bugtraq mailing list - 2012/03

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2012/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 1	² 2	³	⁴
⁵ 10	⁶ 4	⁷ 8	⁸ 14	⁹ 5	¹⁰	¹¹
¹² 10	¹³ 5	¹⁴ 5	¹⁵ 3	¹⁶ 7	¹⁷	¹⁸
¹⁹ 18	²⁰ 6	²¹ 10	²² 2	²³ 13	²⁴	²⁵
²⁶	²⁷ 16	²⁸ 16	²⁹ 12	³⁰ 6	³¹

Messages by day:

March 1 (1 message)

[ MDVSA-2012:028 ] libxslt (security@...driva.com)

March 2 (2 messages)

[Suspected Spam] FlashFXP v4.1.8.1701 - Buffer Overflow Vulnerability ("research@...nerability-lab.com" <research@...nerability-lab.com>)
[Suspected Spam] Endian UTM Firewall v2.4.x & v2.5.0 - Multiple Web Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)

March 5 (10 messages)

[SECURITY] [DSA 2423-1] movabletype-opensource security update (Florian Weimer <fw@...eb.enyo.de>)
Security Implications of Predictable IPv6 Fragment Identification values (rev'ed IETF I-D) (Fernando Gont <fgont@...networks.com>)
Lastguru ASP GuestBook 'View.asp' - SQL Injection Vulnerability (demonalex@....com)
[SECURITY] [DSA 2424-1] libxml-atom-perl security update (Florian Weimer <fw@...eb.enyo.de>)
%windir%\temp\sso\ssoexec.dll (or: how trustworthy is Microsoft's build process) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[SECURITY] [DSA 2425-1] plib security update (Florian Weimer <fw@...eb.enyo.de>)
Symfony2 Local File Disclosure - Security Advisory - SOS-12-002 ("Lists" <lists@...seofsecurity.com>)
Timesheet Next Gen 1.5.2 Multiple SQLi (Thomas Richards <g13net@...il.com>)
Open-Realty CMS 2.5.8 (2.x.x) <= "select_users_template" Local File Inclusion Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Etano 1.x <= Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)

March 6 (4 messages)

11in1 CMS v1.2.1 - SQL Injection Vulnerabilities ("admin@...ab" <admin@...nerability-lab.com>)
[TSI-ADV-1201] Path Traversal on Polycom Web Management Interface (Joao Paulo Caldas Campello <joao.paulo@...pest.com.br>)
[TSI-ADV-1202] Polycom Web Management Interface O.S. Command Injection (Joao Paulo Caldas Campello <joao.paulo@...pest.com.br>)
ESA-2012-013: RSA SecurID(r) Software Token Converter buffer overflow vulnerability (<Security_Alert@....com>)

March 7 (8 messages)

[SECURITY] [DSA 2426-1] gimp security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 2427-1] imagemagick security update (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBUX02741 SSRT100728 rev.2 - HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Rest… (security-alert@...com)
XCon 2012 XFocus Information Security Conference Call for Paper (xcon@...yongxingan.com)
Multiple XSS in Fork CMS (advisory@...ridge.ch)
Multiple SQL injections in rivettracker <=1.03 (ali.raheem@...il.com)
OSClass directory traversal (leads to arbitrary file upload) (Filippo Cavallarin <filippo.cavallarin@...seq.it>)
[security bulletin] HPSBMU02744 SSRT100776 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Unautho… (security-alert@...com)

March 8 (14 messages)

