bugtraq mailing list - 2009/05

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2009/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 17	² 2	³
⁴ 16	⁵ 12	⁶ 7	⁷ 12	⁸ 6	⁹ 6	¹⁰
¹¹ 16	¹² 28	¹³ 14	¹⁴ 23	¹⁵	¹⁶	¹⁷
¹⁸	¹⁹ 35	²⁰ 23	²¹ 4	²² 9	²³	²⁴
²⁵ 18	²⁶ 11	²⁷ 16	²⁸ 18	²⁹ 9	³⁰	³¹

Messages by day:

May 1 (17 messages)

Durzosploit v0.1 alpha (Benjilenoob <benjilenoob@...mail.com>)
BLIND SQL INJECTION--Leap CMS 0.1.4--> (y3nh4ck3r@...il.com)
[ MDVSA-2009:103 ] udev (security@...driva.com)
New WebApp security paper: Anti-fraud Image Solutions ("WebAppSec" <webappsec@...hnicalinfo.net>)
Re: Security tools list: First Version (Ulises2k <ulises2k@...il.com>)
Addonics NAS Adapter FTP Remote Denial of Service (mcyr2@....com)
[ MDVSA-2009:104 ] udev (security@...driva.com)
[ MDVSA-2009:102 ] apache (security@...driva.com)
MULTIPLE SQL INJECTION VULNERABILITIES --MiniTwitter v0.2-Beta--> (y3nh4ck3r@...il.com)
multiple vendor - PF NULL pointer dereference (rembrandt <rembrandt@...ith.net>)
BH USA CFP closing next Tuesday ("jmoss" <jmoss@...ckhat.com>)
[SECURITY] [DSA 1784-1] New freetype packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
CA20090429-01: CA ARCserve Backup Apache HTTP Server Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: Symantec Fax Viewer Control v10 (DCCFAXVW.DLL) remote buffer overflow exploit (Nick FitzGerald <nick@...us-l.demon.co.uk>)
USER OPTIONS CHANGER EXPLOIT --MiniTwitter v0.2-Beta+-> (y3nh4ck3r@...il.com)
[SECURITY] [DSA 1785-1] New wireshark packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[TZO-18-2009] Mcafee multiple evasions/bypasses (RAR, ZIP) (Thierry Zoller <Thierry@...ler.lu>)

May 2 (2 messages)

[SECURITY] [DSA 1786-1] New acpid packages fix denial of service (white@...ian.org (Steffen Joeris))
about inactive account hijacking (innate@....de)

May 4 (16 messages)

[ GLSA 200905-01 ] Asterisk: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
Call for Papers Hack.lu 2009 ("hack.lu 2009 info" <hl2009@...k.lu>)
[SECURITY] [DSA 1787-1] New Linux 2.6.24 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Secunia Research: IBM Tivoli Storage Manager Remote Agent Service Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
“Cross-Site Scripting” vulnerability in MyBB 1.4.5 (Jacques Copeau <jacquescopeau@...glemail.com>)
[SecNiche WhitePaper ] - PDF Silent HTTP Form Repurposing Attacks (Aditya K Sood <0kn0ck@...niche.org>)
[ MDVSA-2009:105 ] memcached (security@...driva.com)
Coppermine Photo Gallery 1.4.21 Cross-Site Scripting (darkz.gsa@...il.com)
Grabit <= 1.7.2 beta 3 NZB file parsing stack overflow (Niels Teusink <my_first_name_here@...sink.net>)
[USN-769-1] libwmf vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
MULTPLE REMOTE VULNERABILITIES --ProjectCMS v-1.1 Beta--> (y3nh4ck3r@...il.com)
[security bulletin] HPSBMA02425 SSRT080091 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMA02374 SSRT080046 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Service (DoS) (security-alert@...com)
LayerOne 2009 - Final Announcement (LayerOne Call For Papers <layeronecfp@...il.com>)
[SECURITY] [DSA 1787-1] New quagga packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1789-1] New php5 packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)

