security.bugtraq (date)

security.bugtraq (date)

November 29, 2002

[ElectronicSouls] - BOOZT CGI Exploit, es
[OpenPKG-SA-2002.012] OpenPKG Security Advisory (samba), OpenPKG
Moby NetSuite POST Denial of Service Vulnerability, Matthew Murphy
re: Solaris priocntl exploit, Jeff Damens
Exploit for traceroute-nanog overflow, Carl Livitt
User downgraded from Administrator to User retains the ability to list other user's running tasks, Eitan Caspi
bogofilter contrib/bogopass temp file vulnerability, Matthias Andree

November 28, 2002

Security Patch for PortailPHP 0.99, vALDEUx
Re: d_path() truncating excessive long path name vulnerability, Paul Szabo
Re: d_path() truncating excessive long path name vulnerability, Solar Designer
RE: CAIS-ALERT: Vulnerability in the sending requests control of BIND, Vagner Sacramento
MDKSA-2002:083 - Updated sendmail packages fix smrsh insecurities, Mandrake Linux Security Team
RE: CAIS-ALERT: Vulnerability in the sending requests control of BIND, Iván Arce
RE: Cracking OpenVMS passwords with John the Ripper, moose
Kerberos login sniffer and cracker for Windows 2000/XP, Arne Vidstrom
Re: Solaris priocntl exploit, Casper Dik
Re: File reading vulnerable in PHP and MySQL (Local Exploit), Dave Wilson
TracerouteNG - never ending story, Paul Starzetz
On vulnerabilities in open and closed source products, Steven M. Christey
pWins Perl Web Server Directory Transversal Vulnerability, Matthew Wagenknecht
Remote Multiple Buffer Overflow(s) vulnerability in Libcgi-tuxbr., dong-h0un U

November 27, 2002

Re: CAIS-ALERT: Vulnerability in the sending requests control of BIND, D. J. Bernstein
RE: CAIS-ALERT: Vulnerability in the sending requests control of BIND, Iván Arce
ASI Sybase Security Alert: Buffer overflow in DBCC CHECKVERIFY, Aaron C. Newman (Application Security, Inc.)
Re: Solaris priocntl exploit, Casper Dik
ASI Sybase Security Alert: Buffer overflow in DROP DATABASE, Aaron C. Newman (Application Security, Inc.)
ASI Sybase Security Alert: Buffer overflow in xp_freedll, Aaron C. Newman (Application Security, Inc.)
Cross-site Scripting Vulnerability in ImageFolio Image Gallery Software, Stuart Moore
Solaris priocntl exploit, 蔺毅?
[ESA-20021127-032] 'pine' version upgrade, security fixes., EnGarde Secure Linux
Remote Frame Pointer Overwrite vulnerability in LIB CGI in Language C., dong-h0un U
[ESA-20021127-032] 'pine' version upgrade, security fixes., EnGarde Secure Linux
Re: d_path() truncating excessive long path name vulnerability, Paul Szabo
AIM Bug, Dave B.
[Security bulletin] SSRT2266 HP Tru64 UNIX IGMP Potential (DoS) Security Vulnerability (fwd), Dave Ahmad

November 26, 2002

Re: Netscape Problems., zen-parse
FreeNews & News Evolution (PHP), Frog Man
File reading vulnerable in PHP and MySQL (Local Exploit), Hai Nam Luke
Re: wu-ftpd attack ???, Rodrigo Barbosa
Netscape 4 Java buffer overflow, Jouko Pynnonen
Re: Netscape Problems., Georgi Guninski
XSS vulnerability in Bugzilla if upgraded from 2.10 or earlier, David Miller
Linksys not fixed, Will
Cracking OpenVMS passwords with John the Ripper, Jean-loup Gailly
Oracle TNS SEH Exploit, benjurry
MDKSA-2002:081 - Updated samba packages fix potential root compromise, Mandrake Linux Security Team
Re: Netscape Problems., Dave Aitel
MDKSA-2002:082 - Updated python packages fix local arbitrary code execution vulnerability, Mandrake Linux Security Team
Re: ISS Security Brief: Solaris fs.auto Remote Compromise Vulnerability (fwd), Florian Weimer
[security bulletin] SSRT2385 OSIS V5.4 LDAP Module for System Authentication Potential Security Vulnerability (fwd), Dave Ahmad
[security bulletin] SSRT2301 - HP Tru64 UNIX uudecode Potential Security Vulnerability (fwd), Dave Ahmad
wu-ftpd attack ???, Aaron D. Lewis
Netscape Problems., zen-parse
Predictable TCP Initial Sequence Numbers, NetScreen Security Response Team
vBulletin XSS Injection Vulnerability, Sp . IC
Potential H.323 Denial of Service, NetScreen Security Response Team
CAIS-ALERT: Vulnerability in the sending requests control of BIND, Vagner Sacramento

