: Multiple Vulnerabilities in Novell Teaming (Bernhard Mueller <research@...-consult.com>)
SEC Consult SA-20090415-1 :: Nortel Application Gateway 2000 Password Disclosure Vulnerability (Bernhard Mueller <research@...-consult.com>)
Secunia Research: Oracle BEA WebLogic Server Plug-ins Certificate Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[USN-758-1] udev vulnerabilities (Kees Cook <kees@...ntu.com>)
XSS with mod_perl perl_status utility (antonia.goodwin@...checkup.com)

April 16 (18 messages)

iDefense Security Advisory 04.15.09: Microsoft WordPad Word97 Converter Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 1771-1] New clamav packages fix several vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)
SQL Injection in package DBMS_AQIN (ak@...-database-security.com)
Unprivileged DB users can see APEX password hashes (ak@...-database-security.com)
Phorum < 5.2.10 Cross-Site Scripting/Request Forgery (research@...doo-labs.org)
Secunia Research: Danske Bank e-Sec Control Module Error Logging Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Geeklog <= 1.5.2 savepreferences()/*blocks[] remote sql injection exploit (nospam@...il.it)
iDefense Security Advisory 04.15.09: IBM AIX muxatmd Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
SQL Injection in package DBMS_AQADM_SYS (ak@...-database-security.com)
[SECURITY] [DSA 1772-1] New udev packages fix privilege escalation (Florian Weimer <fw@...eb.enyo.de>)
webSPELL 4.2.0c--XSS (BYPASS BBCODE) COOKIES STEALING VULNERABILITY-- (y3nh4ck3r@...il.com)
skpd: A tool to dump processes to executable ELF files (Albert Sellarès <whats@...k.net>)
DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues (ddvulnalert@...fronline.com)
[DSECRG-09-018] Apache Geronimo - Directory Traversal vulnerabilities (DSecRG <research@...crg.com>)
[DSECRG-09-019] Apache Geronimo - XSS vulnerabilities.txt (DSecRG <research@...crg.com>)
[DSECRG-09-020] Apache Geronimo - XSRF vulnerabilities (DSecRG <research@...crg.com>)
Miniweb server Multiple Vulnerabilities (ew1zz@...com)
Miniweb Buffer Overflow (ew1zz@...tspammepls.com)

April 17 (25 messages)

[USN-759-1] poppler vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-760-1] CUPS vulnerability (Jamie Strandboge <jamie@...onical.com>)
rPSA-2009-0062-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
ERNW Security Advisory 01-2009: XSS in Blackberries Mobile Data Service Connection Service (mozilla@...-guide.de)
[TZO-08-2009] Bitdefender generic bypass/evasion (Thierry Zoller <Thierry@...ler.lu>)
[SECURITY] [DSA 1773-1] New cups packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[TZO-09-2009] Avast bypass / evasion (Limited details) (Thierry Zoller <Thierry@...ler.lu>)
rPSA-2009-0061-1 cups (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2009-0063-1 udev (rPath Update Announcements <announce-noreply@...th.com>)
[IMF 2009] 2nd Call for Papers - Submission Open (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
rPSA-2009-0064-1 icu (rPath Update Announcements <announce-noreply@...th.com>)
Tiny Blogr 1.0.0 rc4 Authentication Bypass ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[SECURITY] [DSA 1774-1] New ejabberd packages fix cross-site scripting (white@...ian.org (Steffen Joeris))
[ GLSA 200904-15 ] mpg123: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
rPSA-2009-0060-1 ghostscript (rPath Update Announcements <announce-noreply@...th.com>)
[TZO-11-2009] Fortinet bypass / evasion (Limited details) (Thierry Zoller <Thierry@...ler.lu>)
Secunia Research: CUPS pdftops JBIG2 Symbol Dictionary Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[TZO-09-2009] NOD32 (Eset) bypass / evasion (Limited details) (Thierry Zoller <Thierry@...ler.lu>)
Secunia Research: Xpdf JBIG2 Symbol Dictionary Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
rPSA-2009-0059-1 poppler (rPath Update Announcements <announce-noreply@...th.com>)
Malleo 1.2.3 Local File Inclusion Vulnerability ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[ GLSA 200904-16 ] libsndfile: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
CLAN TIGER CMS--(module custompage.php) BLIND SQL INJECTION--> (y3nh4ck3r@...il.com)
CLAN TIGER CMS--MULTIPLE COOKIES HANDLING VULNERABILITIES--> (y3nh4ck3r@...il.com)
CLAN TIGER CMS--AUTH BYPASS LOGIN FORM (SQL INJECTION)--> (y3nh4ck3r@...il.com)