May 5 (12 messages)

[USN-770-1] ClamAV vulnerability (Jamie Strandboge <jamie@...onical.com>)
[RT-SA-2009-001] IceWarp WebMail Server: Cross Site Scripting in Email View (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2009-004] IceWarp WebMail Server: Client-Side Specification of "Forgot Password" eMail Content (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2009-002] IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
CONFidence 2009 trainings (andrzej.targosz@...il.com)
[RT-SA-2009-003] IceWarp WebMail Server: SQL Injection in Groupware Component (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[DSECRG-09-034] Sun Glassfish Enterprise Server - Multiple Linked XSS vulnerabilies ("Digital Security Research Group [DSecRG]" <research@...crg.com>)
[DSECRG-09-038] Sun Glassfish Woodstock Project - Linked XSS Vulnerability ("Digital Security Research Group [DSecRG]" <research@...crg.com>)
MULTIPLE REMOTE VULNERABILITIES--TemaTres 1.0.3--> (y3nh4ck3r@...il.com)
BLIND SQL INJECTION EXPLOIT--TemaTres 1.0.3--> (y3nh4ck3r@...il.com)
[SECURITY] [DSA 1790-1] New xpdf packages fix multiple vulnerabilities (Noah Meyerhans <noahm@...ian.org>)
[security bulletin] HPSBMA02419 SSRT090060 rev.1 - Insight Control Suite For Linux (ICE-LX) Multiple Remote Vulnerabilities In Nagios (security-alert@...com)

May 6 (7 messages)

[ MDVSA-2009:106 ] libwmf (security@...driva.com)
New Browser Security Paper: Why Silent Updates Boost Security (Stefan Frei <stefan.frei@...hzoom.net>)
[SECURITY] [DSA 1791-1] New moin packages fix cross-site scripting (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 1792-1] New drupal6 packages fix multiple vulnerabilities (Noah Meyerhans <noahm@...ian.org>)
[SECURITY] [DSA 1793-1] New kdegraphics packages fix multiple vulnerabilities (Noah Meyerhans <noahm@...ian.org>)
Persistent XSS in Kayako Support Suite (pen-test@...odo.com)
EUSecWest 2009 (May27/28) London Agenda and PacSec 2009 (Nov 4/5) Tokyo CFP deadline: June 1 2009 (Dragos Ruiu <dr@....net>)

May 7 (12 messages)

[ MDVSA-2009:107 ] acpid (security@...driva.com)
[SECURITY] [DSA 1794-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
[SECURITY] [DSA 1795-1] New ldns packages fix arbitrary code execution (Devin Carraway <devin@...ian.org>)
Secunia Research: Garmin Communicator Plug-In Domain Locking Security Bypass (Secunia Research <remove-vuln@...unia.com>)
Update: [TZO-15-2009] Aladdin eSafe generic bypass - Forced release (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:108 ] zsh (security@...driva.com)
SQL INJECTION VULNERABILITIES--ST-Gallery version 0.1 alpha--> (y3nh4ck3r@...il.com)
[USN-771-1] libmodplug vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[oCERT-2009-001] Pango integer overflow in heap allocation size calculations (Will Drewry <redpig@...rt.org>)
[USN-772-1] MPFR vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-773-1] Pango vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1796-1] New libwmf packages fix denial of service (Nico Golde <nion@...ian.org>)

May 8 (6 messages)

[TOOL] moth - vulnerable web application vmware (Andres Riancho <andres.riancho@...il.com>)
Re: [WEB SECURITY] [TOOL] moth - vulnerable web application vmware (romain <r@...kthespam.com>)
Claroline v.1.8.11 Cross-Site Scripting (darkz.gsa@...il.com)
[security bulletin] HPSBUX02366 SSRT080120 rev.2 - HPUX Running useradd(1M), Local Unauthorized Access (security-alert@...com)
BLIND SQL INJECTION exploit (GET var 'AlbumID')--RTWebalbum 1.0.462--> (y3nh4ck3r@...il.com)
Vpopmail/QmailAdmin User's Quota Multiple Integer Overflows (Jacobo Avariento Gimeno <advisories@...istic.net>)