November 25, 2002

'Malicious-URL' Feature may be Circumvented Using IP Fragmentation, NetScreen Security Response Team
LibHTTPD Vulnerability and fix, David J. Hughes
BadBlue XSS/Information Disclosure Vulnerabilities, Matthew Murphy
SFAD02-002: Calisto Internet Talker Remote DOS, subversive
Immobilier 1 (PHP), Frog Man
RE: MS02-066 - fixes, gaps and incorrect statements, GreyMagic Software
[Sec-Tec Advisory] Local scripting vulnerability in phpBB, Pete Foster
Web Server Creator - Web Portal 0.1 (PHP), Frog Man
ISS Security Brief: Solaris fs.auto Remote Compromise Vulnerability (fwd), Dave Ahmad
Netscreen Malicious URL feature can be bypassed by fragmenting the request, zel
Multiple phpNuke Modules Vulnerable to Cross-Site Scripting, Matthew Murphy
[RHSA-2002:264-05] New kernel 2.2 packages fix local denial of service issue, bugzilla
Remote POST Buffer Overflow vulnerability in Pserv., dong-h0un U
acFTP Authentication Issue, Matthew Murphy
acFreeProxy Cross-Site Scripting Vulnerability/Possible DoS, Matthew Murphy
TSLSA-2002-0080 - samba, Trustix Secure Linux Advisor
Re: Alert: Microsoft Security Bulletin - MS02-066, Lise
SuSE Security Announcement: pine (SuSE-SA:2002:046), Thomas Biege
Remote Heap malloc/free & multiple Overflow vulnerability in WSMP3., dong-h0un U

November 24, 2002

Allied Telesyn switches & routers vulnerability, Oleg A. Lebedev
UPDATE: Linksys router vulnerability (add'l models affected), Seth Bromberger

November 23, 2002

[ESA-20021122-031] php upgrade, security fixes, EnGarde Secure Linux
Mulitple Buffer Overflow conditions in RealPlayer/RealOne (#NISR22112002), NGSSoftware Insight Security Research
[ESA-20021122-030] local kernel vulnerabilities, EnGarde Secure Linux
[CLA-2002:550] Conectiva Linux Security Announcement - samba, secure
ClearCase DoS vulnerabilty, marek . rouchal
G-Con Announcement, Enrique A. Sanchez Montellano
Re: MS02-065 vulnerability, HggdH
Open WebMail 1.71 "background" magic info, FreeBSDbr Bugtraq DataBase
Re: MS02-065 vulnerability, Paul Szabo
MDKSA-2002:080 - Updated kdenetwork packages fix remote command execution vulnerabilites, Mandrake Linux Security Team
Zeroo Folder Traversal Vulnerability, mattmurphy@xxxxxxxxx
MDKSA-2002:079 - Updated kdelibs packages fix remote command execution vulnerabilites, Mandrake Linux Security Team
XSS bug in vBulletin, Arab VieruZ
GLSA: samba, Daniel Ahlberg
Security Update: [CSSA-2002-053.0] Linux: gv execution of arbitrary shell commands, security
GLSA: php, Daniel Ahlberg
zlib vulnerability in JAVA on IRIX, SGI Security Coordinator

November 22, 2002

SuSE Security Announcement: samba (SuSE-SA:2002:045), Roman Drahtmueller
[OpenBSD] [syslogd] false src-IP when logging to remote syslogd, Torsten Valentin
Re: MS02-065 vulnerability, HggdH
iDEFENSE Security Advisory 11.19.02c: Netscape Predictable Directory Structure Allows Theft of Preferences File, David Endler
[RHSA-2002:266-05] New samba packages available to fix potential security vulnerability, bugzilla
Clipboard in QNX Photon, One Semicolon
Security contact for SAP database, KF
[LSD] Java and JVM security vulnerabilities, Last Stage of Delirium
[ESA-20021122-031] php upgrade, security fixes, EnGarde Secure Linux
[ESA-20021122-030] local kernel vulnerabilities, EnGarde Secure Linux
iDEFENSE Security Advisory 11.19.02b: Eudora Script Execution Vulnerability, David Endler
CERT Advisory CA-2002-32 Backdoor in Alcatel OmniSwitch AOS (fwd), Dave Ahmad
MS02-065 vulnerability, Paul Szabo
iDEFENSE Security Advisory 11.19.02a: Denial of Service Vulnerability in Linksys Cable/DSL Routers, David Endler
RE: (MSIE) -"dialogArguments" (extended), GreyMagic Software
Cisco Security Advisory: Cisco PIX Multiple Vulnerabilities, Cisco Systems Product Security Incident Response Team
GLSA: gtetrinet, Daniel Ahlberg
Sun Security Bulletin #00220, Matt Selsky
GLSA: courier, Daniel Ahlberg
Security Update: [CSSA-2002-052.0] Linux: sendmail smrsh bypass vulnerabilities, security

