Bugtraq

Date Index

WheatBlog 1.1 RFI/SQL Injection, underwater
Re: Re: Progress Webspeed exploit for all releases, suresync
Airscanner Advisory #07062901: FlexiSPY Victim/User Database Exposure (Full world readable access to ALL SMS/Emails/Voice data from victims/users), Airscanner Corp.
SQL Injection In Script VBZooM V1.12, RaeD
flac123 0.0.9 - Stack overflow in comment parsing, David Thiel
[SECURITY] [DSA 1325-1] New evolution packages fix arbitrary code execution, Moritz Muehlenhoff
TSLSA-2007-0021 - kerberos5, Trustix Security Advisor
[USN-479-1] MadWifi vulnerabilities, Kees Cook
[SECURITY] [DSA 1323-1] New krb5 packages fix several vulnerabilities, Moritz Muehlenhoff
[SECURITY] [DSA 1324-1] New hiki packages fix missing input sanitising, Steve Kemp
FLEA-2007-0030-1: avahi avahi-glib avahi-sharp, Foresight Linux Essential Announcement Service
[security bulletin] HPSBTU02232 SSRT071429 rev.1 - Secure Web Server for HP Tru64 UNIX Powered by Apache (SWS) or HP Internet Express for Tru64 UNIX running PHP, Remote Arbitrary Code Execution, Unauthorized Disclosure of Information, or Denial of Service (DoS), security-alert
Secunia Research: KVIrc irc:// URI Handler Command Execution Vulnerability, Secunia Research
Secunia Research: Symantec Mail Security for SMTP Boundary Errors, Secunia Research
[SecurInfos] PCSoft WinDEV .wdp Project File Handling Buffer Overflow, Jerome Athias
XEForum Cookie Modification Privilege Escalation Vulnerability, Firewall1954
FLEA-2007-0029-1: krb5 krb5-workstation, Foresight Linux Essential Announcement Service
rPSA-2007-0136-1 httpd mod_ssl, rPath Update Announcements
eTicket version 1.5.5 XSS Attack Vulnerability, securityresearch
- <Possible follow-ups>
- Re: eTicket version 1.5.5 XSS Attack Vulnerability, sf
eTicket version 1.5.5 Path Disclosure Vulnerability, securityresearch
[SECURITY] [DSA 1322-1] New wireshark packages fix denial of service, Moritz Muehlenhoff
[GOODFELLAS - VULN] hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data Write., Goodfellas SRT
rPSA-2007-0135-1 krb5 krb5-server krb5-services krb5-test krb5-workstation, rPath Update Announcements
CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability, Henri Lindberg - Louhi Networks Oy
Juniper SBR V 6.0.1 CRL-Checking problem, USprotte
Contact request - nVidia, john-lindsay
HPSBTU02207 SSRT061239 rev.2 - HP Tru64 UNIX OpenSSL and BIND Remote Arbitrary Code Execution or Denial of Service (DoS), security-alert
Openedge _mprosrv buffer overflow, suresync
Conti FTP Server v1.0 DoS, esc6
[ MDKSA-2007:136 ] - Updated evolution packages fix vulnerability, security
SAP Internet Communication Framework (BC-MID-ICF) Vulnerability, Ivan Buetler
PHP 4/5 htaccess safemode and open_basedir Bypass, cxib
SAP Web Dynpro Java (BC-WD-JAV) Vulnerability, Ivan Buetler
[USN-478-1] libexif vulnerability, Kees Cook
[ MDKSA-2007:137 ] - Updated krb5 packages fix vulnerabilities, security
[USN-477-1] krb5 vulnerabilities, Kees Cook
[ GLSA 200706-09 ] libexif: Buffer overflow, Raphael Marichez
[ GLSA 200706-08 ] emul-linux-x86-java: Multiple vulnerabilities, Raphael Marichez
[GOODFELLAS - VULN ] Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write, GOODFELLAS SRT
iDefense Security Advisory 06.26.07: RealNetworks RealPlayer/HelixPlayer SMIL wallclock Stack Overflow Vulnerability, iDefense Labs
Calyptix Security Advisory CX-2007-04 - Cross-Site Request Forgery Attack Against Check Point Safe@Office Device, Calyptix Security
