Mail Thread Index

• Date Index

• Re: Advisory 02/2005: Remote code execution in Serendipity, GulfTech Security Research
• [SECURITY] [DSA 733-1] New crip packages fix insecure temporary files, Martin Schulze
• Publishing exploit code - what is it good for, Aviram Jenik
  • Re: [Full-disclosure] Publishing exploit code - what is it good for, bruen
  • Re: [Full-disclosure] Publishing exploit code - what is it good for, Joachim Schipper
    • Re: [Full-disclosure] Publishing exploit code - what is it good for, devnull
• [DRUPAL-SA-2005-002] Drupal 4.6.2 / 4.5.4 fixes input validation issue, Uwe Hermann
• [DRUPAL-SA-2005-003] Drupal 4.6.2 / 4.5.4 fixes critical XML-RPC issue, Uwe Hermann
• Re: [Full-disclosure] SEC-CONSULT SA-20050629-0, Moritz Naumann
• Anyone else having serious repercussions from applying W2k sp4 se curity rollup patch?, gerald
• Microsoft Windows NTFS Information Disclosure, Matthew Murphy
• NetBSD Security Advisory 2005-001: Crypto leaks across HyperThreaded CPUs (i386, P4, HTT+SMP only), NetBSD Security-Officer
• MDKSA-2005:108 - Updated squirrelmail packages fix XSS vulnerabilities, Mandriva Security Team
• MDKSA-2005:109 - Updated php-pear packages fix remotely exploitable vulnerability, Mandriva Security Team
• MDKSA-2005:110 - Updated 2.6 kernel packages fix multiple vulnerabilities, Mandriva Security Team
• MDKSA-2005:111 - Updated 2.4 kernel packages fix multiple vulnerabilities, Mandriva Security Team
• [SECURITY] [DSA 735-1] New sudo packages fix pathname validation race, Michael Stone
• [SECURITY] [DSA 736-1] New spamassassin packages fix potential DOS, Michael Stone
• /dev/random is probably not, Charles M. Hannum
  • Re: /dev/random is probably not, Thomas Wana
    • Re: /dev/random is probably not, McLain Causey
  • Re: /dev/random is probably not, Chiaki
    • Re: /dev/random is probably not, exon
      • Re: /dev/random is probably not, Darren Reed
        • Re: /dev/random is probably not, devnull
        • Re: /dev/random is probably not, Thomas
          • Re: /dev/random is probably not, Darren Reed
            • Re: /dev/random is probably not, Thomas
          • Re: /dev/random is probably not, Kai Howells
            • Re: /dev/random is probably not, Stefan Bethke
          • Re: /dev/random is probably not, Francesco Messineo
    • Re: /dev/random is probably not, Zow
      • Re: /dev/random is probably not, Anton Ivanov
        • Re: /dev/random is probably not, devnull
      • RE: /dev/random is probably not, David Schwartz
      • Re: /dev/random is probably not, Glynn Clements
        • Re: /dev/random is probably not, ChayoteMu
      • Re: /dev/random is probably not, Jack Lloyd
        • Re: /dev/random is probably not, Alexey Toptygin
    • Re: /dev/random is probably not, Robert Foxworth
      • Re: /dev/random is probably not, Chris Kuethe
      • Re: /dev/random is probably not, Thomas
        • RE: /dev/random is probably not, David Schwartz
  • <Possible follow-ups>
  • Re: /dev/random is probably not, Michael Gnau
• PEAR XML_RPC Remote Code Execution Vulnerability, GulfTech Security Research
• TSLSA-2005-0031 - multi, Trustix Security Advisor
• [SECURITY ALERT] osTicket bugs, ghc
• PHPXMLRPC Remote Code Execution, GulfTech Security Research
• UnixWare 7.1.4 : Mozilla updated to 1.7.8 fixes security issues, please_reply_to_security
• Advisory 05/2005: Cacti Authentification/Addslashes Bypass Vulnerability, Stefan Esser
• Advisory 04/2005: Cacti Remote Command Execution Vulnerability, Stefan Esser
• Advisory 03/2005: Cacti Multiple SQL Injection Vulnerabilities [FIXED], Stefan Esser
• Three More Vulnerable to PHPXMLRPC code injection, GulfTech Security Research
• XMLRPC remote commands execute exploit, duk3nn
• pam_ldap/nss_ldap password leak in a master+slave+start_tls LDAP setup, Rob Holland
• [SECURITY] [DSA 725-2] New ppxp packages fix local root exploit, Martin Schulze
• UPDATE: [ GLSA 200506-17 ] SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability, Sune Kloppenborg Jeppesen
• Re: [Full-disclosure] Solaris 9/10 ld.so fun, KF (lists)
• [ GLSA 200507-01 ] PEAR XML-RPC, phpxmlrpc: PHP script injection vulnerability, Thierry Carrez
• Re: Access right escalation / severe permission problems on Raritan Console Servers, spam
• Re: Microsoft Internet Explorer "javaprxy.dll" Code Execution Exploit, stupidfrenchdudes
  • <Possible follow-ups>
  • Re: Microsoft Internet Explorer "javaprxy.dll" Code Execution Exploit, berendjanwever
• PlanetFileServer v2.0.1.3 - Denial Of Service, unsecure
• a new sql injection for aspjar guestbook, arash_pc0
  • Re: a new sql injection for aspjar guestbook, security curmudgeon
