bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2013/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 7	²	³
⁴ 8	⁵ 4	⁶ 8	⁷ 5	⁸ 3	⁹	¹⁰
¹¹ 10	¹² 6	¹³ 6	¹⁴ 10	¹⁵ 4	¹⁶	¹⁷
¹⁸ 9	¹⁹ 20	²⁰ 6	²¹ 11	²² 6	²³	²⁴
²⁵ 4	²⁶ 7	²⁷ 7	²⁸ 3	²⁹ 3	³⁰

Messages by day:

November 1 (7 messages)

[security bulletin] HPSBMU02933 rev.1 - HP SiteScope, issueSiebelCmd SOAP Request, Remote Code Execution (security-alert@...com)
[security bulletin] HPSBMU02872 SSRT101185 rev.3 - HP Service Manager, Remote Disclosure of Information, Cross Site Scripting(XSS) (security-alert@...com)
[security bulletin] HPSBMU02932 rev.1 - HP Application LifeCycle Management, ALM client component, Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMU02935 rev.1 - HP LoadRunner Virtual User Generator, Remote Code Execution (security-alert@...com)
[SECURITY] [DSA 2789-1] strongswan security update (Yves-Alexis Perez <corsac@...ian.org>)
[security bulletin] HPSBMU02874 SSRT101184 rev.2 - HP Service Manager, Java Runtime Environment (JRE) Security Update (security-alert@...com)
[security bulletin] HPSBMU02934 rev.1 - HP Application LifeCycle Management, GossipService SOAP Request, Remote Code Execution (security-alert@...com)

November 4 (8 messages)

pdirl PHP Directory Listing 1.0.4 - Cross Site Scripting Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBMU02931 rev.2 - HP Service Manager, Injection of Arbitrary Code, Remote Privilege Elevation, Remote Disclosure of … (security-alert@...com)
[SECURITY] [DSA 2790-1] nss security update (Salvatore Bonaccorso <carnil@...ian.org>)
[slackware-security] mozilla-thunderbird (SSA:2013-307-01) (Slackware Security Team <security@...ckware.com>)
XSS and CSRF Horde Groupware Web mail Edition (m.benetrix@...ecure.com.au)
CSRF Horde Groupware Web mail Edition (m.benetrix@...ecure.com.au)
XADV-2013003 Linux Kernel eCryptfs write_tag_3_packet Heap Buffer Overflow Vulnerability (geinblues@...il.com)
[SECURITY] [DSA 2791-1] tryton-client security update (Florian Weimer <fw@...eb.enyo.de>)

November 5 (4 messages)

Cisco Mars Cross-Site Scripting Vulnerability - CVE-2013-5563 (g.delvecchio@...rtnetsecurity.net)
[SECURITY] [DSA 2792-1] wireshark security update (Salvatore Bonaccorso <carnil@...ian.org>)
ESA-2013-070: EMC Documentum Cross Site Scripting Vulnerability. (Security Alert <Security_Alert@....com>)
ESA-2013-073: EMC Documentum eRoom Multiple Cross Site Scripting Vulnerabilities. (Security Alert <Security_Alert@....com>)

November 6 (8 messages)

[ISecAuditors Security Advisories] SQL Injection vulnerability in "Project'Or RIA" allow arbitrary access to the databa… (ISecAuditors Security Advisories <advis…)
[ISecAuditors Security Advisories] Multiple XSS vulnerabilities in "Project'Or RIA" (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[ISecAuditors Security Advisories] LinkedIn social network is affected by Persistent Cross-Site Scripting vulnerability (ISecAuditors Security Advisories <advis…)
wordpress jigoshop Plugin path disclosure vulnerabilities (iedb.team@...il.com)
[SOJOBO-ADV-13-03] - Wordpress plugin Gallery Bank 2.0.19 Reflected Cross Site Scripting (advisories@...omio.com)
Open-Xchange Security Advisory 2013-11-06 (Martin Braun <martin.braun@...n-xchange.com>)
SQL Injection in appRain (High-Tech Bridge Security Research <advisory@...ridge.com>)
CORE-2013-0704 - Vivotek IP Cameras RTSP Authentication Bypass (CORE Advisories Team <advisories@...esecurity.com>)