May 9 (6 messages)

Universal XSS in all Google Services (Inferno@...ureThoughts.com)
speaker Bill Blunden on Rootkits... (Alex Keller <alkeller@...u.edu>)
Changes : [TZO-17-2009]Trendmicro multiple bypass/evasions (Thierry Zoller <Thierry@...ler.lu>)
[TZO-20-2009] AVG ZIP evasion / bypass (Thierry Zoller <Thierry@...ler.lu>)
[SECURITY] [DSA 1797-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[TZO-21-2009] Fprot CAB bypass / evasion (Thierry Zoller <Thierry@...ler.lu>)

May 11 (16 messages)

TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit (travesti@...vesti.in)
[SECURITY] [DSA 1798-1] New pango1.0 packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
Insufficient Authentication vulnerability in Acer notebooks ("MustLive" <mustlive@...security.com.ua>)
[ MDVSA-2009:109 ] quagga (security@...driva.com)
[Bkis-08-2009] Microchip MPLAB IDE Buffer Overflow Vulnerability (Bkis <svrt@...v.com.vn>)
RE: Insufficient Authentication vulnerability in Acer notebooks (David Sánchez Martín <dsanchez@...00.es>)
Advisory - Gmail/Google Doc PDF Repurposing Integrated Attacks - Cookie Hijacking / Stealing (Aditya K Sood <0kn0ck@...niche.org>)
Five days left to find the oldest data loss incident (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[USN-774-1] MoinMoin vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit (michael@...mpfle.de)
[oCERT-2009-004] AjaxTerm session id collision (Andrea Barisani <lcars@...rt.org>)
(POST var 'rating') BLIND SQL INJECTION--microTopic v1 Initial Release--> (y3nh4ck3r@...il.com)
Re: Five days left to find the oldest data loss incident (Dragos Ruiu <dr@....net>)
[security bulletin] HPSBMA02348 SSRT080033 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial o… (security-alert@...com)
[security bulletin] HPSBMA02349 SSRT080043 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Unauthorized Access to Data (security-alert@...com)
[SECURITY] [DSA 1799-1] New qemu packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)

May 12 (28 messages)

Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities ("Felipe M. Aragon" <felipe@...unt.com>)
Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code execution exploit (nospam@...il.it)
xcon2009 is coming (bugdigger@...oo.cn)
Re: Insufficient Authentication vulnerability in Acer notebooks (dpo5003@...il.com)
Security Advisory: Banks in Australia (militan.c7@...il.com)
Re: Insufficient Authentication vulnerability in Acer notebooks (Øystein Larsen <oystein.larsen@...t.uio.no>)
Exploiting IE8 UTF-7 XSS Vulnerability using Local Redirection (Inferno@...urethoughts.com)
Re: Insufficient Authentication vulnerability in Acer notebooks ("Garrett M. Groff" <groffg@...design.com>)
The security tools list, new version with more than 200 new tools! (Ying <ropstrip@...il.com>)
Re: Universal XSS in all Google Services (Nam Nguyen <namn@...emoon.com.vn>)
FormMail 1.92 Multiple Vulnerabilities (ascii <ascii@...amail.com>)
Sun IDM Arbitrary Commands Execution Vulnerability ("abb@...nit.be" <abb@...nit.be>)
Re: Five days left to find the oldest data loss incident ("Elazar Broad" <elazar@...hmail.com>)
CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities [Updated] ("Williams, James K" <James.Williams@...com>)
User options changer (SQLi) EXPLOIT --Bigace CMS -stable release- 2.5--> (y3nh4ck3r@...il.com)
Secunia Research: Microsoft PowerPoint Atom Parsing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
Re: The security tools list, new version with more than 200 new tools! (Stephen Mullins <steve.mullins.work@...il.com>)
ZDI-09-019: Microsoft Office PowerPoint OutlineTextRefAtom Parsing Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-020: Microsoft Office PowerPoint Notes Container Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Re: The security tools list, new version with more than 200 new tools! (Ying <ropstrip@...il.com>)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion Filter Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion Filter Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion Filter Stack Overflow (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT 4.0 Importer Multiple Stack Buffer Overflow Vulnerabiliti… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT95 Import Multiple Stack Buffer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.co…)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT95 Import Multiple Stack Buffer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.co…)
[USN-775-1] Quagga vulnerability (Kees Cook <kees@...ntu.com>)
[USN-776-1] KVM vulnerabilities (Kees Cook <kees@...ntu.com>)