• JBoss jBPM 2.0: Remote code execution and classloader covert channel, Marc Schoenefeld
• [SECURITY] [DSA 734-1] New gaim packages fix denial of service, Martin Schulze
• [USN-147-1] PHP XMLRPC vulnerability, Martin Pitt
• iDEFENSE Security Advisory 07.05.05: Adobe Acrobat Reader UnixAppOpenFilePerform() Buffer Overflow Vulnerability, iDEFENSE Labs
• Re: [badroot security] AutoIndex PHP Script: XSS vulnerability, mozako
• [badroot security] probe.cgi: Remote Command Execution, mozako
• MyGuestbook Remote File Inclusion., group@xxxxxxxxxxxxxxxx
• XSS in nested tag in phpbb 2.0.16, alex
• [covide] possible sql injection, Hans Wolters
• ekg insecure temporary file creation and arbitrary code execution, ZATAZ Audits
  • Re: ekg insecure temporary file creation and arbitrary code execution, Adam Wysocki
• Imail Cookie Vulnerability (unhashed), Sintigan
  • Re: Imail Cookie Vulnerability (unhashed), Christophe Vandeplas
• Passwords in RAM dumps [formally Novell GroupWise Plain Text Password Vulnerability.], Anything But Microsoft
  • Re: Passwords in RAM dumps [formally Novell GroupWise Plain Text Password Vulnerability.], Jason Coombs
• McAfee Intrushield IPS Abuse, c0ntexb
  • <Possible follow-ups>
  • Re: McAfee Intrushield IPS Abuse, shs_bulldog
  • Re: Re: McAfee Intrushield IPS Abuse, c0ntexb
    • McAfee Intrushield IPS Abuse Update is available, AsTriXs
• SUSE Security Announcement: zlib denial of service attack (SUSE-SA:2005:039), Marcus Meissner
• FreeBSD Security Advisory FreeBSD-SA-05:16.zlib, FreeBSD Security Advisories
• SUSE Security Announcement: heimdal telnetd remote buffer overflow (SUSE-SA:2005:040), Marcus Meissner
• [SECURITY] [DSA 740-1] New zlib packages fix denial of service, Michael Stone
• [SECURITY] [DSA 738-1] New razor packages fix potential DOS, Michael Stone
• GNATS - gen-index, pi3ki31ny
• Advisory 07/2005: Jaws Multiple Remote Code Execution Vulnerabilities, Stefan Esser
• VoIP-Phones: Weakness in proccessing SIP-Notify-Messages, Tobias Glemser
  • Re: VoIP-Phones: Weakness in proccessing SIP-Notify-Messages, Javor Ninov
• PHPXMAIL - Authentication Bypass, Steve
  • Re: PHPXMAIL - Authentication Bypass, security
• Solaris Socket Hijack, c0ntexb
• Cross site scripting in Lotus Notes web mail, shalom
• [SECURITY] [DSA 737-1] New clamav packages fix potential DOS, Michael Stone
• [SECURITY] [DSA 739-1] New trac package fixes upload/download vulnerability, Martin Schulze
• eRoom Multiple Security Issues, c0ntexb
  • <Possible follow-ups>
  • eRoom Multiple Security Issues, c0ntexb
• [ GLSA 200507-06 ] TikiWiki: Arbitrary command execution through XML-RPC, Sune Kloppenborg Jeppesen
• Re: Microsoft Word Protection Bypass, Dave . Collins
  • <Possible follow-ups>
  • Re: Re: Microsoft Word Protection Bypass, dan
  • RE: Microsoft Word Protection Bypass, Christian King
    • Re: Microsoft Word Protection Bypass, Johan De Meersman
  • RE: Microsoft Word Protection Bypass, Walter Wickersham
• [USN-148-1] zlib vulnerability, Martin Pitt
• [ GLSA 200507-05 ] zlib: Buffer overflow, Thierry Carrez
• [USN-147-2] Fixed php4-pear packages for USN-147-1, Martin Pitt
• MDKSA-2005:112 - Updated zlib packages fix vulnerability, Mandriva Security Team
• phpSlash account hijacking vulnerability, tobozo
  • <Possible follow-ups>
  • Re: phpSlash account hijacking vulnerability, tobozo
• [ GLSA 200507-04 ] RealPlayer: Heap overflow vulnerability, Thierry Carrez
• Problems with the Oracle Critical Patch Update for April 2005, David Litchfield
  • Re: Problems with the Oracle Critical Patch Update for April 2005, Cesar
    • Re: Problems with the Oracle Critical Patch Update for April 2005, David Litchfield
• ICMP vulnerabilities, Theo de Raadt
  • Re: ICMP vulnerabilities, J. Oquendo
    • Re: ICMP vulnerabilities, Bob Beck
  • <Possible follow-ups>
  • Re: ICMP Vulnerabilities, Dragos Ruiu
    • Re: ICMP Vulnerabilities, Joachim Schipper
• Vulnerability in Whatpulse.Org profiles allows XSS and session hijacking, rift13
• PNG&#402;J&#402;E&#402;&#8220;&#402;^+&#8212;p&#402;&#402;O&#8240;&#402;X&#402;N&#402;&#352;&#402;v&#402;g remote commands execution vulnerability, blahplok
• SimplePHPBlog 0.4.0 <= Remote Password Disclosure, pjphem
• Multiple vulnerabilities in Lantronix SLC console server, spam
• [OpenPKG-SA-2005.013] OpenPKG Security Advisory (zlib), OpenPKG
• NULL sessions vulnerabilities using alternate named pipes, Jean-Baptiste Marchand
• [SECURITY] [DSA 741-1] New bzip2 packages prevent decompression bomb, Martin Schulze
• [Bday release] Comersus shopping cart has multiple Sql injection and Cross Site Scripting vulnerabilities, dcrab