November 21, 2002

Security Update: [CSSA-2002-051.0] Linux: fetchmail remote vulnerabilities in multidrop mode, security

November 20, 2002

Opera 6.03/Linux crashes on HTTPS over Squid Proxy on a site, Peter Bieringer
Re: Security Update: [CSSA-2002-050.0] Linux: tcpdump denial-of-service in print-bgp.c, Silvio Cesare
Update: iDEFENSE Security Advisory 11.19.02b: Eudora Script Execution Vulnerability, David Endler
Re: AIM 5.1.3036 buffer overflow, Alan MacDonald
Updated ypserv packages fix memory leak, Mandrake Linux Security Team
(MSIE) when parent gives his son bad things ;) --"dialogArguments " again, Liu Die Yu
NetBSD Security Advisory 2002-027: ftpd STAT output non-conformance can deceive firewall devices, NetBSD Security Officer
Multiple incorrect permissions in QNX., One Semicolon
NetBSD Security Advisory 2002-028: Buffer overrun in getnetbyname/getnetbyaddr, NetBSD Security Officer
Update: EEYE: Macromedia ColdFusion/JRun Remote SYSTEM Buffer Overflow Vulnerabilities, Marc Maiffret
NetBSD Security Advisory 2002-029: named(8) multiple denial of service and remote execution of code, NetBSD Security Officer
Re: (MSIE) when parent gives his son bad things ;) --"dialogArguments " again, Dave Ahmad
Security Update: [CSSA-2002-050.0] Linux: tcpdump denial-of-service in print-bgp.c, security

November 19, 2002

Re: [PATCH] ALERT!! - 2.2.x i386 Linux kernel has DoS same as 2.4.x!!!!, Marc-Christian Petersen
[PATCH] ALERT!! - 2.2.x i386 Linux kernel has 2.4.x DoS!!!!, Matthew Grant
[PATCH] ALERT!! - 2.2.x i386 Linux kernel has DoS same as 2.4.x!!!!, Matthew Grant
[SECURITY] [DSA 199-1] New mhonarc packages fix cross site scripting, Martin Schulze
iPlanet WebServer, remote root compromise, labs@NGSEC
RE: AIM 5.1.3036 buffer overflow, josh
OWASP CodeSeeker - An Open Source Application Firewall and IDS, Mark Curphey
TFTPD32 Directory Traversal Vulnerability, Aviram Jenik
Linksys router vulnerability, Seth Bromberger
TFTPD32 Buffer Overflow Vulnerability (Long filename), Aviram Jenik
MailEnable POP3 Server remote shutdown !:/ -newest ~ (and previous) bufferoverflow-, Ketil Braun Larsen
[PATCH] for 2.2.x i386 Linux kernel DoS - Affects 2.2.x and probably 2.0.x, Matthew Grant
Security Update: [CSSA-2002-049.0] Linux: lynx CRLF injection vulnerability, security
[CLA-2002:549] Conectiva Linux Security Announcement - dhcpcd, secure
Security Update: [CSSA-2002-048.0] Linux: wwwoffled remote access vulnerability, security

November 18, 2002

Update to LOM's advisory, 3APA3A
Re: When scrubbing secrets in memory doesn't work, Peter Watkins
XSS bug in phpBB, Arab VieruZ
Paketto Keiretsu 1.0, Dan Kaminsky
RE: Exploit code for IP Smart Spoofing, shannong
Re: LOM: Multiple vulnerabilities in Macromedia Flash ActiveX, Troy Evans
PlanetWeb Web Server Buffer Overflow in processing GET requests, PlanetDNS Support
XOOPS WebChat module - patch UPDATE, Val Deux
Re: When scrubbing secrets in memory doesn't work, Florian Weimer
RE: bind 8 info update regarding ISS, Russ
Re: When scrubbing secrets in memory doesn't work, Richard Moore
TSLSA-2002-0077 - kernel, Trustix Secure Linux Advisor
LOM: Multiple vulnerabilities in Macromedia Flash ActiveX, 3APA3A
Re: GNU GCC: Optimizer Removes Code Necessary for Security, Florian Weimer
[CLA-2002:548] Conectiva Linux Security Announcement - windowmaker, secure
AIM 5.1.3036 buffer overflow, husun arner
[SECURITY] [DSA 198-1] New nullmailer packages fix local denial of service, Martin Schulze
TSLSA-2002-0076 - bind, Trustix Secure Linux Advisor
Re: When scrubbing secrets in memory doesn't work, Nicholas Weaver
RE: Bind 8 patches available, John . Airey
Security Industry Under Scrutiny: Part Two, sockz loves you
Re: FW: i386 Linux kernel DoS - Affects 2.2.x and probably 2.0.x, Matthew Grant