May 13 (14 messages)

iDefense Security Advisory 05.12.09: Microsoft PowerPoint Notes Container Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ MDVSA-2009:111 ] firefox (security@...driva.com)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ MDVSA-2009:111-1 ] firefox (security@...driva.com)
iDefense Security Advisory 05.12.09: Microsoft PowerPoint Build List Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ MDVSA-2009:110 ] squirrelmail (security@...driva.com)
[USN-776-2] KVM regression (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: FormMail 1.92 Multiple Vulnerabilities (David Cantrell <d.cantrell@...cometechnologies.com>)
Re: The security tools list, new version with more than 200 new tools! (Ying <ropstrip@...il.com>)
Re: FormMail 1.92 Multiple Vulnerabilities (ascii <ascii@...amail.com>)
maxcms2.0 creat new admin exploit (info@...uritylab.ir)
Pinnacle Studio 12 "Hollywood FX Compressed Archive" (.hfz) directory traversal vulnerability poc (ipsdix@...il.com)
(GET var 'member') BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS <= v1.9 --> (y3nh4ck3r@...il.com)
[ MDVSA-2009:112 ] ipsec-tools (security@...driva.com)

May 14 (23 messages)

Re: MULTIPLE REMOTE SQL INJECTION VULNERABILITIES---MIM:InfiniX v1.2.003---> (robi@....org)
Insufficient Authentication vulnerability in Asus notebook ("MustLive" <mustlive@...security.com.ua>)
Re: Insufficient Authentication vulnerability in Asus notebook (Jeremy Brown <0xjbrown41@...il.com>)
[security bulletin] HPSBMA02417 SSRT090031 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition (SSE), Lo… (security-alert@...com)
Re: Insufficient Authentication vulnerability in Asus notebook (Susan Bradley <sbradcpa@...bell.net>)
Re: Insufficient Authentication vulnerability in Asus notebook (Mike Vasquez <mike.vasquez@...il.com>)
Re: Insufficient Authentication vulnerability in Asus notebook ("Bob Fiero" <i.am@...talfloss.net>)
iDefense Security Advisory 05.14.09: Apple Mac OS X xnu Kernel workqueue_additem/workqueue_removeitem Index Validation … (iDefense Labs <labs-no-reply@...fense.c…)
RE: Insufficient Authentication vulnerability in Asus notebook (Mike Wilson <mwilson@...disys.com>)
Re: Insufficient Authentication vulnerability in Asus notebook (Michael Scheidell <scheidell@...nap.net>)
Re: Insufficient Authentication vulnerability in Asus notebook (nameless <my.security.lists@...il.com>)
Re: MULTIPLE REMOTE SQL INJECTION VULNERABILITIES---MIM:InfiniX v1.2.003---> ("Tomas Kuliavas" <tokul@...rs.sourceforge.net>)
MULTIPLE CODE INJECTION VULNERABILITIES --TUENTI--SPAIN--> (y3nh4ck3r@...il.com)
MULTIPLE SQL INJECTION VULNERABILITIES --Shutter v-0.1.1--> (y3nh4ck3r@...il.com)
Re: Re: MULTIPLE REMOTE SQL INJECTION VULNERABILITIES---MIM:InfiniX v1.2.003---> (y3nh4ck3r@...il.com)
Re: Insufficient Authentication vulnerability in Asus notebook ("KF (lists)" <kf_lists@...italmunition.com>)
Re: Insufficient Authentication vulnerability in Asus notebook (Ansgar Wiechers <bugtraq@...netcobalt.net>)
Re: Insufficient Authentication vulnerability in Asus notebook (Susan Bradley <sbradcpa@...bell.net>)
Re: Insufficient Authentication vulnerability in Asus notebook (Susan Bradley <sbradcpa@...bell.net>)
RE: Insufficient Authentication vulnerability in Asus notebook (Mike Wilson <mwilson@...disys.com>)
Re: Insufficient Authentication vulnerability in Asus notebook (Daniel Hazelton <dhazelton@...er.net>)
RE: Insufficient Authentication vulnerability in Asus notebook (Steve Quan <sq01@...ku.ca>)
Re: Insufficient Authentication vulnerability in Asus notebook (nameless <my.security.lists@...il.com>)