• SUSE Security Announcement: php/pear XML RPC remote code execution (SUSE-SA:2005:041), Marcus Meissner
• [SECURITY] [DSA 744-1] New fuse packages fix information disclosure, Martin Schulze
• [SECURITY] [DSA 743-1] New ht packages fix arbitrary code execution, Martin Schulze
• TSLSA-2005-0034 - multi, Trustix Security Advisor
• SiteMinder Multiple Vulnerabilities, c0ntexb
  • Re: SiteMinder Multiple Vulnerabilities, Tero Hänninen
  • <Possible follow-ups>
  • Re: SiteMinder Multiple Vulnerabilities, Williams, James K
• Fwd: [VOIPSEC] VoIP-Phones: Weakness in proccessing SIP-Notify-Messages, gary madsen
  • <Possible follow-ups>
  • RE: [VOIPSEC] VoIP-Phones: Weakness in proccessing SIP-Notify-Messages, Walton, John Michael (John)
  • RE: [VOIPSEC] VoIP-Phones: Weakness in proccessing SIP-Notify-Messages, Walton, John Michael (John)
• Security Advisory for Bugzilla 2.18.1 and 2.19.3, mkanat
• [SECURITY] [DSA 735-2] New sudo packages fix pathname validation race, Michael Stone
• [SECURITY] [DSA 736-2] New spamassassin packages fix potential DOS, Michael Stone
• Advisory 09/2005: PunBB arbitrary PHP code inclusion vulnerability, Stefan Esser
• Advisory 08/2005: PunBB SQL Injection Vulnerability, Stefan Esser
• ToorCon 2005 Call for Papers, h1kari@xxxxxxxxxxx
• [SECURITY] [DSA 742-1] New cvs packages fix arbitrary code execution, Martin Schulze
• USENIX Security Symposium, July 31, Baltimore, Maryland, USA, Peter Mui
• UPDATE: [ GLSA 200506-20 ] Cacti: Several vulnerabilities, Thierry Carrez
• Vocera IP Phones, Holden Caulfield
• WindowsUpdate sending unsigned ActiveX ?, Nestor Burma
• Re: /dev/random is probably not (fwd), Bencsath Boldizsar
• A comment on using CPU resources, Gandalf The White
  • Re: A comment on using CPU resources, Jeroen van Rijn
    • A comment on using CPU resources, addendum., Jeroen van Rijn
    • Re: A comment on using CPU resources, Steven Champeon
  • Re: A comment on using CPU resources, Security
  • Re: A comment on using CPU resources, Andreas Bartelt
  • Re: A comment on using CPU resources, Raghu Chinthoju
    • RE: A comment on using CPU resources, Scott Marburger
    • Re: A comment on using CPU resources, Steven Champeon
  • Re: A comment on using CPU resources, Joachim Schipper
  • Re: A comment on using CPU resources, Christian
  • <Possible follow-ups>
  • RE: A comment on using CPU resources, Joseph Finley
    • RE: A comment on using CPU resources, Martin Konold
  • Re: Re: A comment on using CPU resources, securityfocus
• [SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability, Martin Schulze
• [ GLSA 200507-09 ] Adobe Acrobat Reader: Buffer overflow vulnerability, Matthias Geerdsen
• [SECURITY] [DSA 748-1] New ruby1.8 packages fix arbitrary command execution, Michael Stone
• [SECURITY] [DSA 750-1] New dhcpcd packages fix denial of service, Martin Schulze
• Bug Hosting Controller New (v6.1 - Hotfix 2.1), kehieuhoc
• [ Suresec Advisories ] - Linux kernel ia32 compatibility (ia64/x86-64) race condition, Suresec Advisories
  • Re: [Full-disclosure] [ Suresec Advisories ] - Linux kernel ia32 compatibility (ia64/x86-64) race condition, Juergen Schmidt
• [ GLSA 200507-08 ] phpGroupWare, eGroupWare: PHP script injection vulnerability, Matthias Geerdsen
• [SECURITY] [DSA 749-1] New ettercap packages fix arbitrary code execution, Michael Stone
• [SECURITY] [DSA 747-1] New egroupware packages fix remote command execution, Michael Stone
• [ GLSA 200507-07 ] phpWebSite: Multiple vulnerabilities, Matthias Geerdsen
• [SECURITY] [DSA 745-1] New drupal package fixes multiple vulnerabilities, Michael Stone
• WASC-Articles: 'DOM Based Cross Site Scripting or XSS of the Third Kind: A look at an overlooked flavor of XSS', contact
• blogtorrent remote/local user password disclosure, Emanuele Gentili
  • <Possible follow-ups>
  • Re: blogtorrent remote/local user password disclosure, trashtrash
• [SECURITY] [DSA 752-1] New gzip packages fix several vulnerabilities, Martin Schulze
• MA[2005-0712b] - 'Nokia Affix Bluetooth btsrv/btobex poor use of system()', KF (lists)
• MITKRB5-SA-2005-003: double-free in krb5_recvauth, Tom Yu
  • Message not available
    • Re: MITKRB5-SA-2005-003: double-free in krb5_recvauth, Tom Yu
• SoftiaCom MailServer - Local Password Disclosure Vulnerability, unsecure
• Advisory 10/2005: Yawp/YaWiki Remote URL Include Vulnerability, Stefan Esser
• [SECURITY] [DSA 753-1] New gedit packages fix denial of service, Martin Schulze
• Cisco Security Advisory: Cisco CallManager Memory Handling Vulnerabilities, Cisco Systems Product Security Incident Response Team
• MDKSA-2005:116 - Updated cpio packages fix vulnerabilities, Mandriva Security Team