November 17, 2002

Re: Bind 8 bug experience, Paul Theodoropoulos
GNU GCC: Optimizer Removes Code Necessary for Security, Joseph Wagner
[tcpdump-announce] initial comments on trojan attack (fwd), Jonas Eriksson
patch for named buffer overflow now available (fwd), Jonas Eriksson

November 16, 2002

[SECURITY] [DSA 197-1] New sqwebmail packages fix local information exposure, Martin Schulze
bind 8 info update regarding ISS, mark_sala
NBActiveX Sure ActiveX Big Vulnerability, Webmaster, Lorenzo Hernandez Garcia-Hierro
Remote Buffer Overflow vulnerability in Zeroo HTTP Server., dong-h0un U
FreeBSD Security Advisory FreeBSD-SA-02:41.smrsh [REVISED], FreeBSD Security Advisories
FreeBSD Security Advisory FreeBSD-SA-02:43.bind [REVISED], FreeBSD Security Advisories
[SECURITY] [DSA-196-1] New BIND packages fix several vulnerabilities, Daniel Jacobowitz
Re: Bind 8 patches available, Peter Bieringer
[RHSA-2002:262-07] New kernel fixes local denial of service issue, bugzilla
RE: Yahoo Messenger Stale Sessions, Leonard.Ong
[OpenPKG-SA-2002.011] OpenPKG Security Advisory (bind, bind8), OpenPKG
Re: ZDnet forum: IE formatting local drive, Gossi The Dog
Re: MS02-064 fix time, Steven M. Christey
Security Update: [CSSA-2002-047.0] Linux: KDE SSL and XSS vulnerabilities, security
Unofficial statement re: tcpdump and libpcap, Alan DeKok

November 15, 2002

RE: When scrubbing secrets in memory doesn't work, Michael Wojcik
Security holes... Who cares?, Eric Rescorla
Re: i386 Linux kernel DoS, Jirka Kosina
MDKSA-2002:077 - bind update, Mandrake Linux Security Team
arp spoofing defence, Ilya Teterin
[CLA-2002:546] Conectiva Linux Security Announcement - bind, secure
GLSA: kdenetwork, Daniel Ahlberg
Perception LiteServe HTTP CGI Disclosure Vulnerability, mattmurphy@xxxxxxxxx
[CLA-2002:547] Conectiva Linux Security Announcement - syslog-ng, secure
Better security through shame, Michael Bacarella
Re: Yahoo Messenger Stale Sessions, Rudolfo Amnesico
RE: Opera 7 vulnerabilities, Thor Larholm
RE: ZDnet forum: IE formatting local drive, Thor Larholm
RE: A technique to mitigate cookie-stealing XSS attacks, Eric Stevens
Re: Bind 8 bug experience, Glen Bishop
Security Update: [CSSA-2002-046.0] Linux: buffer overflows and other security issues in squid, security
Re: BIND Exploits, h2g . sec . list

November 14, 2002

Re: Bind 8 bug experience, Olaf Kirch
Security Update: [CSSA-2002-045.0] Linux: python insecure temporary files in os._execvpe, security
[ESA-20021114-029] BIND buffer overflow, DoS attacks., EnGarde Secure Linux
RE: i386 Linux kernel DoS (fixed), Leif Sawyer
Opera 7 vulnerabilities, GreyMagic Software
Re: Yahoo Messenger Stale Sessions, BANIER Jeremie
RE: Exploit code for IP Smart Spoofing, Stephen Gill
MS02-064 fix time, David Litchfield
IISPop remote DOS, securma massine
Re: Bind 8 bug experience, Chris Adams
Netscape/Mozilla: Exploitable heap corruption via jar: URI handler., zen-parse
FreeBSD Security Advisory FreeBSD-SA-02:43.bind, FreeBSD Security Advisories
GLSA: kdelibs, Daniel Ahlberg
SuSE Security Announcement: Multiple vulnerabilities in BIND8 (SuSE-SA:2002:044), Olaf Kirch
RE: A technique to mitigate cookie-stealing XSS attacks, Ulf Harnhammar
Re: Bind 8 bug experience, Jeremy C. Reed
[ESA-20021114-029] BIND buffer overflow, DoS attacks., EnGarde Secure Linux
[CLA-2002:545] Conectiva Linux Security Announcement - php4, secure
ZDnet forum: IE formatting local drive, Alan Rouse
Re: Bind 8 bug experience, Matthew Dixon Cowles
JSP processor 1.1 information disclosure, Andy
Office XP document numbers can be linked to individual machines, Woody Leonhard
RE: ISS Security Advisory: Multiple Remote Vulnerabilities in BIND4 andBIND8 (fwd), Russ
Buffalo AP Denial of Service, Andrei Mikhailovsky
Re: Linksys security contact, Jim Knoble
Re: Yahoo Messenger Stale Sessions, Tat Wee Kan
RE: A technique to mitigate cookie-stealing XSS attacks, Steven M. Christey
RE: Exploit code for IP Smart Spoofing, Stephen Gill
KeyFocus KF Web Server File Disclosure Vulnerability, mattmurphy@xxxxxxxxx