[SECURITY] [DSA 2429-1] mysql-5.1 security update (Florian Weimer <fw@...eb.enyo.de>)
APPLE-SA-2012-03-07-1 iTunes 10.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2012-03-07-2 iOS 5.1 Software Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2012-03-07-3 Apple TV 5.0 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[Suspected Spam] Barracuda WAF 660 v7.6.0.028 - Cross Site Vulnerability ("research@...nerability-lab.com" <research@...nerability-lab.com>)
[Suspected Spam] Barracuda CudaTel v2.0.029.1 - Multiple Web Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)
Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)
Enterasys SecureStack Switch v6.x - Multiple Vulnerabilities ("research@...nerability-lab.com" <research@...nerability-lab.com>)
Pitrinec MacroToolworks 7.5 - Buffer Overflow Vulnerability ("research@...nerability-lab.com" <research@...nerability-lab.com>)
SAP Business Objects XI R2 Infoview Multiple XSS (vulns@...nach.com)
Iciniti Store SQL Injection - Security Advisory - SOS-12-003 ("Lists" <lists@...seofsecurity.com>)
gnome-terminal, xfce4-terminal, terminator and others write scrollback buffer to disk (Mark Krenz <mark@...o.com>)
Eleytt Research ER-03-2012 ("Michal Bucko" <michal.bucko@...ytt.com>)
[SECURITY] [DSA 2428-1] freetype security update (Moritz Muehlenhoff <jmm@...ian.org>)

March 9 (5 messages)

Re: gnome-terminal, xfce4-terminal, terminator and others write scrollback buffer to disk ("Dmitry Yu. Bolkhovityanov" <D.Yu.Bolkhovityanov@....nsk.su>)
VMSA-2012-0002 VMware vCenter Chargeback Manager Information Leak and Denial of Service (VMware Security Team <security@...are.com>)
VMSA-2012-0003 VMware VirtualCenter Update and ESX 3.5 patch update JRE (VMware Security Team <security@...are.com>)
Re: Fwd: 2.6.6 <= phpMyFAQ <= 2.6.8 XSS (Henri Salo <henri@...v.fi>)
LSE-2012-03-01: PyPAM -- Python bindings for PAM - Double Free Corruption (Markus Vervier <markus.vervier@...xperts.de>)

March 12 (10 messages)

Synology Photo Station 5 - Reflected Cross-Site Scripting (simon.ganiere@...il.com)
Wikidforum 2.10 Multiple security vulnerabilities (sschurtz@...ksecurity.de)
Re: Ariadne 2.7.6 Multiple XSS vulnerabilities (Henri Salo <henri@...v.fi>)
[SECURITY] [DSA 2430-1] python-pam security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2431-1] libdbd-pg-perl security update (Moritz Muehlenhoff <jmm@...ian.org>)
OSI Security: CheckPoint Firewall VPN - Information Disclosure (Patrick Webster <patrick@...security.com.au>)
Android wireless accepts fake response (No interaction requires) (Vulnerability ?) (Security Mailing List <s3clist@...mail.com>)
Aurora WebOPAC SQL Injection - Security Advisory - SOS-12-004 ("Lists" <lists@...seofsecurity.com>)
APPLE-SA-2012-03-12-1 Safari 5.1.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 2432-1] libyaml-libyaml-perl security update (Moritz Muehlenhoff <jmm@...ian.org>)

March 13 (5 messages)

[security bulletin] HPSBMU02746 SSRT100781 rev.1 - HP Data Protector Express, Remote Denial of Service (DoS), Execution of Arbitrary Code (security-alert@...com)
Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability [CVE-2012-1417] (Narendra Shinde <nshinde@...urview.com>)
ESA-2012-012: EMC Documentum eRoom Multiple Vulnerabilities (<Security_Alert@....com>)
Announcing Hackademic CFP (B Potter <gdead@...oo.com>)
PrivaWall Antivirus Office XML Format Evasion/Bypass Vulnerability (moshez@...secglobal.com)

March 14 (5 messages)

Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Cataly… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco Firewall Services Module Crafted Protocol Independent Multicast Message Denial of Service… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco ASA 5500 Series Adaptive Security Appliance Clientless VPN ActiveX Control Remote Code Ex… (Cisco Systems Product Security Incident…)
Struts2 Security Challenge ("Ivan Buetler" <ivan.buetler@...c.ch>)
Oracle Exadata Infiniband Switch default logins and world readable shadow file (larry0@...com)

March 15 (3 messages)

Re: Android wireless accepts fake response (No interaction requires) (Vulnerability ?) (Security Mailing List <s3clist@...mail.com>)
nginx fix for malformed HTTP responses from upstream servers (security-bulletin@...nx.com)
WikyBlog 1.7.3RC2 XSS vulnerability (sschurtz@...ksecurity.de)