iDefense Security Advisory 06.26.07: Multiple Vendor Kerberos kadmind Rename Principal Buffer Overflow Vulnerability, iDefense Labs
MITKRB5-SA-2007-005: kadmind vulnerable to buffer overflow, Tom Yu
MITKRB5-SA-2007-004: kadmind multiple RPC lib vulnerabilities, Tom Yu
SYMSA-2007-004: Multiple Vulnerabilities in Xythos Server Products, research
rPSA-2007-0133-1 emacs emacs-leim, rPath Update Announcements
CFP: ISOI III (a DA workshop), Gadi Evron
[ISR] :: Infobyte Security Research :: release (ISR-sqlget.pl) v1.0.0, Francisco Amato
Calendarix version 0.7. 20070307 Multiple SQL Injection Vulnerabilities, securityresearch
MyNews version 0.10 SQL Injection Vulnerability, securityresearch
[security bulletin] HPSBUX02225 SSRT071295 rev.1 - HP-UX Running Xserver, Local Denial of Service (DoS), security-alert
rPSA-2007-0131-1 libexif, rPath Update Announcements
"run as" local denial-of-service enables administrative account processes to be killed, Eitan Caspi
- RE: "run as" local denial-of-service enables administrative account processes to be killed, James C. Slora Jr.
Safari XMLHttpRequest HTTP header injection, Richard Moore
Papoo CMS 3.6 - Access Restriction Bypass, Nico Leidecker
phpTrafficA < 1.4.2, laurent . gaffie
Calendarix version 0.7. 20070307 Multiple XSS Attacks, securityresearch
Safari Bookmarks Buffer Overflow Vulnerability, azizov
Pluxml 0.3.1 Remote Code Execution Exploit, gmdarkfig
Calendarix version 0.7. 20070307 Multiple Path Disclosure Vulnerabilities, securityresearch
- <Possible follow-ups>
- Calendarix version 0.7. 20070307 Multiple Path Disclosure Vulnerabilities, securityresearch
LiteWEB 2.7 404 Denial of Services, imprili
Ingres wakeup setuid(ingres) file truncation, NGSSoftware Insight Security Research
POWER PHLOGGER v.2.2.5 (username) SQL Injection, darkz . gsa
Ingres stack overflow in uuid_from_char function, NGSSoftware Insight Security Research
Ingres Unauthenticated Pointer Overwrite 1, NGSSoftware Insight Security Research
Papoo CMS 3.6 - SQL Injection, Nico Leidecker
KF Web Server 3.1.0 admin console XSS, imprili
- <Possible follow-ups>
- Re: KF Web Server 3.1.0 admin console XSS, support
Ingres verifydb local stack overflow, NGSSoftware Insight Security Research
Ingres Unauthenticated Pointer Overwrite 2, NGSSoftware Insight Security Research
SHTTPD V1.38 server source code disclosure, imprili
[GOODFELLAS - VULN] BarCodeAx.dll v. 4.9 ActiveX Control Remote Stack Buffer Overflow, GOODFELLAS SRT
[SECURITY] [DSA 1320-1] New clamav packages fix several vulnerabilities, Moritz Muehlenhoff
[SECURITY] [DSA 1321-1] New evolution-data-server packages fix arbitrary code execution, Moritz Muehlenhoff
[SECURITY] [DSA 1319-1] New maradns packages fix denial of service, Moritz Muehlenhoff
[SECURITY] [DSA 1317-1] New tinymux packages fix buffer overflow, Steve Kemp
[SECURITY] [DSA 1318-1] New ekg packages fix denial of service, Moritz Muehlenhoff
[ MDKSA-2007:135 ] - Updated webmin packages fix XSS vulnerability, security
FLEA-2007-0028-1: libexif, Foresight Linux Essential Announcement Service
[USN-476-1] redhat-cluster-suite vulnerability, Kees Cook
eNdonesia 8.4 [multiple injection sql], laurent . gaffie
[CAID 35450, 35451, 35452, 35453]: CA Products That Embed Ingres Multiple Vulnerabilities, Williams, James K
All Of the Mambo & Joomla Script Remote File Inclussion Bugs.., spymeta
[USN-475-1] evolution-data-server vulnerability, Kees Cook
MS07-034: Executing arbitrary script with mhtml: protocol handler, HASEGAWA Yosuke