November 13, 2002

Gnujsp and Domino R5.0.10, YM Barusseau
FreeBSD Security Advisory FreeBSD-SA-02:41.smrsh, FreeBSD Security Advisories
Default SNMP community in Surecom Broadband Router, Andrei Mikhailovsky
Latest libpcap & tcpdump sources from tcpdump.org contain a trojan, Mincu Alexandru
Eudora 5.2 attachment spoof, Paul Szabo
Well known flaw in web cart software remains wide open, whitehat2004
Re: i386 Linux kernel DoS, Christophe Devine
IceWarp 3.4.5 XSS *AGAIN*, DarC KonQuesT
Re: When scrubbing secrets in memory doesn't work, Jan Echternach
RE: i386 Linux kernel DoS, Leif Sawyer
FreeBSD Security Advisory FreeBSD-SA-02:42.resolv, FreeBSD Security Advisories
Re: i386 Linux kernel DoS, Jim Paris
Code Injection in phpBB Advanced Quick Reply Mod, Hai Nam Luke
Bind 8 bug experience, Michael Brennen
Remote Buffer Overflow vulnerability in Lib HTTPd., dong-h0un U
[SECURITY] [DSA 195-1] New Apache-Perl packages fix several vulnerabilities, Martin Schulze
FreeBSD Security Advisory FreeBSD-SA-02:40.kadmind, FreeBSD Security Advisories
Re: A technique to mitigate cookie-stealing XSS attacks, Seth Arnold
The Unix Auditor's Practical Handbook, K. K. Mookhey
Fresh hole in W3Mail (fwd), Tim Brown
Apache Security Vulnerabilities on IRIX, SGI Security Coordinator

November 12, 2002

Security Update: [CSSA-2002-SCO.42] UnixWare 7.1.1 Open UNIX 8.0.0 : in.talkd format string vulnerabilities, security
IRIX lpd daemon vulnerabilities via sendmail and dns, SGI Security Coordinator
i386 Linux kernel DoS, Christophe Devine
Security Update: [CSSA-2002-042.0] Linux: libpng progressive image loading vulnerabilities and other buffer overflows, security
RE: Motorola Cable Modem DOS, Chris Wilson
EEYE: Macromedia ColdFusion/JRun Remote SYSTEM Buffer Overflow Vulnerabilities, Marc Maiffret
APBoard - post threads to protected forums and possibility to hijack forum-password, ProXy
RE: A technique to mitigate cookie-stealing XSS attacks, jasonk
Exploit code for IP Smart Spoofing, Laurent Licour
[Fwd: Notice of serious vulnerabilities in ISC BIND 4 & 8], Aaron Howell
NOVL-2002-2963827 - Remote Manager Security Issue - NW5.1, Ed Reed
RE: When scrubbing secrets in memory doesn't work, Michael Wojcik
Remote Buffer Overflow vulnerability in Light HTTPd, dong-h0un U
[SECURITY] [DSA 194-1] New masqmail packages fix buffer overflows, Martin Schulze
GLSA: apache, Daniel Ahlberg
KDE Security Advisory: rlogin.protocol and telnet.protocol URL KIO Vulnerability, Andreas Pour
NOVL-2002-2963767 - Remote Manager Security Issue - eDir 8.6.2, Ed Reed
WebChat for XOOPS RC3 SQL INJECTION, vALDEUx
SuSE Security Announcement: SuSE-SA:2002:043 (traceroute-nanog/nkitb), Thomas Biege
[SecurityOffice] Hyperion Ftp Server v2.8.1 Directory Traversal Vulnerability, Tamer Sahin
[SecurityOffice] INweb Mail Server v2.01 Denial of Service Vulnerability, Tamer Sahin
KDE Security Advisory: resLISa / LISa Vulnerabilities, Andreas Pour
SuSE Security Announcement: KDE lanbrowser vulnerability (SuSE-SA:2002:042), Olaf Kirch
RE: A technique to mitigate cookie-stealing XSS attacks, Jason Coombs
ISS Security Advisory: Multiple Remote Vulnerabilities in BIND4 and BIND8 (fwd), Dave Ahmad
Re: XSS in Postnuke Rogue release (0.72), Rick Updegrove