May 19 (35 messages)

eggdrop/windrop remote crash vulnerability (Thomas Sader <thommey@...il.com>)
[SECURITY] [DSA 1802-1] New squirrelmail packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
INSECURE COOKIE HANDLING VULNERABILITIES --Dog Pedigree Online Database v1.0.1-Beta--> (y3nh4ck3r@...il.com)
[SECURITY] [DSA 1801-1] New ntp packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
(GET var 'id') BLIND SQL INJECTION EXPLOIT --Dog Pedigree Online Database v1.0.1-Beta --> (y3nh4ck3r@...il.com)
HTTP Parameter Pollution ("Luca.carettoni" <luca.carettoni@...isoft.com>)
[ MDVSA-2009:117 ] ntp (security@...driva.com)
Re: POC & exploit for Apache mod_rewrite off-by-one (arulvadivel1@...iffmail.com)
Namad Cms Remote File Download (info@...uritylab.ir)
[security bulletin] HPSBMA02428 SSRT090048 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting … (security-alert@...com)
[TZO-23-2009] Avira antivir generic evasion of heuristics (for PDF) (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:118 ] kernel (security@...driva.com)
[TZO-22-2009] Bitdefender generic evasion of heuristics (for PDF) (Thierry Zoller <Thierry@...ler.lu>)
rPSA-2009-0086-1 postgresql postgresql-contrib postgresql-server (rPath Update Announcements <announce-noreply@...th.com>)
[ MDVSA-2009:116 ] gnutls (security@...driva.com)
ZDI-09-023: Apple OS X ATSServer Compact Font Format Parsing Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2009:115 ] phpMyAdmin (security@...driva.com)
[ MDVSA-2009:114 ] ipsec-tools (security@...driva.com)
Conference on Cyber Warfare: registration open! (kgconference@...il.com)
ZDI-09-022: Apple Safari Malformed SVGList Parsing Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
PAPER: Dynamic Data Flow Analysis via Virtual Code Integration (aka The SpiderPig case) ("Piotr Bania" <bania.piotr@...il.com>)
[ MDVSA-2009:113 ] cyrus-sasl (security@...driva.com)
BugCON '09 has swine influenza!! (Carlos Augusto <vend3tta@...oo.fr>)
NetDecision TFTP Server 4.2 TFTP Directory Traversal (vuln_research@...nceofnigeria.org)
[TKADV2009-006] libsndfile/Winamp VOC Processing Heap Buffer Overflow (Tobias Klein <tk@...pkit.de>)
WinAppDbg module v1.1 is out! (Mario Alejandro Vilas Jerez <mvilas@...il.com>)
rPSA-2009-0084-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
Fwd: [Full-disclosure] IIS6 + webdav and unicode rides again in 2009 (Thierry Zoller <Thierry@...ler.lu>)
n.runs-SA-2009.001 - OS X CFNetwork advisory (<security@...ns.com>)
[security bulletin] HPSBMA02426 SSRT090053 rev.1 - HP System Management Homepage (SMH) for Linux and Windows Running PHP and OpenSSL, Remo… (security-alert@...com)
[security bulletin] HPSBMA02427 SSRT090069 rev.1 - HP Remote Graphics Software (RGS) Sender Running Easy Login, Remote Unauthorized Access (security-alert@...com)
MULTIPLE REMOTE VULNERABILITIES --my-colex 1.4.2--> (y3nh4ck3r@...il.com)
MULTIPLE REMOTE VULNERABILITIES --my-Gesuad 0.9.14--> (y3nh4ck3r@...il.com)
[SECURITY] [DSA 1800-1] New Linux 2.6.26 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
iDefense Security Advisory 05.14.09: Multiple Vendor Outside In Multiple Integer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)