• MDKSA-2005:115 - Updated mplayer packages fix vulnerabilities, Mandriva Security Team
• [ GLSA 200507-11 ] MIT Kerberos 5: Multiple vulnerabilities, Sune Kloppenborg Jeppesen
• MDKSA-2005:114 - Updated leafnode packages fix multiple vulnerabilities, Mandriva Security Team
• MDKSA-2005:113 - Updated clamav packages fix vulnerability, Mandriva Security Team
• Possible security issue with FreeBSD 5.4 jailing and BPF, ronvdaal
• Metasploit exploit for PHP XMLRPC, comsatcat
• [FLSA-2005:155505] Updated php packages fix security issues, Marc Deslauriers
• Multiple High Risk Vulnerabilities in Oracle E-Business Suite 11i - Critical Patch Update July 2005, Integrigy Security
• [FLSA-2005:154991] Updated sharutils package fixes security issue, Marc Deslauriers
• [FLSA-2005:152908] Updated gftp package fixes security issue, Marc Deslauriers
• PacSec/core05 Call For Papers, Dragos Ruiu
• [FLSA-2005:152835] Updated dhcp package fixes security issue, Marc Deslauriers
• [FLSA-2005:152895] Updated mailman package fixes security issue, Marc Deslauriers
• iDEFENSE Security Advisory 07.12.05: Microsoft Word 2000 and Word 2002 Font Parsing Buffer Overflow Vulnerability, iDEFENSE Labs
• [ GLSA 200507-10 ] Ruby: Arbitrary command execution through XML-RPC, Thierry Carrez
• [FLSA-2005:123014] Updated openssh packages fix a security issue, Marc Deslauriers
• [FLSA-2005:152583] Updated telnet packages fix security issues, Marc Deslauriers
• Detecting vulnerable zlib versions (CAN-2005-2096), Florian Weimer
• DMA[2005-0712a] - 'Nokia Affix Bluetooth btftp client buffer overflow', KF (lists)
• Dragonfly Shopping Cart Multiple vulnerabilities, dcrab
• Full Disclosure - XMLRPC Exploit Code written in Python jul 2005, Anonymous
• MITKRB5-SA-2005-002: buffer overflow, heap corruption in KDC, Tom Yu
• SoftiaCom MailServer v2.0 - Denial Of Service, unsecure
• [SECURITY] [DSA 755-1] New tiff packages fix arbitrary code execution, Martin Schulze
• APPLE Darwin Streaming Server Web Admin Remote Denial of Serivce, Sowhat .
• [SECURITY] [DSA 754-1] New centericq packages fix insecure temporary file creation, Martin Schulze
• Cisco Security Advisory: Cisco ONS 15216 OADM Telnet Denial-of-Service Vulnerability, Cisco Systems Product Security Incident Response Team
• MDKSA-2005:118 - Updated ruby packages fix vulnerabilities, Mandriva Security Team
• CORE-2005-0629: MailEnable Buffer Overflow Vulnerability, Core Security Technologies Advisories
• MDKSA-2005:117 - Updated dhcpcd packages fix vulnerabilities, Mandriva Security Team
• Cisco Security Advisory:Cisco Security Agent Vulnerable to Crafted IP attack, Cisco Systems Product Security Incident Response Team
• [SECURITY] [DSA 756-1] New squirrelmail packages fix several vulnerabilities, Martin Schulze
• WPS Web-Portal-System v.0.7.0 (wps_shop.cgi) remote commands execution vulnerability, blahplok
• PHPsFTPd - Admin password leak, Steve
• [SM-ANNOUNCE] SquirrelMail 1.4.5 Released, Jonathan Angliss
• Advisory: Oracle JDeveloper passes Plaintext Password, ak
• Advisory: Oracle JDeveloper Plaintext Passwords, ak
• Endless loop in NetPanzer 0.8, Luigi Auriemma
• [ GLSA 200507-12 ] Bugzilla: Unauthorized access and information disclosure, Thierry Carrez
• Advisory: Oracle Forms Insecure Temporary File Handling, ak
• Advisory: Oracle Forms Builder Password in Temp Files, ak
• Path Disclosure and XSS problem in PHP Counter 7.2, priestmaster
• [FLSA-2005:152777] Updated ImageMagick packages fix security issues, Marc Deslauriers
• YaBBSe 1.5.5c Path disclosure problem, priestmaster
• 1st European Conference on Computer Network Defence (EC2ND), Blyth A J C (Comp)
• TSLSA-2005-0036 - multi, Trustix Security Advisor
• [SM-ANNOUNCE] Patch available for CAN-2005-2095, Jonathan Angliss
• SquirrelMail Arbitrary Variable Overwriting Vulnerability, GulfTech Security Research
• 05_07_14-bitdefender_malicious_content_bypass, Alexander Hagenah
• XSS in forums Simple Message Board Version 2.0 Beta 1, stormhacker
• [SECURITY] [DSA 746-1] New packages fix remote command execution in phpgroupware, Michael Stone
• [ GLSA 200507-13 ] pam_ldap and nss_ldap: Plain text authentication leak, Thierry Carrez
• Re: [Full-disclosure] ICMP Security Vulnerabilities - NEW (cough), Fernando Gont
• MDKSA-2005:120 - Updated mozilla-firefox packages fix multiple vulnerabilities, Mandriva Security Team
• MDKSA-2005:119 - Updated krb5 packages fix multiple vulnerabilities, Mandriva Security Team
• iDEFENSE Security Advisory 07.14.05: Sophos Anti-Virus Zip File Handling DoS Vulnerability, iDEFENSE Labs
• [ GLSA 200507-15 ] PHP: Script injection through XML-RPC, Thierry Carrez