November 7 (5 messages)

Cisco Security Advisory: Cisco TelePresence VX Clinical Assistant Administrative Password Reset Vulnerability (Cisco Systems Product Security Incident Response …)
CVE-2013-4425: Private key disclosure, Osirix (lite, 64bit and FDA cleader version) (Medical Application) (Dirk-Willem van Gulik <dirkx@...weaving.org>)
Cisco Security Advisory: Cisco WAAS Mobile Remote Code Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
CFP BugCON 2014 - Mexico City ("Carlos A. Lozano" <vendetta@...con.org>)
Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <…)

November 8 (3 messages)

Apple MacOSX 10.9 Hard Link Memory Corruption (submit@...ec.org)
RE: FP BugCON 2014 - Mexico City (Tamara Vera <tverac@...elcorp.net>)
Word 2003 SP2 .doc fork bomb on WinXP SP3 (jsibley1@...il.com)

November 11 (10 messages)

WorldCIST'14 - World Conference on IST; Submission deadline: November 29 ("Maria Lemos" <marialemos72@...il.com>)
Belkin WiFi NetCam video stream backdoor with unchangeable admin/admin credentials (Johannes.Ernst@...il.com)
Re: Word 2003 SP2 .doc fork bomb on WinXP SP3 ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[SECURITY] [DSA 2793-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
XADV-2013003 Linux Kernel bt8xx Video Driver IOCTL Heap Overflow (geinblues@...il.com)
[ MDVSA-2013:265 ] kernel (security@...driva.com)
Vulnerability in Pydio/AjaXplorer < = 5.0.3 (advisories@...fsec.com)
Vulnerability in Pydio/AjaXplorer <= 5.0.3 (advisories@...fsec.com)
[SECURITY] [DSA 2794-1] spip security update (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Word 2003 SP2 .doc fork bomb on WinXP SP3 (jsibley1@...il.com)

November 12 (6 messages)

vulnerability issue for DB2 express (bhavyasethi.atcs@...il.com)
XSS on Juniper JUNOS 11.4 Embedthis Appweb 3.2.3 (info@...reabodei.com)
WebSurgery v1.1 released (Web application security testing suite) (John Stamatakis <srgn.ml@...glemail.com>)
WebSurgery v1.1 released (Web application security testing suite) ("John Stamatakis" <john.stamatakis@...risetech.gr>)
RUCKUS ADVISORY ID 111113-1: Authenticated code injection vulnerability in ZoneDirector administrative web interface (Ruckus Product Security Team <security@ru…)
Re: Apple MacOSX 10.9 Hard Link Memory Corruption (Stefan Arentz <stefan@...ement.sateh.com>)

November 13 (6 messages)

Fwd: vulnerability issue for DB2 express (Jonathan Yu <jonathan.i.yu@...il.com>)
Fwd: RUCKUS ADVISORY ID 111113-2: Authenticated persistent cross site scripting vulnerability in guest pass provisionin… (Ruckus Product Security Team <security@…)
[security bulletin] HPSBHF02939 rev.1 - HP Integrated Lights-Out 4 (iLO4), Remote Cross Site Scripting (XSS), Unauthorized Disclosure of I… (security-alert@...com)
[SECURITY] [DSA 2795-1] lighttpd security update (Michael Gilbert <mgilbert@...ian.org>)
LastPass Android container PIN and auto-wipe security feature bypass (CVE-2013-5113/5114) (Chris John Riley <chris.riley@....cc>)
Cross-Site Scripting (XSS) in Zikula Application Framework (High-Tech Bridge Security Research <advisory@...ridge.com>)

November 14 (10 messages)

[SECURITY] [DSA 2796-1] torque security update (Salvatore Bonaccorso <carnil@...ian.org>)
Android Superuser shell character escape vulnerability (Kevin Cernekee <cernekee@...il.com>)
Superuser "su --daemon" vulnerability on Android >= 4.3 (Kevin Cernekee <cernekee@...il.com>)
Superuser unsanitized environment vulnerability on Android <= 4.2.x (Kevin Cernekee <cernekee@...il.com>)
[SECURITY] [DSA 2797-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
Dahua DVR Authentication Bypass - CVE-2013-6117 (Jake Reynolds <Jake@...thsecurity.com>)
Re: DS3 Authentication Server - Multiple Issues (support@...global.com)
Re: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Prime Data Center Network Manager (Rodzbry27@...oo.com)
Re: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Prime Data Center Network Manager (Rodzbry27@...oo.com)
Re: [security bulletin] HPSBUX02922 SSRT101305 rev.1 - HP-UX Running Java5 Runtime Environment (JRE) and Java Developer Kit (JDK), Remote … (Rodzbry27@...oo.com)