March 16 (7 messages)

[SECURITY] [DSA 2433-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
AST-2012-002: Remote Crash Vulnerability in Milliwatt Application ("Asterisk Security Team" <security@...erisk.org>)
AST-2012-003: Stack Buffer Overflow in HTTP Manager ("Asterisk Security Team" <security@...erisk.org>)
VMSA-2012-0004 VMware View privilege escalation and cross-site scripting (VMware Security Team <security@...are.com>)
[ MDVSA-2012:029 ] pidgin (security@...driva.com)
[ MDVSA-2012:030 ] systemd (security@...driva.com)
[Announcement] ClubHack Mag - Call for Articles (abhijeet@...ag.in)

March 19 (18 messages)

VMSA-2012-0005 VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, ESXi and ESX address sever… (VMware Security Team <security@...are.c…)
[ MDVSA-2012:031 ] firefox (security@...driva.com)
Re: WikyBlog 1.7.3RC2 XSS vulnerability (Henri Salo <henri@...v.fi>)
Android wipe unreliable (Jan Schejbal <jan.mailinglisten@...glemail.com>)
[security bulletin] HPSBPI02728 SSRT100692 rev.5 - Certain HP Printers and HP Digital Senders, Remote Firmware Update Enabled by Default (security-alert@...com)
at32 ReverseProxy - Multiple HTTP Header Field Denial Of Service Vulnerability (demonalex@....com)
ESA-2012-014: RSA enVision Multiple Vulnerabilities (<Security_Alert@....com>)
Dell Webcam Software Bundled ActiveX Control CrazyTalk4Native.dll sprintf Remote Buffer Overflow Vulnerability (nospam@...il.it)
SEC Consult SA-20120315-0 :: Multiple permanent XSS vulnerabilities in EMC Documentum eRoom (SEC Consult Vulnerability Lab <research@...-consult.com>)
Re: Android wireless accepts fake response (No interaction requires) (Vulnerability ?) (vince@...eproject.com)
RE: Android wireless accepts fake response (No interaction requires) (Vulnerability ?) (Joe Arnold <jarnold@...e.net>)
Tor Browser Bundle for Linux (2.2.35-8) "EVIL bug" (CXySuYg5DuKktzX@...e-mail.net)
ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthenticated Remote Directory Traversal Vulnerability (nospam@...il.it)
VUPEN Security Research - Adobe Flash Player "Matrix3D" Remote Memory Corruption (CVE-2012-0768) (VUPEN Security Research <advisories@...en.com>)
Evasion attacks expoliting file-parsing vulnerabilities in antivirus products (sumanj@...il.com)
Aruba Networks multiple advisories: OS command injection in RAP web interface and 802.1X EAP-TLS user authentication bypass (RGill <rgill@...banetworks.com>)
[SECURITY] [DSA 2436-1] libapache2-mod-fcgid security update (Thijs Kinkhorst <thijs@...ian.org>)
Re: [oss-security] Case YVS Image Gallery (Kurt Seifried <kseifried@...hat.com>)

March 20 (6 messages)

[SECURITY] [DSA 2434-1] nginx security update (Luciano Bello <luciano@...ian.org>)
[SECURITY] [DSA 2435-1] gnash security update (Gabriele Giacone <1o5g4r8o@...il.com>)
[MajorSecurity-SA-2012-014]Apple Safari on iOS 5.1 - Adressbar spoofing vulnerability (david.kurz@...orsecurity.net)
[security bulletin] HPSBMU02752 SSRT100802 rev.1 HP Insight Control Software for Linux (IC-Linux), Remote Execution of Arbitrary Code, Den… (security-alert@...com)
Regarding MS12-020 ("Thor \(Hammer of God\)" <thor@...merofgod.com>)
[ MDVSA-2012:032 ] mozilla (security@...driva.com)

March 21 (10 messages)

Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1 (Security <security@...ynamics.com>)
Cyberoam Unified Threat Management: Insecure Password Handling (Saurabh Harit <saurabh.harit@...il.com>)
Cyberoam Unified Threat Management: OS Command Execution (Saurabh Harit <saurabh.harit@...il.com>)
Multiple vulnerabilities in Open Journal Systems (OJS) (advisory@...ridge.com)
CMSimple_XH 1.5.2 Cross-site Scripting vulnerability (sschurtz@...ksecurity.de)
[ MDVSA-2012:033 ] libpng (security@...driva.com)
Seeker Advisory: Insecure Redirect in .NET Form Authentication - Redirect From Login Mechanism (ReturnURL Parameter) ("Irene Abezgauz" <irene@...kersec.com>)
[SECURITY] [DSA 2437-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
RE: Regarding MS12-020 (Jim Harrison <Jim@...tools.org>)
RE: Regarding MS12-020 ("Thor \(Hammer of God\)" <thor@...merofgod.com>)

March 22 (2 messages)

CA20120320-01: Security Notice for CA ARCserve Backup ("Kotas, Kevin J" <Kevin.Kotas@...com>)
Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX Control PlayerPT.ocx sprintf Buffer Overflow Vulnerability (nospam@...il.it)

March 23 (13 messages)

struts2 xsltResult Local code execution vulnerability (voidloafer@...il.com)
[CVE-2012-0047] Apache Wicket XSS vulnerability via pageMapName request parameter (Martin Grigorov <mgrigorov@...che.org>)
[CVE-2012-1089] Apache Wicket serving of hidden files vulnerability (Martin Grigorov <mgrigorov@...che.org>)
Prado TJavaScript::encode() script injection vulnerability (gabor.berczi@...worx.hu)
'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670) (Mark Stanislav <mark.stanislav@...il.com>)
'phpMoneyBooks' Local File Inclusion (CVE-2012-1669) (Mark Stanislav <mark.stanislav@...il.com>)
[SECURITY] [DSA 2438-1] raptor security update (Moritz Muehlenhoff <jmm@...ian.org>)
[ANNOUNCE] Apache Traffic Server releases for security incident CVE-2012-0256 (Leif Hedstrom <zwoop@...che.org>)
[SECURITY] [DSA 2439-1] libpng security update (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2012:034 ] libzip (security@...driva.com)
[ MDVSA-2012:035 ] file (security@...driva.com)
[ MDVSA-2012:036 ] libsoup (security@...driva.com)
[ MDVSA-2012:037 ] cyrus-imapd (security@...driva.com)

March 27 (16 messages)

CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) (VSR Advisories <advisories@...curity.com>)
[SECURITY] [DSA 2440-1] libtasn1-3 security update (Florian Weimer <fw@...eb.enyo.de>)
SQL injection attack possible when connecting to PostgreSQL 9.1 with version 8.1 JDBC driver (Steffen Dettmer <steffen@...t.de>)
[SECURITY] [DSA 2441-1] gnutls26 security update (Florian Weimer <fw@...eb.enyo.de>)
Traffic amplification via Quake 3-based servers (Simon McVittie <smcv@...ian.org>)
[ MDVSA-2012:038 ] openssl (security@...driva.com)
Matthew1471s ASP BlogX - XSS Vulnerabilities (demonalex@....com)
[SECURITY] [DSA 2442-1] openarena security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 2443-1] linux-2.6 security update (dann frazier <dannf@...ian.org>)
[PRE-SA-2012-02] Incorrect loop construct and numeric overflow in libzip (Timo Warns <Warns@...-Sense.DE>)
[ MDVSA-2012:039 ] libtasn1 (security@...driva.com)
[waraxe-2012-SA#080] - Multiple Vulnerabilities in NextBBS 0.6.0 (come2waraxe@...oo.com)
PcwRunAs Password Obfuscation Design Flaw (otr@...kcay.de)
[ MDVSA-2012:040 ] gnutls (security@...driva.com)
Re: CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) (Solar Designer <solar@...nwall.com>)
[ MDVSA-2012:041 ] expat (security@...driva.com)