[ MDKSA-2007:134 ] - Updated xfsdump packages fix unsafe temporary directory creation issue, security
[ MDKSA-2007:133 ] - Updated emacs packages fix DoS vulnerability, security
iDefense Security Advisory 06.21.07: Ingres Database Multiple Heap Corruption Vulnerabilities, iDefense Labs
Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x, Steven M. Christey
- <Possible follow-ups>
- Re: Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x, scott-REMOVE-
HPSBST02231 SSRT071438 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-030 to MS07-035, security-alert
[security bulletin] HPSBGN02199 SSRT071312 rev.3 - Mercury Quality Center ActiveX, Remote Unauthorized Arbitrary Code Executio, security-alert
NetClassifieds [multiple vulnerabilities], laurent . gaffie
[ MDKSA-2007:132 ] - Updated madwifi-source, wpa_supplicant packages fix vulnerabilities, security
VLC 0.8.6b format string vulnerability & integer overflow, David Thiel
[SECURITY] [DSA 1316-1] New emacs21 packages fix denial of service, Steve Kemp
[ MDKSA-2007:131 ] - Updated Thunderbird packages fix multiple vulnerabilities, security
[ MDKSA-2007:130 ] - Updated proftpd packages fix authentication bypass vulnerability, security
HTTP SERVER (httpsv1.6.2) 404 Denial of Service, imprili
MyServer-0.8.9 - xss in sample cgi page, imprili
MyServer-0.8.9 - source code disclosure, imprili
HTTP SERVER (httpsv1.6.2) source code disclosure, imprili
[security bulletin] HPSBTU02218 SSRT071424 rev.1 - HP Tru64 UNIX Internet Express running Samba, Remote Arbitrary Code Execution or Local Unauthorized Privilege Elevation, security-alert
[security bulletin] HPSBPI02226 SSRT061274 rev.1 - HP Help and Support Center Running on HP Notebook Computers Running with Windows XP, Remote Unauthorized Access, security-alert
fusetalk CSS (autherror.cfm), Ivan Almuina
fusetalk CSS (comfinish.cfm), Ivan Almuina
[ MDKSA-2007:128 ] - Updated libexif packages fix integer overflow flaw, security
FLEA-2007-0027-1: thunderbird, Foresight Linux Essential Announcement Service
Pixy - An Open-Source Vulnerability Scanner for PHP Applications, pixy-noreply
New Include Redirect Bug XSS All vBulletin v 3.x.x, stormhacker
- <Possible follow-ups>
- Re: New Include Redirect Bug XSS All vBulletin v 3.x.x, scott-REMOVE-
  - Re: New Include Redirect Bug XSS All vBulletin v 3.x.x, kaneda
- Re: Re: New Include Redirect Bug XSS All vBulletin v 3.x.x, scott-REMOTE-
[ MDKSA-2007:129 ] - Updated jasper packages fix vulnerability, security
Apache Prefork MPM vulnerabilities - Report, Blazej Miga
Comersus Shop Cart 7.07 SQL Injection & XSS, DoZ
New post Topic Hijacking XSS All vBulletin v 3.x.x (2), stormhacker
- <Possible follow-ups>
- Re: New post Topic Hijacking XSS All vBulletin v 3.x.x (2), scott-REMOVE-
[ MDKSA-2007:127 ] - Updated apache packages fix mod_mem_cache issue, security
[ GLSA 200706-07 ] PHProjekt: Multiple vulnerabilities, Raphael Marichez
[ GLSA 200706-06 ] Mozilla products: Multiple vulnerabilities, Raphael Marichez
W1L3D4 WEBmarket v0,1 SQL Injection Vuln, crackers_child
[SECURITY] [DSA 1315-1] New libphp-phpmailer packages fix arbitrary shell command execution, Moritz Muehlenhoff
[SECURITY] [DSA 1314-1] New open-iscsi packages fix several vulnerabilities, Moritz Muehlenhoff
[SECURITY] [DSA 1313-1] New MPlayer packages fix arbitrary code execution, Moritz Muehlenhoff
Persistent cross-site scripting in wordpress.com dashboard, Matteo Carli