November 15 (4 messages)

APPLE-SA-2013-11-14-1 iOS 7.0.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Re: Superuser unsanitized environment vulnerability on Android <= 4.2.x (Kevin Cernekee <cernekee@...il.com>)
NEW VMSA-2013-0013 VMware Workstation host privilege escalation vulnerability ("\"VMware Security Response Center\"" <security@...are.com>)
Re: Superuser unsanitized environment vulnerability on Android <= 4.2.x ("Gleb O. Raiko" <raiko@...si.msk.ru>)

November 18 (9 messages)

Cross-Site Scripting (XSS) in Tweet Blender Wordpress Plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)
[CVE-2013-6356] Avira Secure Backup v1.0.0.1 Multiple Registry Key Value Parsing Local Buffer Overflow Vulnerability (Julien Ahrens <info@...security.com>)
XADV-2013005 FreeBSD 10 <= nand Driver IOCTL Kernel Memory Leak Bug (geinblues@...il.com)
XADV-2013006 FreeBSD <= 10 kernel qlxge/qlxgbe Driver IOCTL Multiple Kernel Memory Leak Bugs (geinblues@...il.com)
[SECURITY] [DSA 2795-2] lighttpd regression update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 2797-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 2798-1] curl security update (Michael Gilbert <mgilbert@...ian.org>)
Information Security Forecast 2014 (Jeimy Cano <jjcano@...oo.com>)
[OVSA20131108] OpenVAS Manager And OpenVAS Administrator Vulnerable To Partial Authentication Bypass (Tim Brown <timb@...nvas.org>)

November 19 (20 messages)

Re: Fwd: vulnerability issue for DB2 express (shatter@...secinc.com)
[SOJOBO-ADV-13-04] - PHP-Nuke 8.2.4 multiple vulnerabilities (advisories@...omio.com)
[slackware-security] mozilla-firefox (SSA:2013-322-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] openssh (SSA:2013-322-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] samba (SSA:2013-322-03) (Slackware Security Team <security@...ckware.com>)
PayPal Inc Bug Bounty #65 China - Redirect Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[slackware-security] seamonkey (SSA:2013-322-04) (Slackware Security Team <security@...ckware.com>)
PayPal Inc Bug Bounty #42 - Persistent POST Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Paypal Inc Bug Bounty #47 ALYZ - Persistent Search Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
SKIDATA RFID Freemotion.Gate Unauthenticated Web Service Aribtrary Remote Command Execution (Dennis Kelly <dennis.kelly@...il.com>)
FreeBSD Security Advisory FreeBSD-SA-13:14.openssh (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
16TH AVAR INTERNATIONAL SECURITY CONFERENCE 2013 - (4th-7th Dec'13, Chennai. India) (Gregory Panakkal <gregory_panakkal@...tmail.fm>)
[ MDVSA-2013:267 ] java-1.7.0-openjdk (security@...driva.com)
ESA-2013-078: EMC Document Sciences xPression Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
pineapp mailsecure remote no authenticated privilege escalation & remote execution code (rubengarrote@...il.com)
XADV-2013003 Linux Kernel fbdev Driver arcfb_write() Overflow (geinblues@...il.com)
XADV-2013008 Linux Kernel 3.11.7 <= sk_attach_filter Kernel Heap Corruption (geinblues@...il.com)
[ MDVSA-2013:266 ] java-1.6.0-openjdk (security@...driva.com)
XADV-2013007 Linux Kernel bt8xx Video Driver IOCTL Heap Overflow (geinblues@...il.com)
Intersystems Cache Remote Code Execution (via Default 'Minimal Security' Install) (bruk0ut.sec@...il.com)

November 20 (6 messages)

