bugtraq mailing list - 2014/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 11	² 3	³ 8	⁴ 8	⁵ 5	⁶	⁷
⁸ 7	⁹ 9	¹⁰ 12	¹¹ 12	¹² 6	¹³	¹⁴
¹⁵ 22	¹⁶ 8	¹⁷ 15	¹⁸ 5	¹⁹ 10	²⁰	²¹
²² 8	²³ 5	²⁴ 6	²⁵ 8	²⁶	²⁷	²⁸
²⁹ 3	³⁰ 5	³¹ 2

Messages by day:

December 1 (11 messages)

WordPress <=4.0 Denial of Service Exploit (CVE-2014-9034) (john@...ureli.com)
[SECURITY] [DSA 3079-1] ppp security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3080-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3083-1] mutt security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3082-1] flac security update (Sebastien Delafond <seb@...ian.org>)
[The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[SECURITY] [DSA 3081-1] libvncserver security update (Luciano Bello <luciano@...ian.org>)
CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4 (<Stephan.Rickauer@...sscom.com>)
[RT-SA-2014-009] Information Disclosure in TYPO3 Extension ke_questionnaire (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2014-007] Remote Code Execution in TYPO3 Extension ke_dompdf (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2014-011] EntryPass N5200 Credentials Disclosure (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

December 2 (3 messages)

[SECURITY] [DSA 3084-1] openvpn security update (Florian Weimer <fw@...eb.enyo.de>)
[RT-SA-2014-012] Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management Components (RedTeam Pentesting GmbH <release@...team-pe…)
CVE-2014-9129: XSS and CSRF in CM Download Manager plugin for WordPress (Henri Salo <henri@...v.fi>)

December 3 (8 messages)

ESA-2014-156: EMC Documentum Content Server Insecure Direct Object Reference Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2014-160: RSA® Adaptive Authentication (On-Premise) Authentication Bypass Vulnerability (Security Alert <Security_Alert@....com>)
F5 BIGIP - (OLD!) Persistent XSS in ASM Module (jplopezy@...il.com)
[SECURITY] [DSA 3085-1] wordpress security update (Yves-Alexis Perez <corsac@...ian.org>)
[slackware-security] mozilla-thunderbird (SSA:2014-337-01) (Slackware Security Team <security@...ckware.com>)
Re: [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 (Pedro Ribeiro <pedrib@...il.com>)
Wireless N ADSL 2/2+ Modem Router - DT5130 - Xss / URL Redirect / Command Injection (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)
[SECURITY] [DSA 3086-1] tcpdump security update (Salvatore Bonaccorso <carnil@...ian.org>)

December 4 (8 messages)

APPLE-SA-2014-12-2-1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
CVE-2014-9215 - SQL Injection in PBBoard CMS (tien.d.tran@...s.vn)
Re: Slider Revolution/Showbiz Pro shell upload exploit (assistenz@...-br.com)
[SECURITY] [DSA 3087-1] qemu security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3088-1] qemu-kvm security update (Salvatore Bonaccorso <carnil@...ian.org>)
[oCERT-2014-009] JasPer input sanitization errors (Andrea Barisani <lcars@...rt.org>)
[SECURITY] [DSA 3089-1] jasper security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3090-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)

December 5 (5 messages)

[security bulletin] HPSBUX03218 SSRT101770 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information, and Other V… (security-alert@...com)
[security bulletin] HPSBGN03205 rev.1 - HP Insight Remote Support Clients running SSLv3, Remote Disclosure of Information (security-alert@...com)
Offset2lib: bypassing full ASLR on 64bit Linux (Hector Marco <hecmargi@....es>)
NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (VMware Security Response Center <security@...are.com>)
NASA Orion Mars Program - Bypass, Persistent Issue & Embed Code Execution Vulnerability (Boarding Pass) (Vulnerability Lab <research@...nerability-lab.com>)

December 8 (7 messages)