March 28 (16 messages)

[ MDVSA-2012:042 ] wireshark (security@...driva.com)
[security bulletin] HPSBMU02747 SSRT100771 rev.1 - HP OpenView Network Node Manager (OV NNM) Running Apache Tomcat, Remote Denial of Servi… (security-alert@...com)
[security bulletin] HPSBMU02748 SSRT100772 rev.1 - HP OpenView Network Node Manager (OV NNM) Running Apache HTTP Server, Remote Unauthoriz… (security-alert@...com)
[security bulletin] HPSBMU02744 SSRT100776 rev.2 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Unautho… (security-alert@...com)
[security bulletin] HPSBUX02755 SSRT100667 rev.1 - HP-UX WBEM, Remote Unauthorized Access to Diagnostic Data (security-alert@...com)
[security bulletin] HPSBMU02756 SSRT100596 rev.1 - HP Performance Manager Running on HP-UX, Linux, Solaris and Windows, Remote Execution o… (security-alert@...com)
Cisco Security Advisory: Cisco IOS Software RSVP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Smart Install Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.co…)
Cisco Security Advisory: Cisco IOS Internet Key Exchange Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco IOS Software Traffic Optimization Features (Cisco Systems Product Security Incident Response Team <p…)
Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Reverse SSH Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
TRENDnet SecurView TV-IP121WN Wireless Internet Camera UltraMJCam ActiveX Control OpenFileDlg WideCharToMultiByte Remote Stack Buffer Overflow (nospam@...il.it)
Quest InTrust 10.4.x Annotation Objects ActiveX Control AnnotateX.dll Uninitialized Pointer Remote Code Execution (nospam@...il.it)
D-Link SecuriCam DCS-5605 Network Surveillance ActiveX Control DcsCliCtrl.dll lstrcpyW Remote Buffer Overflow Vulnerability (nospam@...il.it)
Quest InTrust 10.4.x ReportTree and SimpleTree Classes ArDoc.dll ActiveX Control Remote File Creation / Overwrite Vulnerability (nospam@...il.it)

March 29 (12 messages)

OWASP AppSec Research EU CFP/CFT (OWASP AppSec EU <appseceu@...sp.org>)
[SECURITY] [DSA 2444-1] tryton-server security update (Florian Weimer <fw@...eb.enyo.de>)
NGS00153 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Reflective XSS allowing an attacker to gain… ("Research@...Secure" <research@...secur…)
NGS00154 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Session hijacking and bypassing client-side… ("Research@...Secure" <research@...secur…)
NGS00155 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Any logged-in user can bypass controls to r… ("Research@...Secure" <research@...secur…)
NGS00156 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Active sesssion tokens of other users are d… ("Research@...Secure" <research@...secur…)
NGS00157 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Password hashes can be recovered from a sys… ("Research@...Secure" <research@...secur…)
NGS00158 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Arbitrary file download is possible with a … ("Research@...Secure" <research@...secur…)
[ MDVSA-2012:043 ] nginx (security@...driva.com)
[ MDVSA-2012:044 ] cvs (security@...driva.com)
Cross-site scripting vulnerability in Invision Power Board version 3.2.3 (Netsparker Advisories <advisories@...itunasecurity.com>)
[waraxe-2012-SA#081] - Multiple Vulnerabilities in Coppermine 1.5.18 (come2waraxe@...oo.com)

March 30 (6 messages)

Bitsmith PS Knowbase 3.2.3 - Buffer Overflow Vulnerability (Research <research@...nerability-lab.com>)
PHP 5.4/5.3 deprecated eregi() memory_limit bypass (cxib@...ecurity.com)
[ MDVSA-2012:045 ] gnutls (security@...driva.com)
Intuit Help System Protocol URL Heap Corruption and Memory Leak (ds.adv.pub@...il.com)
Intuit Help System Protocol File Retrieval (ds.adv.pub@...il.com)
VMware High-Bandwidth Backdoor ROM Overwrite Privilege Elevation (ds.adv.pub@...il.com)

173 messages

Powered by blists - more mailing lists