April 20 (17 messages)

[ GLSA 200904-17 ] Adobe Reader: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200904-18 ] udev: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200904-19 ] LittleCMS: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1775-1] New php-json-ext packages fix denial of service (white@...ian.org (Steffen Joeris))
CLAN TIGER CMS 1.1.1 (AUTH BYPASS) SQL-INJECTION (y3nh4ck3r@...il.com)
Cross-site Scripting vulnerability in Stronghold/2.3 Apache/1.2.6 C2NetUS/2007 (XiaShing@...il.com)
Linksys WRT54GC - Admin Password Change (POC) (gabriel@...andodeseguranca.com)
Multi-lingual E-Commerce System 0.2 Multiple Remote Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Sungard Banner System XSS (reportback@...dthepost.com)
Multiple Remote Vulnerabilities--SQLi-(INSECURE-COOKIE-HANDLING)-LFI--> (y3nh4ck3r@...il.com)
Creasito e-commerce content manager Authentication Bypass ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Windows Update (re-)installs outdated Flash ActiveX on Windows XP ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Addendum :[TZO-09-2009] Avast bypass / evasion (Limited details) (Thierry Zoller <Thierry@...ler.lu>)
WysGui CMS 1.2 BETA(Insecure Cookie Handling)--Blind-sql-injection-exploit--> (y3nh4ck3r@...il.com)
[security bulletin] HPSBMA02414 SSRT080185 rev.1 - HP Storage Essentials Running Secure NaviCLI, Remote Unauthorized Access, Gain Extended… (security-alert@...com)
[security bulletin] HPSBMA02422 SSRT080146 rev.1 - HP StorageWorks Storage Mirroring, Remote Execution of Arbitrary Code, Denial of Servic… (security-alert@...com)
Addonics NAS Adapter (bts.cgi) Remote DoS Exploit (post-auth) (mcyr2@....com)

April 21 (12 messages)

[USN-761-1] PHP vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-762-1] APT vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-763-1] xine-lib vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE-2009-0991 PoC (Dennis Yurichev <dennis@...us.info>)
[SECURITY] [DSA 1777-1] New git-core packages fix privilege escalation (Thijs Kinkhorst <thijs@...ian.org>)
Trend Micro OfficeScan Client - DOS (jplopezy@...il.com)
[SECURITY] [DSA 1776-1] New slurm-llnl packages fix privilege escalation (Thijs Kinkhorst <thijs@...ian.org>)
Re: Addonics NAS Adapter (bts.cgi) Remote DoS Exploit (post-auth) (Jeremy Brown <0xjbrown41@...il.com>)
Re: Trend Micro OfficeScan Client - DOS (Thierry Zoller <Thierry@...ler.lu>)
Python winappdbg module v1.0 is out! (Mario Alejandro Vilas Jerez <mvilas@...il.com>)
MixedCMS 1.0--Multiple Remote Vulnerabilities--> (y3nh4ck3r@...il.com)
CORE-2009-0114 - HTTP Response Splitting vulnerability in Sun Delegated Administrator (CORE Security Technologies Advisories <advisories@...esecurity.com>)

April 22 (12 messages)