November 11, 2002

xoops Quizz Module IMG bug, magistrat
Yahoo Messenger Stale Sessions, Leonard.Ong
RE: A technique to mitigate cookie-stealing XSS attacks, Michael Howard
RE: How to execute programs with parameters in IE - Sandblad advisory #10, Russ
iDEFENSE Security Advisory 11.11.02: Buffer Overflow in KDE resLISa, David Endler
Re: SuSE Security Announcement: perl-MailTools (SuSE-SA:2002:041), Sebastian Krahmer
Security Update: [CSSA-2002-044.0] Linux: Preboot eXecution Environment (PXE) server denial-of-service attacks, security
[SECURITY] [DSA 193-1] New klisa packages fix buffer overflow, Martin Schulze
RE: Motorola Cable Modem DOS, Dan Taylor Jr.
Re: A technique to mitigate cookie-stealing XSS attacks, Jeremiah Grossman
[SECURITY] [DSA 191-2] New squirrelmail packages fix problem in options page, Martin Schulze
Multiple vulnerabilities in Tiny HTTPd, dong-h0un U
Timing the Application of Security Patches for Optimal Uptime, Crispin Cowan
Re: Cisco PIX SSH/telnet dDOS vulnerability CSCdy51810, Sharad Ahlawat
NOVL-2002-2963651 - iManager (eMFrame) Buffer Overflow, Ed Reed
[RHSA-2002:213-06] New PHP packages fix vulnerability in mail function, bugzilla
benchmark tool for HTTP pages., Tacettin Karadeniz
Multiple Vuln. in Hotfoon.com's Hotfoon4.exe dialer, S G Masood
Re: How to execute programs with parameters in IE - Sandblad advisory #10, Andreas Sandblad
Layer 2 Analysis of WLAN Discovery Applications for Intrusion Detection, Joshua Wright
GLSA: kgpg, Daniel Ahlberg
Buffer Overflow in iSMTP Gateway, K. K. Mookhey

November 10, 2002

Re: Securing OWA on public computers., Alexander
Re: A technique to mitigate cookie-stealing XSS attacks, Ulf Harnhammar

November 09, 2002

Finding Vendor Security Contacts, Ed Ravin
Re: How to execute programs with parameters in IE - Sandblad advisory #10, hysterix1
RhinoSoft Serv-U FTP Anonymous Remote DoS Vulnerability, [secondmotion]-Matt Thompson
Securing OWA on public computers., Alex T.
[SECURITY] [DSA 192-1] New html2ps packages fix arbitrary code execution, Martin Schulze
Zeus Admin Server v4.1r2 index.fcgi XSS bug, euronymous
Re: When scrubbing secrets in memory doesn't work, Michael Zimmermann
Re: Motorola Cable Modem DOS, Peter Arnts
Technical information about unpatched MS Java vulnerabilities, Jouko Pynnonen
Re: A technique to mitigate cookie-stealing XSS attacks, Justin King
Re: A technique to mitigate cookie-stealing XSS attacks, Ulf Harnhammar
Cisco PIX SSH/telnet dDOS vulnerability CSCdy51810, Nils Reichen
RE: A technique to mitigate cookie-stealing XSS attacks, NESTING, DAVID M (SBCSI)
Oracle iSQL*Plus buffer Overflow.., deadbeat
NetBSD Security Advisory 2002-024: IPFilter FTP proxy, NetBSD Security Officer
Re: Accesspoints disclose wep keys, password and mac filter (fwd), tenty
Re: Accesspoints disclose wep keys, password and mac filter (fwd), Tollef Fog Heen
When scrubbing secrets in memory doesn't work, Michael Howard
[SECURITY] [DSA 188-1] New Apache-SSL packages fix several vulnerabilities, Martin Schulze
Re: Help Please, Patrick Oonk
Re: [VulnWatch] Netscreen SSH1 CRC32 Compensation Denial of service, quentyn
Re: Accesspoints disclose wep keys, password and mac filter (fwd), Alex Harasic
Re: PHP-Nuke SQL Injection Vulnerability, Predrag Damnjanovic
Re: Accesspoints disclose wep keys, password and mac filter (fwd), Casper Dik