May 20 (23 messages)

iDefense Security Advisory 05.14.09: Multiple Vendor Outside In Spreadsheet Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 05.14.09: Multiple Vendor Outside In Spreadsheet Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 05.14.09: Multiple Vendor Outside In Multiple Spreadsheet Buffer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com…)
Re: Insufficient Authentication vulnerability in Acer notebooks ("MustLive" <mustlive@...security.com.ua>)
Re: Insufficient Authentication vulnerability in Asus notebook ("Bob Fiero" <i.am@...talfloss.net>)
Re: Insufficient Authentication vulnerability in Asus notebook (Susan Bradley <sbradcpa@...bell.net>)
Re: Insufficient Authentication vulnerability in Asus notebook (Ansgar Wiechers <bugtraq@...netcobalt.net>)
RE: Insufficient Authentication vulnerability in Asus notebook (Jim Harrison <Jim@...tools.org>)
Re: Insufficient Authentication vulnerability in Asus notebook ("Just1n T1mberlake" <hotpackets@...lokitty.com>)
[ MDVSA-2009:119 ] kernel (security@...driva.com)
[USN-777-1] Ntp vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1804-1] New ipsec-tools packages fix denial of service (Nico Golde <nion@...ian.org>)
[SECURITY] [DSA 1803-1] New nsd packages fix denial of service (Thijs Kinkhorst <thijs@...ian.org>)
Cisco Security Advisory: CiscoWorks TFTP Directory Traversal Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Shakacon Security Conference - Trainers and Speakers Finalized ("Shakacon" <info@...kacon.org>)
Re: Insufficient Authentication vulnerability in Acer notebooks (Susan Bradley <sbradcpa@...bell.net>)
DMXReady Registration Manager Arbitrary File Upload Vulnerability (info@...uritylab.ir)
Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities. (publists@...blesecurity.com)
Re: [security bulletin] HPSBMA02426 SSRT090053 rev.1 - HP System Management Homepage (SMH) for Linux and Windows Runnin… (Steve Shockley <steve.shockley@...ckley…)
CORE-2009-0109 - Multiple XSS in Sun Communications Express (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[security bulletin] HPSBPI02398 SSRT080166 rev.3 - Certain HP LaserJet Printers, HP Color LaserJet Printers, and HP Digital Senders, Remot… (security-alert@...com)
(GET vars 'x' & 'y') ADMIN FUNCTION EXECUTION--Jorp v-1.3.05.09--> (y3nh4ck3r@...il.com)
iDefense Security Advisory 05.20.09: IBM AIX libc MALLOCDEBUG File Overwrite Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

May 21 (4 messages)

DDIVRT-2009-25 IPsession SQL Injection Vulnerability (ddvulnalert@...fronline.com)
[ MDVSA-2009:120 ] openssl (security@...driva.com)
Novell GroupWise Web Access Multiple XSS (swhite@...urestate.com)
MULTIPLE SQL INJECTION VULNERABILITIES --Flash Quiz Beta 2--> (y3nh4ck3r@...il.com)

May 22 (9 messages)

[SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix (Thijs Kinkhorst <thijs@...ian.org>)
[ MDVSA-2009:121 ] lcms (security@...driva.com)
DotNetNuke ErrorPage.aspx Cross-Site Scripting Vulnerability (Ben Hawkes <ben.hawkes@...eralsecurity.com>)
Novell GroupWise Internet Agent Remote Buffer Overflow Vulnerabilities ("VUPEN Security Research" <advisories@...en.com>)
Serena Dimensions CM Desktop Client does not validate the server SSL certificate (roland.gruber.extern@...creditgroup.eu)
LxBlog (info@...uritylab.ir)
[TZO-24-2009] Panda generic evasion (CAB) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-25-2009] Panda generic evasion (TAR) (Thierry Zoller <Thierry@...ler.lu>)
[SECURITY] [DSA 1805-1] New pidgin packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)

May 25 (18 messages)

[oCERT-2009-006] Android improper package verification when using shared uids (Will Drewry <redpig@...rt.org>)
Secunia Research: Sun Solaris "sadmind" Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Sun Solaris "sadmind" Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[ GLSA 200905-03 ] IPSec Tools: Denial of Service (Alex Legler <a3li@...too.org>)
ChinaGames (CGAgent.dll) ActiveX Remote Code Execution Exploit (info@...uritylab.ir)
[InterN0T] AMember 3.1.7 - Multiple Vulnerabilities (security@...ern0t.net)
MULTIPLE REMOTE VULNERABILITIES --MiniTwitter<=v0.3-Beta--> (y3nh4ck3r@...il.com)
[ GLSA 200905-06 ] acpid: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200905-02 ] Cscope: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200905-04 ] GnuTLS: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
[ MDVSA-2009:122 ] squirrelmail (security@...driva.com)
[SECURITY] [DSA 1806-1] New cscope packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Re: FUD Forum < 2.7.1 PHP code injection vurnelability (naudefj@...komsa.net)
MULTIPLE SQL INJECTION VULNERABILITIES --Joomla Component 'Boy Scout Advancement' <= v-0.3 (com_bsadv)--> (y3nh4ck3r@...il.com)
[ GLSA 200905-05 ] FreeType: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
Hardening OSX against CVE-2008-5353 (Marc Schoenefeld <marc.schoenefeld@....org>)
PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs ("Piotr Bania" <bania.piotr@...il.com>)
Arcade Trade Script XSS (SmOk3 <smok3f00@...il.com>)

May 26 (11 messages)

Backdoor in com_rsgallery2 gallery extension for joomla (Jan van Niekerk <jvnkrk@...il.com>)
[TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) (Thierry Zoller <Thierry@...ler.lu>)
Multiple vulnerabilities in several ATEN IP KVM Switches (Jakob Lell <jakob@...tu-berlin.de>)
SEC Consult SA-20090525-0 :: Nortel Contact Center Manager Server Authentication Bypass Vulnerability (Bernhard Mueller <research@...-consult.com>)
[ GLSA 200905-07 ] Pidgin: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
COWON America jetCast 2.0.4.1109 (.mp3) local heap buffer overlow exploit (nospam@...il.it)
SEC Consult SA-20090525-1 :: Nortel Contact Center Manager Server Password Disclosure Vulnerability (Bernhard Mueller <research@...-consult.com>)
SEC Consult SA-20090525-2 :: SonicWALL Global Security Client Local Privilege Escalation Vulnerability (Bernhard Mueller <research@...-consult.com>)
SEC Consult SA-20090525-3 :: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability (Bernhard Mueller <research@...-consult.com>)
SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability (Bernhard Mueller <research@...-consult.com>)
[ GLSA 200905-08 ] NTP: Remote execution of arbitrary code (Alex Legler <a3li@...too.org>)

May 27 (16 messages)