• several vulnerabilities present in Belkin wireless routers, [at]
  • Re: several vulnerabilities present in Belkin wireless routers, Steve Kemp
    • Re: several vulnerabilities present in Belkin wireless routers, Ian Clelland
  • Re: several vulnerabilities present in Belkin wireless routers, nicolas.ruff@xxxxxxxxx
  • Re: several vulnerabilities present in Belkin wireless routers, E. Kellinis
    • Re: several vulnerabilities present in Belkin wireless routers, E. Kellinis
  • <Possible follow-ups>
  • Re: several vulnerabilities present in Belkin wireless routers, ian . latter
  • Re: Re: several vulnerabilities present in Belkin wireless routers, steven . salaets
  • Re: several vulnerabilities present in Belkin wireless routers, Roman Daszczyszak
• [ GLSA 200507-14 ] Mozilla Firefox: Multiple vulnerabilities, Thierry Carrez
• On classifying attacks, Derek Martin
  • RE: On classifying attacks, Bryan McAninch
  • Re: On classifying attacks, Indigo Haze
  • Re: On classifying attacks, James Longstreet
    • Re: On classifying attacks, Derek Martin
      • Re: On classifying attacks, Godwin Stewart
      • Re: On classifying attacks, James Longstreet
        • Re: On classifying attacks, Adam Shostack
      • Re: On classifying attacks, Mihai Amarandei-Stavila
    • Re: On classifying attacks, Crispin Cowan
  • <Possible follow-ups>
  • Re: On classifying attacks, Steven M. Christey
  • Re: On classifying attacks, Dustin D. Trammell
  • RE: On classifying attacks, Black, Michael
    • Re: On classifying attacks, Crispin Cowan
      • Re: On classifying attacks, Technica Forensis
        • Re: On classifying attacks, Crispin Cowan
  • RE: On classifying attacks, Black, Michael
    • Re: On classifying attacks, Crispin Cowan
• Silently fixed security bugs in Oracle Critical Patch Update July 2005, ak
  • Re: Silently fixed security bugs in Oracle Critical Patch Update July 2005, David Litchfield
• Compromising pictures of Microsoft Internet Explorer!, Michal Zalewski
  • Re: Compromising pictures of Microsoft Internet Explorer!, Steve Kemp
  • Re: Compromising pictures of Microsoft Internet Explorer!, Stefan Kelm
• LSS Security Advisory: Winamp remote buffer overflow vulnerability, Leon Juranic
  • <Possible follow-ups>
  • Re: LSS Security Advisory: Winamp remote buffer overflow vulnerability, b0fnet
• Why Vulnerability Databases can't do everything, Steven M. Christey
• AW: Silently fixed security bugs in Oracle Critical Patch Update July 2005, Kornbrust, Alexander
• Stack-Based Buffer Overflow in Sybase EAServer 4.2.5 to 5.2, SPI Labs
• [ GLSA 200507-16 ] dhcpcd: Denial of Service vulnerability, Thierry Carrez
• Any info on potential 0day RDP vuln?, Mark
  • <Possible follow-ups>
  • RE: Any info on potential 0day RDP vuln?, Altheide, Cory B. (IARC)
• Internet Explorer / MSN ICC Profiles Crash PoC Exploit, edward11
  • <Possible follow-ups>
  • Re: Internet Explorer / MSN ICC Profiles Crash PoC Exploit, mark . handy
• Re: [Full-disclosure] Why Vulnerability Databases can't do everything, Jason Coombs
  • Re: [Full-disclosure] Why Vulnerability Databases can't do everything, Joel Maslak
• Solaris Runtime Linker - Exploit Detection, petefran
• Installation of software, and security. . ., John Richard Moser
  • Re: Installation of software, and security. . ., Klaus Schwenk
    • Re: Installation of software, and security. . ., John Richard Moser
      • Re: Installation of software, and security. . ., Tim Nelson
        • Re: Installation of software, and security. . ., Jason Coombs
          • RE: Installation of software, and security. . ., Burton Strauss
            • Re: Installation of software, and security. . ., John Richard Moser
        • Re: Installation of software, and security. . ., Matt Beaumont
          • Pointless discussion (was Re: Installation of software, and security. . .), David F. Skoll
        • RE: Installation of software, and security. . ., Burton Strauss
          • Re: Installation of software, and security. . ., Peter Keel
      • Re: Installation of software, and security. . ., Tino Wildenhain
      • Re: Installation of software, and security. . ., Kerry Thompson
      • RE: Installation of software, and security. . ., Burton Strauss
      • Re: Installation of software, and security. . ., David F. Skoll
    • Re: Installation of software, and security. . ., joop gerritse
  • Re: Installation of software, and security. . ., Alexander Klimov
  • <Possible follow-ups>
  • RE: Installation of software, and security. . ., Glenn.Everhart
• [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch, zinho
  • Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch, milw0rm Inc.
  • Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch, GulfTech Security Research
  • <Possible follow-ups>
  • Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch, augustusx00
  • Re: Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch, [at]
• PowerDNS 2.9.18 fixes two security issues affecting users of LDAP backend or limited recursion, bert . hubert
• [ZH2005-16SA] Insecure temporary file creation in Skype for Linux, badpenguin
• [SECURITY] [DSA 758-1] New heimdal packages fix arbitrary code execution, Martin Schulze
• HPSBTU01210 SSRT4743, SSRT4884 rev.0 - HP Tru64 UNIX TCP/IP remote Denial of Service (DoS), Security Alert
• [SECURITY] [DSA 760-1] New ekg packages fix several vulnerabilities, Martin Schulze
• [SECURITY] [DSA 759-1] New phppgadmin packages fix directory traversal vulnerability, Martin Schulze
• NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein, Amit Klein (AKsecurity)
  • Re: NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein, 3APA3A
    • Re: NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein, Amit Klein (AKsecurity)
      • Mozilla cleartext credentials leak bug report to excuse myself (Re[2]: NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein), 3APA3A
• Broadcast format string and buffer-overflow in Race Driver 1.20, Luigi Auriemma
• [KDE Security Advisory]: Kate backup file permission leak, Dirk Mueller
• MRV In-Reach console server: Port Access Control Bypass Vulnerability, spam
• [ GLSA 200507-17 ] Mozilla Thunderbird: Multiple vulnerabilities, Thierry Carrez
• Shorewall MACLIST Problem, Patrick Blitz
• [SECURITY] [DSA 757-1] New krb5 packages fix multiple vulnerabilities, Michael Stone
• Anonymous Anonymity - Request For Comments, Gandalf The White
  • Re: Anonymous Anonymity - Request For Comments, Craig Skelton
  • <Possible follow-ups>
  • Re: Anonymous Anonymity - Request For Comments, gandalf
    • Re: Anonymous Anonymity - Request For Comments, S_Dorn/CIB
    • Re: Anonymous Anonymity - Request For Comments, Moritz Naumann
• MDKSA-2005:121 - Updated nss_ldap/pam_ldap packages fix vulnerabilities, Mandriva Security Team
• [SECURITY] [DSA 761-1] New heartbeat packages fix insecure temporary files, Martin Schulze
• [SECURITY] [DSA 762-1] New affix packages fix arbitrary command and code execution, Martin Schulze
• HPSBUX01137 SSRT5954 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS), Security Alert
  • (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS)), Fernando Gont
    • Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4, Darren Reed
      • Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4, Fernando Gont
        • Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954, Darren Reed
          • Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954, Casper . Dik
          • Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954, Dana Hudes
            • Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954, Darren Reed
• HPSBUX01164 SSRT4884 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS), Security Alert
• Oracle Security Advisory: Overwrite any file via desname in Oracle Reports, ak
• Re: SiteMinder Multiple Vulnerabilities (solution), Williams, James K
• [TOOLS] CIRT.DK WebRoot Version v.1.7, CIRT.DK Advisory
• Oracle Security Advisory: Run any OS Command via unauthorized Oracle Forms, ak
• Oracle Security Advisory: Read parts of any file via desformat in Oracle Reports, ak
• Update Your Bookmarks, Valentin Vorovenci
• Oracle Security Advisory: Read parts of any XML-file via customize parameter in Oracle Reports, ak
• Oracle Security Advisory: Run any OS Command via unauthorized Oracle Reports, ak
• [ISR] - Novell Groupwise WebAccess Cross-Site Scripting, Francisco Amato
• Oracle Security Advisory: Various Cross-Site-Scripting Vulnerabilities in Oracle Reports, ak
• Multiple Vulnerabilities in PHP Surveyor, thegreatone2176
• ICMP-based blind performance-degrading attack, Fernando Gont
  • Re: ICMP-based blind performance-degrading attack, Darren Reed
    • Re: ICMP-based blind performance-degrading attack, Fernando Gont
      • Re: ICMP-based blind performance-degrading attack, Darren Reed
• [ GLSA 200507-18 ] MediaWiki: Cross-site scripting vulnerability, Thierry Carrez
• PatchAdvisor Vulnerability Alert - Cisco CallManager Remote Denial of Service Vulnerability, vames
• PHPNews SQL injection vulnerability, ghc
  • <Possible follow-ups>
  • Re: PHPNews SQL injection vulnerability, foster
• [Fwd: phpBB 2.0.17 released], Christian Boenning
• Trivial BGP attacks (ICMP-based blind throughput-reduction attack), Fernando Gont
• Anonymous Web Attacks via Dedicated Mobile Services, Petko Petkov
• FreeBSD Security Advisory FreeBSD-SA-05:17.devfs, FreeBSD Security Advisories
• Re: UPB: Discussion Board/Web-Site Takeover, rgod
• PeanutHull Local Privilege Escalation Vulnerability, Sowhat .
• SQL Injection in Chinese ASP Webcounter, r_i_t_b_15
• Arbitrary code execution in SlimFTPd v3.16, Raphaël Rigo
  • Arbitrary code execution in SlimFTPd v3.16 - Exploit, redsand
• [SECURITY] [DSA 764-1] New cacti packages fix several vulnerabilities, Martin Schulze
• [SECURITY] [DSA 763-1] New zlib packages fix buffer overflow, Michael Stone
• Peter Gutmann data deletion theaory?, Jared Johnson
  • RE: Peter Gutmann data deletion theaory?, Barbara Lockwood
    • RE: Peter Gutmann data deletion theaory?, Tiago Halm
  • Re: Peter Gutmann data deletion theaory?, Jay D. Dyson
    • Re: Peter Gutmann data deletion theaory?, Thor (Hammer of God)
  • Re: Peter Gutmann data deletion theaory?, Simple Nomad
    • Re: Peter Gutmann data deletion theaory?, Volker Tanger
      • Re: Peter Gutmann data deletion theaory?, Alexander L. Ivanchev
      • Re: Peter Gutmann data deletion theaory?, Casper . Dik
    • Re: Peter Gutmann data deletion theaory?, "Vincent DUVERNET (Nolmë Informatique)"
      • Re: Peter Gutmann data deletion theaory?, Jake Appelbaum
    • RE: Peter Gutmann data deletion theaory?, Jared Johnson
  • RE: Peter Gutmann data deletion theaory?, D. Weiss
  • Re: Peter Gutmann data deletion theaory?, Dana Hudes
  • Re: [BugTraq] Peter Gutmann data deletion theaory?, Robin Whittle
    • Re: [BugTraq] Peter Gutmann data deletion theaory?, Volker Kuhlmann
  • RE: Peter Gutmann data deletion theaory?, dave kleiman
  • <Possible follow-ups>
  • RE: Peter Gutmann data deletion theaory?, Jeremy Epstein
  • RE: Peter Gutmann data deletion theaory?, Glenn.Everhart
  • Re: RE: Peter Gutmann data deletion theaory?, underwood-de
    • Re: RE: Peter Gutmann data deletion theaory?, Ron van Daal
      • Re: RE: Peter Gutmann data deletion theaory?, Simple Nomad
  • RE: Peter Gutmann data deletion theaory?, Earnhart, Benjamin J
    • Re: Peter Gutmann data deletion theaory?, Casper . Dik
    • Re: Peter Gutmann data deletion theaory?, devnull
  • RE: Peter Gutmann data deletion theaory?, Robert Thompson Jr.