November 08, 2002

LiteServe Directory Index Cross-Site Scripting, Matthew Murphy
RE: A technique to mitigate cookie-stealing XSS attacks, Michael Howard
Re: A technique to mitigate cookie-stealing XSS attacks, David Wagner
Re: Accesspoints disclose wep keys, password and mac filter (fwd), Thomas Sarlandie
MDKSA-2002:075 - nss_ldap update, Mandrake Linux Security Team
MDKSA-2002:076 - perl-MailTools update, Mandrake Linux Security Team
Re: Bypassing website filter in SonicWall, Justin King
iDEFENSE Security Advisory 11.08.02b: Non-Explicit Path Vulnerability in QNX Neutrino RTOS, David Endler
iDEFENSE Security Advisory 11.08.02a: File Disclosure Vulnerability in Simple Web Server, David Endler
Re: A technique to mitigate cookie-stealing XSS attacks, Peter Watkins
Re: RES: A technique to mitigate cookie-stealing XSS attacks, Florian Weimer
Re: A technique to mitigate cookie-stealing XSS attacks, Steven M. Christey
Re: How to execute programs with parameters in IE - Sandblad advisory #10, jelmer
Re: How to execute programs with parameters in IE - Sandblad advisory #10, Gert Fokkema
Re: A technique to mitigate cookie-stealing XSS attacks, Florian Weimer
Re: A technique to mitigate cookie-stealing XSS attacks, Nick Simicich
Re: When scrubbing secrets in memory doesn't work, Valdis . Kletnieks
XSS in Postnuke Rogue release (0.72), Muhammad Faisal Rauf Danka
Re: MDKSA-2002:076 - perl-MailTools update, Vincent Danen
Help Please, Mark Litchfield
Lotus Domino HTTP Server security issue, Frank Perreault
Re: Accesspoints disclose wep keys, password and mac filter (fwd), Hakan Carlsson
Re: Accesspoints disclose wep keys, password and mac filter (fwd), informatik.koerfer
Re: A technique to mitigate cookie-stealing XSS attacks, Valdis . Kletnieks
RE: Motorola Cable Modem DOS, Fulton Preston
Potential Denial of Service Vulnerability in IRIX RPC-based libc, SGI Security Coordinator
Re: Yahoo Messenger: Invisible User Detect, Chris Caydes

November 07, 2002

RES: A technique to mitigate cookie-stealing XSS attacks, AQBARROS
Re: A technique to mitigate cookie-stealing XSS attacks, Matthew Collins
Re: When scrubbing secrets in memory doesn't work, Andy Polyakov
Vulnerability in Cutecast Forum v1.2, Zero-X www.lobnan.de Team
[SECURITY] [DSA 191-1] New squirrelmail packages fix cross site scripting bugs, Martin Schulze
Re: When scrubbing secrets in memory doesn't work, Gianni Tedesco
Yahoo Messenger: Invisible User Detect, cringe
Re: Motorola Cable Modem DOS, Peter Jeremy
Re: Accesspoints disclose wep keys, password and mac filter (fwd), informatik.koerfer
[RHSA-2002:242-06] Updated kerberos packages available, bugzilla
RE: How to execute programs with parameters in IE - Sandblad advisory #10, Thor Larholm
[SECURITY] [DSA-190-1] buffer overflow in Window Maker, Wichert Akkerman
Remote pine Denial of Service, Linus Sjöberg
Linksys security contact, David Endler
RE: Security Industry Under Scrutiny: Part One, John . Airey
Security Industry Under Scrutiny: Part One, sockz loves you
[RHSA-2002:197-09] Updated glibc packages fix vulnerabilities in resolver, bugzilla
[CLA-2002:544] Conectiva Linux Security Announcement - linuxconf, secure

November 06, 2002

How to execute programs with parameters in IE - Sandblad advisory #10, Andreas Sandblad
IRIX ToolTalk rpc.ttdbserverd vulnerabilities, SGI Security Coordinator
QNX 6.1 TimeCreate weakness, Pawel Pisarczyk
[SECURITY] [DSA 189-1] New luxman packages fix local root exploit, Martin Schulze
iDEFENSE Security Advisory 11.06.02: Non-Explicit Path Vulnerability in LuxMan, David Endler
Re: ZoneEdit Account Hijack Vulnerability, securityfocus
[CLA-2002:535] Conectiva Linux Security Announcement - glibc, secure
[CLA-2002:538] Conectiva Linux Security Announcement - tar/unzip, secure
[CLA-2002:542] Conectiva Linux Security Announcement - gv/kghostview, secure
[CLA-2002:534] Conectiva Linux Security Announcement - krb5, secure
[CLA-2002:537] Conectiva Linux Security Announcement - tetex, secure
[CLA-2002:540] Conectiva Linux Security Announcement - heartbeat, secure
[CLA-2002:541] Conectiva Linux Security Announcement - mod_ssl, secure
[CLA-2002:539] Conectiva Linux Security Announcement - ypserv, secure
GLSA: MailTools, Daniel Ahlberg
Re: Re: Oracle Security Contact, Chris Wysopal
Re: Oracle Security Contact, Steven M. Christey
Re: When scrubbing secrets in memory doesn't work, Perry E. Metzger