SAP Cfolders Multiple Linked XSS Vulnerabilities ("Digital Security Research Group [DSecRG]" <research@...crg.com>)
SAP Cfolders Multiple Stored XSS Vulnerabilies ("Digital Security Research Group [DSecRG]" <research@...crg.com>)
Re: [Bkis-07-2009] 010 Editor Multiple Buffer Overflow Vulnerabilities (Tavis Ormandy <taviso@....lonestar.org>)
[TZO-12-2009] SUN / Oracle JVM Remote code execution (Thierry Zoller <Thierry@...ler.lu>)
[Tool] sqlmap 0.7rc1 released ("Bernardo Damele A. G." <bernardo.damele@...il.com>)
[Bkis-07-2009] 010 Editor Multiple Buffer Overflow Vulnerabilities (Bkis <svrt@...v.com.vn>)
FreeBSD Security Advisory FreeBSD-SA-09:07.libc (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[ MDVSA-2009:093 ] mpg123 (security@...driva.com)
FreeBSD Security Advisory FreeBSD-SA-09:08.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[ MDVSA-2009:094 ] mysql (security@...driva.com)
[SECURITY] [DSA 1778-1] New mahara packages fix cross-site scripting (Nico Golde <nion@...ian.org>)
Re: Windows Update (re-)installs outdated Flash ActiveX on Windows XP ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)

April 23 (4 messages)

Re: Windows Update (re-)installs outdated Flash ActiveX on Windows XP ("Andrew Kuriger" <a.kuriger@...uidphlux.com>)
[USN-764-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: [DSECRG-09-037] abk-soft AbleSpace CMS 1.0 - Multiple security vulnerabilities (sales@...-soft.net)
FOWLCMS 1.1--Multiple Remote Vulnerabilities--> (y3nh4ck3r@...il.com)

April 24 (12 messages)

[ GLSA 200904-20 ] CUPS: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
WOOT'09 call for papers (Alexander Sotirov <alex@...irov.net>)
CVE-2009-1190: Spring Framework Remote Denial of Service Vulnerability (Mark Thomas <Mark.Thomas@...ingsource.com>)
RE: Cisco ASA5520 Web VPN Host Header XSS ("Mark-David McLaughlin (marmclau)" <marmclau@...co.com>)
Pragyan CMS 2.6.4 Multiple SQL Injection Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
REMOTE SQL INJECTION (SQLi) VULNERABILITY--Photo-Rigma.BiZ v30--> (y3nh4ck3r@...il.com)
Formshield Captcha - Older Version vulnerable to replay attacks (arvind doraiswamy <arvind.doraiswamy@...il.com>)
Aruba Advisory ID: AID-42309 Management User Authentication Bypass Vulnerability When Using Public Key Based SSH Authenti… (Robbie Gill <rgill@...banetworks.com>)
Juniper Advisory (security@...checkup.com)
[ MDVSA-2009:095 ] ghostscript (security@...driva.com)
MSL-2009-001 - Samsung Missing Provisioning Authentication (Mobile Security Lab <research@...clab.com>)
[ MDVSA-2009:096 ] printer-drivers (security@...driva.com)

April 27 (14 messages)

[ MDVSA-2009:097 ] clamav (security@...driva.com)
[ MDVSA-2009:097 ] clamav (security@...driva.com)
Remote iodinetd DoS vulnerability on Debian Lenny (Albert Sellarès <whats@...k.net>)
T2'09: Call for Papers 2009 (Helsinki / Finland) (Tomi Tuominen <tomi.tuominen@...fi>)
[TZO-13-2009] Avira Antivir generic CAB evasion / bypass (Thierry Zoller <Thierry@...ler.lu>)
MataChat Cross-Site Scripting Vulnerabilities (IrIsT.Ir@...il.com)
[TZO-15-2009] Aladdin eSafe generic bypass - Forced release (Thierry Zoller <Thierry@...ler.lu>)
[SECURITY] [DSA 1779-1] New apt packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
SQL INJECTION (SHELL UPLOAD)--EZ-blog Beta2--> (y3nh4ck3r@...il.com)
[TZO-14-2009] Comodo Antivirus RAR evasion (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:098 ] krb5 (security@...driva.com)
[ MDVSA-2009:096-1 ] printer-drivers (security@...driva.com)
DDIVRT-2009-24 Precidia Ether232 Memory Corruption (ddivulnalert@...frontline.com)
[security bulletin] HPSBMA02424 SSRT080125 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)