[ MDVSA-2013:268 ] torque (security@...driva.com)
Paypal Bug Bounty #14 - Persistent Payment Mail Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Mybb Ajaxfs Plugin Sql Injection vulnerability (iedb.team@...il.com)
Appologics AirBeam v1.9.2 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2013:269 ] firefox (security@...driva.com)
[ MDVSA-2013:270 ] nss (security@...driva.com)

November 21 (11 messages)

[SECURITY] [DSA 2798-2] curl security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2013:273 ] libjpeg (security@...driva.com)
[ MDVSA-2013:271 ] pmake (security@...driva.com)
[ MDVSA-2013:272 ] poppler (security@...driva.com)
[ MDVSA-2013:275 ] krb5 (security@...driva.com)
[ MDVSA-2013:277 ] lighttpd (security@...driva.com)
Facebook Vulnerability Discloses Friends Lists Defined as Private (qsrc Quotium <qsrc@...tium.com>)
Instagram Photo Upload and Flattr Money Redirection Vulnerability (pfohl@...solutions.de)
[ MDVSA-2013:276 ] curl (security@...driva.com)
[ MDVSA-2013:274 ] libjpeg (security@...driva.com)
[ MDVSA-2013:278 ] samba (security@...driva.com)

November 22 (6 messages)

[SECURITY] [DSA 2801-1] libhttp-body-perl security update (Salvatore Bonaccorso <carnil@...ian.org>)
DC4420 (DefCon London) meeting next Tuesday, 26th November 2013 (Tony Naggs <tonynaggs@...il.com>)
ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 2802-1] nginx security update (Thijs Kinkhorst <thijs@...ian.org>)
CVE-2013-6795 Vulnerability in the Rackspace Windows Agent and Updater (andrew@...udpassage.com)
Unauthorized console access on Satechi travel router v1.5 (Luc Dore <ldore@...lc.net>)

November 25 (4 messages)

[ MDVSA-2013:279 ] wireshark (security@...driva.com)
[ MDVSA-2013:280 ] memcached (security@...driva.com)
[ MDVSA-2013:281 ] nginx (security@...driva.com)
Defense in depth -- the Microsoft way (part 14): incomplete, misleading and dangerous documentation ("Stefan Kanthak" <stefan.kanthak@...go.de>)

November 26 (7 messages)

Open-Xchange Security Advisory 2013-11-25 (Martin Braun <martin.braun@...n-xchange.com>)
[ MDVSA-2013:282 ] perl-HTTP-Body (security@...driva.com)
[ MDVSA-2013:283 ] glibc (security@...driva.com)
[ MDVSA-2013:284 ] glibc (security@...driva.com)
[SECURITY] [DSA 2800-1] nss security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2013:285 ] bugzilla (security@...driva.com)
[ MDVSA-2013:286 ] ruby (security@...driva.com)

November 27 (7 messages)

[SECURITY] [DSA 2803-1] quagga security update (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2013:287 ] drupal (security@...driva.com)
[SECURITY] [DSA 2804-1] drupal7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBGN02942 rev.1 - HP Service Manager and ServiceCenter, Remote Code Execution (security-alert@...com)
Multiple Cross-Site Scripting (XSS) in Claroline (High-Tech Bridge Security Research <advisory@...ridge.com>)
SQL Injection in Dokeos (High-Tech Bridge Security Research <advisory@...ridge.com>)
SQL Injection in Chamilo LMS (High-Tech Bridge Security Research <advisory@...ridge.com>)

November 28 (3 messages)

[HITB-Announce] #HITB2014AMS Call for Papers Now Open (Hafez Kamal <aphesz@...kinthebox.org>)
[SECURITY] [DSA 2805-1] sup-mail security update (Luciano Bello <luciano@...ian.org>)
RUCKUS ADVISORY ID 10282013 - User authentication bypass vulnerability in Ruckus Access Point's administrative web inte… (Ruckus Product Security Team <security@…)

November 29 (3 messages)

NewsAktuell PressePortal DE - Remote SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FreeBSD Security Advisory FreeBSD-SA-13:14.openssh [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 2806-1] nbd security update (Thijs Kinkhorst <thijs@...ian.org>)

147 messages