Addendum : [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) (Thierry Zoller <Thierry@...ler.lu>)
[IMF 2009] 3rd Call - Deadline Extended (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
W3af ninja training class in NYC (Michelangelo Sidagni <msidagni@...sec.com>)
Re: Backdoor in com_rsgallery2 gallery extension for joomla (Jonah Braun <jonah@...ckbarnmedia.com>)
PHP Nuke v.8.0 (referer) SQL Injection (darkz.gsa@...il.com)
Vanilla v.1.1.7 Cross-Site Scripting (darkz.gsa@...il.com)
[security bulletin] HPSBUX02429 SSRT090058 rev.1 - HP-UX Running Java, Remote Execution of Arbitrary Code and Other Vulnerabilities (security-alert@...com)
Re: Addendum : [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) ("Jim Parkhurst" <JPARKHUR@....state.tx.us>)
[ GLSA 200905-09 ] libsndfile: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
Re[2]: [Full-disclosure] Addendum : [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) (Thierry Zoller <Thierry@...ler.lu>)
Re: [Full-disclosure] [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) (Michal Zalewski <lcamtuf@...edump.cx>)
Re[2]: Addendum : [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Re[2]: [Full-disclosure] [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:123 ] opensc (security@...driva.com)
[InterN0T] AdPeeps 8.5d1 - XSS and HTML Injection Vulnerabilities (security@...ern0t.net)
New paper: Understanding Microsoft's KB971492 IIS WebDAV Vuln (Steve Friedl <steve@...xwiz.net>)

May 28 (18 messages)

rPSA-2009-0091-1 cyrus-sasl cyrus-sasl-server (rPath Update Announcements <announce-noreply@...th.com>)
MULTIPLE REMOTE VULNERABILITIES --Small Pirates v-2.1--> (y3nh4ck3r@...il.com)
rPSA-2009-0092-1 ntp ntp-utils (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2009-0095-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
[Bkis-09-2009] XSS vulnerability in 'Monitor_Bandwidth' - PRTG Traffic Grapher (Bkis <svrt@...v.com.vn>)
ecshop 2.6.2 (info@...uritylab.ir)
Survey: "MIME/Content-Type-Sniffing" Issues in Image Uploads in Forum Scripts (Jacques Copeau <jacquescopeau@...glemail.com>)
Re: [TZO-27-2009] Firefox Denial of Service (Keygen) (Tavis Ormandy <taviso@....lonestar.org>)
Re[2]: [TZO-27-2009] Firefox Denial of Service (Keygen) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-27-2009] Firefox Denial of Service (Keygen) (Thierry Zoller <Thierry@...ler.lu>)
Re: [InterN0T] AMember 3.1.7 - Multiple Vulnerabilities (TK147@...Architect.com)
ZDI-09-021: Apple QuickTime PICT Unspecified Tag Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Call For Papers – ACM CCS 2009 Workshops (Christopher Kruegel <chris@...ucsb.edu>)
Re: Insufficient Authentication vulnerability in Acer notebooks ("MustLive" <mustlive@...security.com.ua>)
Novell Groupwise fails to properly sanitize emails. (c3rb3r@...eotron.ca)
Re: Insufficient Authentication vulnerability in Acer notebooks (Susan Bradley <sbradcpa@...bell.net>)
CORE-2009-0401 - StoneTrip S3DPlayers remote command injection (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[InterN0T] Achievo 1.3.4 - XSS Vulnerability (security@...ern0t.net)

May 29 (9 messages)

Re: [InterN0T] AdPeeps 8.5d1 - XSS and HTML Injection Vulnerabilities (support@...eeps.com)
VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues (VMware Security team <security@...are.com>)
[TZO-28-2009] - Avira Antivir generic RAR,CAB,ZIP (Thierry Zoller <Thierry@...ler.lu>)
Re: PHP Nuke v.8.0 (referer) SQL Injection (a@...om)
(whitepaper) Microsoft WPAD Technology Weaknesses [PTResearch Team] (srublev@...ecurity.ru)
Re: Re: [InterN0T] AMember 3.1.7 - Multiple Vulnerabilities (security@...ern0t.net)
SonicWALL SSL-VPN Appliance Format String Vulnerability (Patrick Webster <patrick@...hack.com>)
Re: [InterN0T] Achievo 1.3.4 - XSS Vulnerability (security@...ern0t.net)
Whitepaper (Jared DeMott <jdemott@...cialsecurity.com>)

302 messages

Powered by blists - more mailing lists