Local File Include Vulnerabilities in YaBB <= 2.1(all version), krasza
MaraDNS denial of service vulnerabilities, jantunes
CfP: 5th ACM Workshop on Recurring Malware (WORM) - Deadline extension, chris
iG Shop 1.4 eval Inclusion Vulnerability, ifx
fusetalk SQL (autherror.cfm), Ivan Almuina
rPSA-2007-0127-1 fetchmail, rPath Update Announcements
[CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing, Mark Thomas
FLEA-2007-0026-1: evolution-data-server, Foresight Linux Essential Announcement Service
iDefense Security Advisory 06.18.07: Cerulean Studios Trillian UTF-8 Word Wrap Heap Overflow Vulnerability, iDefense Labs
Fusetalk SQL injection submission., Charles Kim
fuzzylime (forum) XSS, rm
Webif.cgi local file inclusion, maiosyet
[security bulletin] HPSBMA02224 SSRT071334 rev.1 - HP System Management Homepage (SMH) for Linux, Remote Privileged Access, security-alert
PHP hosting Biller, rm
ShAnKaR: Simle machines forum CAPTCHA bypass and PHP injection, 3APA3A
[SECURITY] [DSA 1312-1] New libapache-mod-jk packages fix information disclosure, Moritz Muehlenhoff
[SECURITY] [DSA 1311-1] New PostgreSQL 7.4 packages fix privilege escalation, Moritz Muehlenhoff
WSPortal version 1.0 SQL Injection Vulnerability, securityresearch
Utopia News Pro version 1.4.0 XSS Attack Vulnerability, securityresearch
WSPortal version 1.0 Path Disclosure Vulnerability, securityresearch
[SECURITY] [DSA 1310-1] New libexif packages fix integer overflow, Steve Kemp
[SECURITY] [DSA 1309-1] New libexif packages fix integer overflow, Steve Kemp
[ MDKSA-2007:126-1 ] - Updated Firefox packages fix multiple vulnerabilities, security
[SECURITY] [DSA 1309-1] New PostgreSQL 8.1 packages fix privilege escalation, Moritz Muehlenhoff
Having Fun With PostgreSQL, Nico Leidecker
- Re: Having Fun With PostgreSQL, Ray Stell
- Re: Having Fun With PostgreSQL, Frank Berek
Local Denial of Service in Safari, azizov
Sitellite cms <= 4.2.12 RFI Vuln, CarcaBot
- <Possible follow-ups>
- Re: Sitellite cms <= 4.2.12 RFI Vuln, lux
[SECURITY] [DSA 1304-1] New Linux kernel 2.6.8 packages fix several vulnerabilities, dann frazier
[ MDKSA-2007:126 ] - Updated Firefox packages fix multiple vulnerabilities, security
PhpListPro Persistent XSS Vulnerability, corrado . liotta
Papoo CMS - Multiple Cross Site Scripting, Nico Leidecker
[ GLSA 200706-05 ] ClamAV: Multiple Denials of Service, Raphael Marichez
rPSA-2007-0122-1 evolution-data-server, rPath Update Announcements
rPSA-2007-0126-1 util-linux, rPath Update Announcements
rPSA-2007-0124-1 kernel xen, rPath Update Announcements
rPSA-2007-0123-1 squirrelmail, rPath Update Announcements
Kaspersky Multiple insufficient argument validation of hooked SSDT function Vulnerability, Matousec - Transparent security Research
Re: [MajorSecurity Advisory #47]Simple Machines Forum (SMF) - Session fixation Issue, nobody
- <Possible follow-ups>
- Re: Re: [MajorSecurity Advisory #47]Simple Machines Forum (SMF) - Session fixation Issue, motokochan
[ MDKSA-2007:125 ] - Updated spamassassin packages fix possible DoS condition, security
RFI In Script SH-News 3.1, Raed
ByPass In PortalApp, Raed
Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability, accounting
- Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability, John M. Martinelli
  - Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability, Jon Ribbens
Elxis CMS <= 2006.4 - banner module - sql injection, Nico Leidecker