April 28 (17 messages)

[USN-761-2] PHP vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2009:099 ] openafs (security@...driva.com)
Re: [IVIZ-08-016] F-Secure f-prot Antivirus for Linux corrupted ELF header Security Bypass (security@...rot.com)
Errata: [TZO-13-2009] Avira Antivir generic CAB evasion / bypass (Thierry Zoller <Thierry@...ler.lu>)
[security bulletin] HPSBUX02366 SSRT080120 rev.1 - HPUX Running useradd(1M), Local Unauthorized Access (security-alert@...com)
security tools list (Ying <ropstrip@...il.com>)
Secunia Research: HP OpenView Network Node Manager "ovalarmsrv" Integer Overflow (Secunia Research <remove-vuln@...unia.com>)
Re: Formshield Captcha - Older Version vulnerable to replay attacks (arvind doraiswamy <arvind.doraiswamy@...il.com>)
[USN-767-1] FreeType vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
RE: SQL INJECTION (SHELL UPLOAD)--EZ-blog Beta2--> ("Memisyazici, Aras" <arasm@...edu>)
one shot remote root for linux? (Gadi Evron <ge@...uxbox.org>)
MULTIPLE REMOTE SQL INJECTION VULNERABILITIES---MIM:InfiniX v1.2.003---> (y3nh4ck3r@...il.com)
[USN-766-1] acpid vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: security tools list ("Andrew L. Davis" <adavis@...ekstun.net>)
[USN-765-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
iDefense Security Advisory 04.28.09: TIBCO SmartSockets Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 1780-1] New libdbd-pg-perl packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)

April 29 (15 messages)

Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness (Positron Security <advisories@...itronsecurity.com>)
[ MDVSA-2009:101 ] xpdf (security@...driva.com)
[SECURITY] [DSA 1781-1] New ffmpeg-debian packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[ MDVA-2009:057 ] usermode (security@...driva.com)
[SECURITY] [DSA 1782-1] New mplayer packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 1783-1] New mysql-dfsg-5.0 packages fix multiple vulnerabilities (Devin Carraway <devin@...ian.org>)
Proxy bypass vulnerability & plain text passwords in LevelOne AMG-2000 (SEC Consult Research <research@...-consult.com>)
Symantec Fax Viewer Control v10 (DCCFAXVW.DLL) remote buffer overflow exploit (nospam@...il.it)
[TZO-17-2009]Trendmicro multiple bypass/evasions (Thierry Zoller <Thierry@...ler.lu>)
Addendum: [TZO-17-2009]Trendmicro multiple bypass/evasions (Thierry Zoller <Thierry@...ler.lu>)
iDefense Security Advisory 04.29.09: Symantec System Center Alert Management System Console Arbitrary Program Execution… (iDefense Labs <labs-no-reply@...fense.c…)
SQL INJECTION (SQLi) VULNERABILITY--ProjectCMS v1.0 Beta Final--> (y3nh4ck3r@...il.com)
ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[TZO-16-2009] Nod32 CAB bypass/evasion (Thierry Zoller <Thierry@...ler.lu>)
[security bulletin] HPSBMA02400 SSRT080144 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)

April 30 (4 messages)

Re: Symantec Fax Viewer Control v10 (DCCFAXVW.DLL) remote buffer overflow exploit (secure@...antec.com)
Security tools list: First Version (Ying <ropstrip@...il.com>)
Re: ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability (Steve Shockley <steve.shockley@...ckley.net>)
MULTIPLE REMOTE VULNERABILITIES--Leap CMS 0.1.4--> (y3nh4ck3r@...il.com)

298 messages

Powered by blists - more mailing lists