    • Re: Peter Gutmann data deletion theaory?, Andreas Beck
    • RE: Peter Gutmann data deletion theaory?, Bret Morey
• [KDE Security Advisory] Multiple libgadu vulnerabilities, Dirk Mueller
• MDKSA-2005:123 - Updated shorewall packages fix vulnerability, Mandriva Security Team
• Oracle and setting the record straight, David Litchfield
  • Re: Oracle and setting the record straight, Adam Laurie
• MDKSA-2005:122 - Updated kdelibs packages fix vulnerability in kate and kwrite, Mandriva Security Team
• [USN-149-1] Firefox vulnerabilities, Martin Pitt
• [USN-152-1] PAM/NSS LDAP vulnerabilitiy, Martin Pitt
• [USN-150-1] KDE library vulnerability, Martin Pitt
• [USN-151-1] zlib vulnerability, Martin Pitt
• Multiple vulnerabilities in libgadu and ekg package, Wojtek Kaniewski
• Mozilla XPCOM Library Race Condition, GulfTech Security Research
• Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS)), Dennis Lubert
• SlimFTPd Server: PoC Exploit, Dim K0r0l
• Advisory 11/2005: Multiple vulnerabilities in Contrexx, Christopher Kunz
• eBay phishing - phishers are getting better, John Gateley
  • Re: eBay phishing - phishers are getting better, Ivaylo Zashev
  • <Possible follow-ups>
  • Re: eBay phishing - phishers are getting better, [at]
• [ GLSA 200507-19 ] zlib: Buffer overflow, Sune Kloppenborg Jeppesen
• [ GLSA 200507-20 ] Shorewall: Security policy bypass, Sune Kloppenborg Jeppesen
• [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released., Alexander Anisimov
• [Argeniss] Oracle 9R2 Unpatched vulnerability on CWM2_OLAP_AW_AWUTIL package, Cesar
• [USN-151-2] zlib vulnerabilities, Martin Pitt
• User privilege escalation exploit., sunos5 . 8
• Critical Patch Update April 2005 for Database 9.2 and 10.1 Update - Correction, unbelievable
• ICMP-based blind connection-reset attack, Fernando Gont
• GoodTech SMTP server 5.16 RCPT TO command remote buffer overflow, Raphaël Rigo
• Realchat user impersonation - BSA 200506110001, Andreas Beck
• MDKSA-2005:124 - Updated zlib packages fix vulnerability, Mandriva Security Team
• Atomic Photo Album (APA) apa_phpinclude.inc.php remote file include, gr0up . pclabs
• [Conectiva-updates] [CLA-2005:980] Conectiva Security Announcement - php4, Conectiva Updates
• PHP FirstPost remote file include vulnerability, gb . network
• ECI router login bypass, D .
• Chroot Security Group Advisory 2005-07-25 -- ftplocate, [at]
• Beehive Forum Multiple Vulnerabilities, thegreatone2176
• Corsaire Security Advisory: SAP Internet Graphics Server traversal issue, advisories
• ClamAV Multiple Rem0te Buffer Overflows, list
  • Re: ClamAV Multiple Rem0te Buffer Overflows, nick
    • RE: ClamAV Multiple Rem0te Buffer Overflows, Sec-Tec Lists
• Siemens SANTIS 50 Authentication Vulnerability, luca . carettoni
• [FLSA-2005:152842] Updated lvm package fixes security issue, Marc Deslauriers
• [FLSA-2005:154276] Updated krb5 packages fix security issues, Marc Deslauriers
• [ GLSA 200507-21 ] fetchmail: Buffer Overflow, Sune Kloppenborg Jeppesen
• [ GLSA 200507-22 ] sandbox: Insecure temporary file handling, Sune Kloppenborg Jeppesen
• [ GLSA 200507-23 ] Kopete: Vulnerability in included Gadu library, Sune Kloppenborg Jeppesen
• [security bulletin] SSRT5954 rev.5 - HP-UX TCP/IP Remote Denial of Service (DoS), security-alert
• [security bulletin] SSRT4884 rev.5 - HP-UX TCP/IP Remote Denial of Service (DoS), security-alert
• [USN-149-2] Fixed Firefox packages for USN-149-1, Martin Pitt
• [USN-154-1] vim vulnerability, Martin Pitt
• Ares FileShare 1.1 'Long Searched String' Buffer Overflow Vulnerability, kozan
• [USN-153-1] fetchmail vulnerability, Martin Pitt
• Denial of service vulnerability in FTPshell Server Version 3.38, Reed Arvin
• SPIDynamics WebInspect Cross-Application Scripting (XAS), 3APA3A
  • RE: [Full-disclosure] SPIDynamics WebInspect Cross-ApplicationScripting (XAS), DAN MORRILL
    • Re[2]: [Full-disclosure] SPIDynamics WebInspect Cross-ApplicationScripting (XAS), 3APA3A
• fetchmail security announcement fetchmail-SA-2005-01, Matthias Andree
• Vulnerability in IBM access, sylvain . roger
• [HSC Security Group] XSS in CartWiz, zinho
• Internet Explorer AJAX Bug, anakin
• Re: Local privilege escalation using runasp V3.5.1, securityfocus . 5 . stele
  • <Possible follow-ups>
  • Re: Re: Local privilege escalation using runasp V3.5.1, securityfocus . 5 . stele
• 3Com launches vulnerability-buying program, Ghaith Nasrawi
  • Re: 3Com launches vulnerability-buying program, Matt Palmer
  • Re: 3Com launches vulnerability-buying program, Paul Schmehl
• CYBSEC - Security Advisory: Default Configuration Information Disclosure in Lotus Domino, Leandro Meiners
• [NILESA-20050701] UnixWare 7.x RPC portmapper Dos Vulnerability, Jonglim Yun
• [SECURITY] [DSA 765-1] New heimdal packages fix arbitrary code execution, Martin Schulze