iDefense Security Advisory 06.14.07: Apache MyFaces Tomahawk JSF Framework Cross-Site Scripting (XSS) Vulnerability, iDefense Labs
[SECURITY] [DSA 1308-1] New iceweasel packages fix several vulnerabilities, Moritz Muehlenhoff
[CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples, Mark Thomas
Re: Re: BlackBoard Multiple Vulnerabilities (XSS), anonymous
[CVE-2007-2450]: Apache Tomcat XSS vulnerability in Manager, Mark Thomas
[ MDKSA-2007:124 ] - Updated tetex packages fix vulnerability, security
rPSA-2007-0119-1 spamassassin, rPath Update Announcements
[ MDKSA-2007:122 ] - Updated gd packages fix vulnerability, security
Singapore Gallery fullpath disclosure, hack2prison
[ MDKSA-2007:123 ] - Updated libwmf packages fix vulnerability, security
[ MDKSA-2007:121 ] - Updated freetype2 packages fix integer overflow vulnerability, security
FLEA-2007-0025-1: openoffice.org, Foresight Linux Essential Announcement Service
[SECURITY] [DSA 1305-1] New icedove packages fix several vulnerabilities, Moritz Muehlenhoff
High risk vulnerability in OpenOffice RTF parser, NGSSoftware Insight Security Research
iDefense Security Advisory 06.13.07: Multiple Vendor libexif Integer Overflow Heap Corruption Vulnerability, iDefense Labs
Apple Safari: cookie stealing, Robert Swiecki
- Re: [Full-disclosure] Apple Safari: cookie stealing, Michal Zalewski
- Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing, Robert Swiecki
  - Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing, Mark Senior
  - Re: Apple Safari: idn urlbar spoofing, Robert Swiecki
    - RE: [Full-disclosure] Apple Safari: idn urlbar spoofing, Larry Seltzer
    - Re: [Full-disclosure] Apple Safari: idn urlbar spoofing, Michal Zalewski
    - Re: Apple Safari: idn urlbar spoofing, Robert Swiecki
[USN-474-1] xscreensaver vulnerability, Kees Cook
iDefense Security Advisory 06.12.07: Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerability, iDefense Labs
Menu Manager Mod for WebAPP - No Input Filtering, web-app
- <Possible follow-ups>
- Re: Menu Manager Mod for WebAPP - No Input Filtering, webapp
ZDI-07-038: Microsoft Internet Explorer Prototype Dereference Code Execution Vulnerability, zdi-disclosures
ZDI-07-037: Microsoft Internet Explorer Language Pack Installation Remote Code Execution Vulnerability, zdi-disclosures
[ MDKSA-2007:120 ] - Updated Firefox packages fix multiple vulnerabilities, security
Windows Oday release, Thomas Lim
- Re: Windows Oday release, ge
  - Re: Windows Oday release, Joanna Rutkowska
    - Re: [Full-disclosure] Windows Oday release, Jared DeMott
- <Possible follow-ups>
- Re: Windows Oday release, Steven M. Christey
  - Re: Windows Oday release, ge
    - Re: Windows Oday release, Hugo van der Kooij
[ MDKSA-2007:119 ] - Updated Thunderbird packages fix multiple vulnerabilities, security
[security bulletin] HPSBUX02219 SSRT061273 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS), security-alert
[SECURITY] [DSA 1307-1] New OpenOffice.org packages fix arbitrary code execution, Martin Schulze
ZDI-07-036: Arris Cadant C3 CMTS Remote DoS Vulnerability, zdi-disclosures
PHP parse_str() arbitrary variable overwrite, gmdarkfig
- <Possible follow-ups>
- Re: PHP parse_str() arbitrary variable overwrite, admin
- Re: PHP parse_str() arbitrary variable overwrite, Steven M. Christey
  - Re: PHP parse_str() arbitrary variable overwrite, Chuck Swiger
- Re: Re: PHP parse_str() arbitrary variable overwrite, gmdarkfig
[SECURITY] [DSA 1306-1] New xulrunner packages fix several vulnerabilities, Moritz Muehlenhoff