November 05, 2002

When scrubbing secrets in memory doesn't work, Michael Howard
Bug in Monkey Webserver 0.5.0 or minors versions, Daniel
Re: A technique to mitigate cookie-stealing XSS attacks, Florian Weimer
networking_utils.php, Tacettin Karadeniz
SnortCenter 0.9.5 temp file naming problems..., Clint Byrum
A technique to mitigate cookie-stealing XSS attacks, Michael Howard
RE: [security bulletin] SSRT2265 HP TruCluster Server Interconnect Potential Security Vulnerability (fwd), Dave Ahmad
IRIX CDE ToolTalk rpc.ttdbserverd vulnerabilities, SGI Security Coordinator
ZoneEdit Account Hijack Vulnerability, [secondmotion]-Matt Thompson
Re: Accesspoints disclose wep keys, password and mac filter (fwd), d k
SuSE Security Announcement: perl-MailTools (SuSE-SA:2002:041), Sebastian Krahmer
[SNS Advisory No.58] Microsoft IIS Local Cross-site Scripting Vulnerability, snsadv@xxxxxxxxx
Re: Motorola Cable Modem DOS, Juraj Ziegler

November 04, 2002

RE: Accesspoints disclose wep keys, password and mac filter (fwd), Melson, Paul
Re: Accesspoints disclose wep keys, password and mac filter (fwd), Cliff Albert
Re: Accesspoints disclose wep keys, password and mac filter (fwd), Frank Louwers
Oracle iSQL*Plus buffer overflow vulnerability (#NISR04112002), NGSSoftware Insight Security Research
Re: Allot Netenforcer problems, GNU TAR flaw, Felix Radensky
Accesspoints disclose wep keys, password and mac filter (fwd), Tom Knienieder
[Announce] AngeL v0.9.0, Paolo Perego
[A3SC] MS IIS out of process privilege elevation vulnerability(A3CR@K-Vul-2002-06-002), li0n
iDEFENSE Security Advisory 11.04.02a: Pablo FTP Server DoS Vulnerability, David Endler
iDEFENSE Security Advisory 11.04.02b: Denial of Service Vulnerability in Xeneo Web Server, David Endler
[SECURITY] [DSA 187-1] New Apache packages fix several vulnerabilities, Martin Schulze

November 02, 2002

Weak Password Encryption Scheme in MS SQL Server, K. K. Mookhey

November 01, 2002

Re: ion-p.exe allows Remote File Retrieving, Stuart Moore
Bug in EventSave, Frank Heyne
iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability in Abuse, David Endler
(Correction) Netscreen SSH1 CRC32 Compensation Denial of service, Erik Parker
Mindwall Project, Tamer Sahin
RE: Netscreen SSH1 CRC32 Compensation Denial of service, John
Iomega NAS A300U security and inter-operability issues, Keith R. Watson
Re: iDEFENSE Security Advisory 10.31.02a: Denial of Service Vulnerability in Linksys BEFSR41 EtherFast Cable/DSL Router, Alex Harasic
Netscreen SSH1 CRC32 Compensation Denial of service, Erik Parker
ion-p.exe allows Remote File Retrieving, Zero-X www.lobnan.de Team
RE: Motorola Cable Modem DOS, Jeroen Kessenich
Weak Password Encryption Scheme in Integrated Dialer, Arjun Pednekar
RE: Bypassing website filter in SonicWall, Brian J. Gaia
Re: Gimp: Erased sections of images print in some cases, Clark Mills
Re: Motorola Cable Modem DOS, Sam Hayes Merritt, III
Re: IP SmartSpoofing : How to bypass all IP filters relying on source IP address, Ossian Vitek
M$ VPN hole reported, AK
[SECURITY] [DSA 186-1] New log2mail packages fix several vulnerabilities, Martin Schulze
iDEFENSE Security Advisory 10.31.02c: PHP-Nuke SQL Injection Vulnerability, David Endler
iDEFENSE Security Advisory 10.31.02a: Denial of Service Vulnerability in Linksys BEFSR41 EtherFast Cable/DSL Router, David Endler
iDEFENSE Security Advisory 10.31.02b: Prometheus Application Framework Code Injection, David Endler

News | FAQ | advertise