• [ISR] - Novell GroupWise Client Remote Buffer Overflow, Francisco Amato
• [ GLSA 200507-25 ] Clam AntiVirus: Integer overflows, Sune Kloppenborg Jeppesen
• FreeBSD Security Advisory FreeBSD-SA-05:19.ipsec, FreeBSD Security Advisories
• Re : [Firefox Bug 302187] New: Shared section vulnerability when opening microsoft office document resulting in DoS, sylvain . roger
  • <Possible follow-ups>
  • Re: Re : [Firefox Bug 302187] New: Shared section vulnerability when opening microsoft office document resulting in DoS, sylvain . roger
• Shared section vulnerability when opening microsoft office document resulting in DoS, sylvain . roger
• [SECURITY] [DSA 768-1] New phpbb2 packages fix cross-site scripting, Martin Schulze
• [SECURITY] [DSA 767-1] New ekg packages fix arbitrary code execution, Martin Schulze
• [ GLSA 200507-26 ] GNU Gadu, CenterICQ, Kadu, EKG, libgadu: Remote code execution in Gadu library, Sune Kloppenborg Jeppesen
• FreeBSD Security Advisory FreeBSD-SA-05:18.zlib, FreeBSD Security Advisories
• Re: Getting round website authentication with Firefox, Shalom Carmel
  • <Possible follow-ups>
  • Getting round website authentication with Firefox, account . throw
    • Re: Getting round website authentication with Firefox, Christopher Kunz
    • Re: Getting round website authentication with Firefox, Nate Smith
    • Re: Getting round website authentication with Firefox, James Tait
• [USN-155-1] Mozilla vulnerabilities, Martin Pitt
• Spyware database lists, Paul Laudanski
• [SECURITY] [DSA 766-1] New webcalendar package fixes information disclosure, Martin Schulze
• [ GLSA 200507-24 ] Mozilla Suite: Multiple vulnerabilities, Sune Kloppenborg Jeppesen
• MDKSA-2005:125 - Updated clamav packages fix more vulnerabilities, Mandriva Security Team
• [ GLSA 200507-27 ] Ethereal: Multiple vulnerabilities, Sune Kloppenborg Jeppesen
• UnixWare 7.1.4 UnixWare 7.1.3 UnixWare 7.1.1 : RPCBind updated to prevent remote Denial of Service attack, please_reply_to_security
• [OpenPKG-SA-2005.014] OpenPKG Security Advisory (zlib), OpenPKG
• HP OpenView Radia Management Agent remote command execution via directory traversal, NGSSoftware Insight Security Research
• SUSE Security Announcement: zlib denial of service (SUSE-SA:2005:043), Ludwig Nussel
• GNU Mailutils imap4d v0.6 remote format string exploit, coki
• [OpenPKG-SA-2005.016] OpenPKG Security Advisory (fetchmail), OpenPKG
• HAURI live update. Arbitrary remote file download and execute vulnerability, saintlinu
• uguestbook exploit, l--s
• RE: [Full-disclosure] Anonymous Web Attacks via DedicatedMobileServices, Bojan Zdrnja
  • Re: [Full-disclosure] Anonymous Web Attacks via DedicatedMobileServices, Petko Petkov
  • RE: [Full-disclosure] Anonymous Web Attacks via DedicatedMobileServices, Alexander Klimov
• [USN-149-3] Ubuntu 4.10 update for Firefox vulnerabilities, Martin Pitt
• PhpList Sql Injection and Path Disclosure, thegreatone2176
• Re: PHP Code Snippet Library Multiple Cross-Site Scripting (XSS) Vulnerabilities, at
• [USN-155-2] Updated Epiphany packages to match Mozilla security update, Martin Pitt
• Vulnerability in Linksys Router access, Nick Simicich
• Thomson Web Skill Vantage Manager, walter . sobchak
• [OpenPKG-SA-2005.015] OpenPKG Security Advisory (spamassassin), OpenPKG
• Cross Site Scripting vulnerabilities in GForge, Joxean Koret
• Website Baker Project Multiple Vulnerabilities, thegreatone2176
• Advisory 12/2005: UseBB Multiple Vulnerabilities, Stefan Esser
• SPIDynamics WebInspect Cross-ApplicationScripting (XAS), Security-Alert
• MDKSA-2005:126 - Updated fetchmail packages fix vulnerability, Mandriva Security Team
• MDKSA-2005:127 - Updated mozilla-thunderbird packages fix multiple vulnerabilities, Mandriva Security Team
• [SECURITY] [DSA 769-1] New gaim packages fix denial of service, Martin Schulze
• Cisco Security Advisory: IPv6 Crafted Packet Vulnerability, Cisco Systems Product Security Incident Response Team
• [FLSA-2005:163559] Updated php packages fix security issues, Marc Deslauriers
• [USN-156-1] TIFF vulnerability, Martin Pitt
• [SECURITY] [DSA 770-1] New gopher packages fix insecure temporary file creation, Martin Schulze
• Kshout Data Disclosure, group@xxxxxxxxxxxxxxxx
• Kayako liveResponse Multiple Vulnerabilities, GulfTech Security Research
• PC-EXPERIENCE/TOPPE CMS Security Advisory, rat
• Kent's Guestbook database exploit, l--s
• Tool release: Xprobe2 v0.3, Ofir Arkin
• Trillian Ver 3.1 saves password's in plain Text, Suramya Tomar
• [HSC Security Group] SQL Injection in Product Cart 2.6, zinho
• RO CP root exploit, fjlj
• Undisclosed Sudo Vulnerability ?, Esler, Joel - Contractor
  • Re: Undisclosed Sudo Vulnerability ?, Kurt Seifried
  • <Possible follow-ups>
  • Re: Undisclosed Sudo Vulnerability ?, babarr