Safari for Windows, 0day URL protocol handler command injection, Thor Larholm
- RE: [Full-disclosure] Safari for Windows,0day URL protocol handler command injection, Larry Seltzer
[USN-473-1] libgd2 vulnerabilities, Kees Cook
[USN-472-1] libpng vulnerability, Kees Cook
[USN-471-1] libexif vulnerability, Kees Cook
[USN-439-2] file vulnerability, Kees Cook
[ GLSA 200706-04 ] MadWifi: Multiple vulnerabilities, Raphael Marichez
SECNICHE : Dwelling Security is On the Run, Aditya K Sood
PHPMailer command execution, Thor Larholm
MLabs is Shifted Fully : SecNiche Initiative, Aditya K Sood
Project CERA Is Up Again : Secniche Initiative, Aditya K Sood
[TOOL] w3af - Web Application Attack and Audit Framework, Andres Riancho
Webwiz vulnerable, spymaster
WinPT User ID Spoofing Vulnerability, nnposter
SpyBye 0.3 released, Niels Provos
Serious holes affecting JFFNMS, Tim Brown
Maran Blog XSS vulnerability, ls
[SECURITY] [DSA 1303-1] New lighttpd packages fix denial of service, Steve Kemp
Cisco Trust Agent Vulnerability, adblake
[SECURITY] [DSA 1302-1] New freetype packages fix integer overflow, Steve Kemp
myBloggie 2.1.5 Remote File Include, yaser
- <Possible follow-ups>
- Re: myBloggie 2.1.5 Remote File Include, the . tiger100
[SECURITY] [DSA 1301-1] New Gimp packages fix arbitrary code execution, Noah Meyerhans
vSupport Integrated Ticket System 3.*.* SQL injection, stormhacker
[USN-470-1] Linux kernel vulnerabilities, Kees Cook
[ MDKSA-2007:118 ] - Updated libexif packages fix crash and possible arbitrary code execution issue, security
EEYE: Yahoo Webcam ActiveX Controls Multiple Buffer Overflows, eEye Advisories
iDefense Security Advisory 06.07.07: Linux Kernel cpuset tasks Information Disclosure Vulnerability, iDefense Labs
TSLSA-2007-0020 - clamav, Trustix Security Advisor
[OpenPKG-SA-2007.021] OpenPKG Security Advisory (wordpress), OpenPKG GmbH
Wordpress default theme XSS (admin) and other problems, John Smith
rPSA-2007-0117-1 gd php php-mysql php-pgsql, rPath Update Announcements
Packeteer PacketShaper Web Management Denial of Service, nnposter
Second Call for Papers: DeepSec IDSC 2007 Europe/Vienna: 20-23 Nov 2007, Paul Böhm
CSIS Advisory: BlueCoat K9 Web Protection 3.2.36 Overflow, Dennis Rand
PHPMyDesk Beta Release 1.0b ==> RFI, titanichacker titanichacker
- <Possible follow-ups>
- Re: PHPMyDesk Beta Release 1.0b ==> RFI, the . tiger100
- Re: Re: PHPMyDesk Beta Release 1.0b ==> RFI, no-spam
Zen Help Desk ==> Version 2.1 Bypass/, titanichacker titanichacker
Re: LuckyBot v3 Remote File Include, info
Re: Monkey CMS v0.0.3 Remote File Include Vulnerabilitiy, www
[SECURITY] [DSA 1300-1] New iceape packages fix several vulnerabilities, Moritz Muehlenhoff
phpWebThings ==>1.5.2 RFI, titanichacker titanichacker
[SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial of service, dann frazier
- Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial of service, 3APA3A
  - Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial of service, dann frazier
OWASP and WASC Cocktail party at Blackhat USA 2007, Anurag Agarwal
Sudo: local root compromise with krb5 enabled, Thor Lancelot Simon
- Re: Sudo: local root compromise with krb5 enabled, Thor Lancelot Simon
  - MIT krb5: makes sudo authentication issue MUCH worse., Thor Lancelot Simon
- Re: Sudo: local root compromise with krb5 enabled, James Downs
  - Re: Sudo: local root compromise with krb5 enabled, Mark Senior
    - Re: Sudo: local root compromise with krb5 enabled, Todd C. Miller
- <Possible follow-ups>
- Re: Sudo: local root compromise with krb5 enabled, Ken Raeburn
  - Re: Sudo: local root compromise with krb5 enabled, Kyle Wheeler
    - Re: Sudo: local root compromise with krb5 enabled, Ken Raeburn
WmsCMS < = 2.0 Multiple XSS Vulnerabilities, glafkos
[CAID 35395, 35396]: CA Anti-Virus Engine CAB File Buffer Overflow Vulnerabilities, Williams, James K
Atom PhotoBlog v1.0.9 XSS vulnerability, ls
W1L3D4 WEBmarket Remote SQL İnjection, Dj_ReMix_20
CSIS Advisory: Microsoft GDI+ Integer division by zero flaw handling .ICO files, Dennis Rand
- Re: CSIS Advisory: Microsoft GDI+ Integer division by zero flaw handling .ICO files, H D Moore
Hnkaray Duyuru Script Remote SQL İnjection, Dj_ReMix_20
RUS-CERT 2007-06:01 (1380): Insecure Defaults in A-L OmniPCX 7.0, Oliver Goebel
IE 6 / MS Office Outlook Express Address Book Activex DoS, no-reply
[ GLSA 200706-02 ] Evolution: User-assisted execution of arbitrary code, Raphael Marichez
IE 6/Microsoft Html Popup Window (mshtml.dll) DoS, no-reply
[ GLSA 200706-03 ] ELinks: User-assisted execution of arbitrary code, Raphael Marichez
Remote log injection on DenyHosts, Fail2ban and BlockHosts, Daniel Cid
FLEA-2007-0021-2: madwifi, Foresight Linux Essential Announcement Service
Light Blog 4.1 XSS Vulnerability, ls
ASP Folder Gallery Vulnerabilities, hack2prison
Announce - Release RFIDIOt ver 0.1n (June 2007), Adam Laurie
iDefense Security Advisory 06.05.07: Symantec Ghost Multiple Denial of Service Vulnerabilities, iDefense Labs
[USN-469-1] Thunderbird vulnerabilities, Kees Cook
[ MDKSA-2007:117 ] - Updated lha packages fix unsafe temporary files creation issue, security
[ MDKSA-2007:116 ] - Updated libpng packages fix vulnerability, security
[ MDKSA-2007:114 ] - Updated file packages fix vulnerabilities, security
SYM07-011 Symantec Reporting Server password disclosure, secure
Comicsense SQL Injection Advisory/Exploit, s0cratex
[ GLSA 200706-01 ] libexif: Integer overflow vulnerability, Raphael Marichez
ZDI-07-034: CA Multiple Product AV Engine CAB Filename Parsing Stack Overflow Vulnerability, zdi-disclosures
SYM07-012 Symantec Reporting Server elevation of privilege, secure
ZDI-07-035: CA Multiple Product AV Engine CAB Header Parsing Stack Overflow Vulnerability, zdi-disclosures
[security bulletin] HPSBUX02218 SSRT071424 rev.1 - HP-UX running CIFS Server (Samba), Remote Arbitrary Code Execution, security-alert
TPTI-07-09: Macrovision FLEXnet boisweb.dll ActiveX Control Buffer Overflow Vulnerability, TSRT
TPTI-07-10: Centennial Software XferWan.exe Stack Overflow Vulnerability, TSRT
[ MDKSA-2007:111 ] - Updated util-linux packages address login access policies bypassing issue, security
[ MDKSA-2007:112 ] - Updated mplayer packages fix buffer overflow vulnerability, security
TPTI-07-08: Symantec Veritas Storage Foundation Scheduler Service Authentication Bypass Vulnerability, TSRT
[security bulletin] HPSBUX02217 SSRT071337 rev.2 - HP-UX running Kerberos, Remote Arbitrary Code Execution, security-alert
[ MDKSA-2007:115 ] - Updated clamav packages fix vulnerabilities, security
[ MDKSA-2007:113 ] - Updated mutt packages fix vulnerabilities, security
[ MDKSA-2007:110 ] - Updated php-pear packages fix directory traversal vulnerability, security
Disinfectors for the calculator virus (ti89.Gaara), Piotr Bania
Re: [PLESK 7.5 Reload] & [PLESK 7.6 for MS Windows] path passing and disclosure vulnerability, leo
rPSA-2007-0115-1 libexif, rPath Update Announcements
rPSA-2007-0114-1 mutt, rPath Update Announcements
SYM07-009,Symantec Storage Foundation for Windows Volume Manager: Authentication Bypass and Potential Code Execution in Scheduler Service, secure
FLEA-2007-0024-1: libexif, Foresight Linux Essential Advisory Service
Unpatched input validation flaw in Firefox 2.0.0.4, Thor Larholm
[SECURITY] [DSA 1291-4] New samba packages fix regression, Moritz Muehlenhoff
My Datebook SQL Injection + XSS, ls
n.runs-SA-2007.015 - F-Secure Antivirus FSG packed files parsing Infinite Loop Advisory, security
n.runs-SA-2007.014 - F-Secure Antivirus ARJ parsing Infinite Loop Advisory, security
uTorrent overflow, Dj . r4iDeN
- Re: uTorrent overflow, Jon Ribbens
  - Re: uTorrent overflow, Andreas Beck
  - Re: uTorrent overflow, Gavin Hanover
  - Message not available
    - Re: uTorrent overflow, Pavel Konov
- <Possible follow-ups>
- Re: uTorrent overflow, Dj . r4iDeN
CERN İmage Map Dispatcher, h0tturk
Dansie Cart Script Exploit Reported, h0tturk
- <Possible follow-ups>
- Re: Dansie Cart Script Exploit Reported, Steven M. Christey
2007-06-03: PeerCast streaming server submits cleartext password, mpeg
Re: Buffer overflow in BusinessMail email server system 4.60.00, iant
- Re: Buffer overflow in BusinessMail email server system 4.60.00, Steve Tornio
WebStudio Multiple XSS Vulnerabilities, glafkos
Redlevel Advisory #025 - Vonage VoIP Telephone Adapter Default Misconfiguration, john
Assorted browser vulnerabilities, Michal Zalewski
S21Sec-035: F5 FirePass command execution vulnerability, S21sec Labs
CACTUSHOP 6 Default Installation Allows Remote Database Disclosure, DoZ
BCS'07 Call For Papers, Jim Geovedi
Comdev eCommerce 4.1 RFI Vulnerability, johnnytalker
Comdev Web Blogger 4.1 RFI Vulnerability, johnnytalker
MyEvent1.6 (template.php) Remote File Inclusion Vulnerability, yaser
- Re: MyEvent1.6 (template.php) Remote File Inclusion Vulnerability, str0ke
  - Recent OpenSSL exploits, Ryan's spam address
Linker index.php - Cross-Site Scripting Vulnerability, vagrant - e-hack.org
iDefense Security Advisory 06.01.07: Symantec VERITAS Storage Foundation Administration Service DoS Vulnerability, iDefense Labs
jumping sudo using ptrace on Linux/i386, Trent Waddington
[USN-468-1] Firefox vulnerabilities, Kees Cook
Evenzia CMS XSS, glafkos
RevokeBB Blind SQL Injection / Hash Extractor, BlackHawk
Outpost Enforcing system reboot with 'outpost_ipc_hdr' mutex Vulnerability, Matousec - Transparent security Research
[MajorSecurity Advisory #49]Calimero.CMS - Session fixation Issue, admin
bugtraq submission, dr . rezen
- RE: bugtraq submission, Warner Moore
[MajorSecurity Advisory #50]chameleon cms - Session fixation Issue, admin
- <Possible follow-ups>
- Re: [MajorSecurity Advisory #50]chameleon cms - Session fixation Issue, admin
n.runs-SA-2007.013 - F-Secure Antivirus LZH parsing BufferOverflow Advisory, security
Prototype of an PHP application ===> RFI, pito pito
static XSS / SQL-Injection in Omegasoft Insel, MC Iglo
PBSite - PHP Bulletin Site | CMS ====> RFI, pito pito
- <Possible follow-ups>
- PBSite - PHP Bulletin Site | CMS ====> RFI, pito pito
SEC Consult SA-20070601-0 :: PHP chunk_split() integer overflow, Gerhard Wagner
[OpenPKG-SA-2007.020] OpenPKG Security Advisory (php), OpenPKG GmbH
phpreactor <===1.2.7 remote file include, pito pito
Z-Blog 1.7 Authentication Bypass Database Download Vulnerability, Raed
Full Path Disclosure in SendCard, xx_hack_xx_2004