[SECURITY] [DSA 3092-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3091-1] getmail4 security update (Giuseppe Iuculano <iuculano@...ian.org>)
[SE-2014-02] Google App Engine Java security sandbox bypasses (project pending completion / action from Google) (Security Explorations <contact@...urity-explor…)
Re: [oss-security] Offset2lib: bypassing full ASLR on 64bit Linux (Shawn <citypw@...il.com>)
CMS Made Simple PHP Code Injection Vulnerability (All versions) (sahm@...t.com)
CFP: InfoSec SouthWest 2015 (ISSW) (Tod Beardsley <todb@...ketfu.com>)
[ANN] Apache Struts 2.3.20 GA release available with security fix (Lukasz Lenart <lukaszlenart@...che.org>)

December 9 (9 messages)

[CVE-2014-7807] Apache CloudStack unauthenticated LDAP binds (jlk@...che.org)
[SECURITY] [DSA 3094-1] bind9 security update (Giuseppe Iuculano <iuculano@...ian.org>)
[security bulletin] HPSBST03154 rev.2 - HP StoreFabric C-series MDS switches and HP C-series Nexus 5K switches running Bash Shell, Remote … (security-alert@...com)
[SECURITY] [DSA 3093-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
Subrion CMS Security Advisory - XSS Vulnerability - CVE-2014-9120 (Onur Yilmaz <onur@...sparker.com>)
[security bulletin] HPSBGN03222 rev.1 - HP Enterprise Maps running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBGN03208 rev.1 - HP Cloud Service Automation running SSLv3, Remote Disclosure of Information (security-alert@...com)
[CVE-2014-8340] phpTrafficA SQL injection (Daniël Geerts <dgeerts@...hef.nl>)
NEW VMSA-2014-0013 - VMware vCloud Automation Center product updates address a critical remote privilege escalation vul… (VMware Security Response Center <securi…)

December 10 (12 messages)

[security bulletin] HPSBST03106 rev.2 - HP P2000 G3 MSA Array System, HP MSA 2040/1040 Storage running OpenSSL, Remote Unauthorized Access… (security-alert@...com)
[security bulletin] HPSBMU03043 rev.1 - HP Smart Update Manager for Windows and Linux, Local Disclosure of Information (security-alert@...com)
Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities (simo@...xploit.com)
[CVE-2014-7303] SGI Tempo System Database Exposure (john.fitzpatrick@...infosecurity.com)
[CVE-2014-7302] SGI SUID Root Privilege Escalation (john.fitzpatrick@...infosecurity.com)
[CVE-2014-7301] SGI Tempo System Database Password Exposure (john.fitzpatrick@...infosecurity.com)
NEW VMSA-2014-0014 - AirWatch by VMware product update addresses information disclosure vulnerabilities (VMware Security Response Center <security@...are.com>)
FreeBSD Security Advisory FreeBSD-SA-14:27.stdio (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:28.file (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:29.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
AST-2014-019: Remote Crash Vulnerability in WebSocket Server ("Asterisk Security Team" <security@...erisk.org>)
[SECURITY] [DSA 3095-1] xorg-server security update (Moritz Muehlenhoff <jmm@...ian.org>)

December 11 (12 messages)

[SECURITY] [DSA 3096-1] pdns-recursor security update (Sebastien Delafond <seb@...ian.org>)
[slackware-security] openvpn (SSA:2014-344-04) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2014-344-06) (Slackware Security Team <security@...ckware.com>)
[slackware-security] bind (SSA:2014-344-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] pidgin (SSA:2014-344-05) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2014-344-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] wpa_supplicant (SSA:2014-344-07) (Slackware Security Team <security@...ckware.com>)
[slackware-security] openssh (SSA:2014-344-03) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 3097-1] unbound security update (Yves-Alexis Perez <corsac@...ian.org>)
[SECURITY] [DSA 3098-1] graphviz security update (Salvatore Bonaccorso <carnil@...ian.org>)
APPLE-SA-2014-12-11-1 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
ResourceSpace Multiple Cross Site Scripting, and HTML and SQL Injection Vulnerabilities (petri.iivonen@...c.gov.uk)

December 12 (6 messages)

[SECURITY] [DSA 3099-1] dbus security update (Florian Weimer <fw@...eb.enyo.de>)
Docker 1.3.3 - Security Advisory [11 Dec 2014] (Eric Windisch <eric.windisch@...ker.com>)
[security bulletin] HPSBUX03162 SSRT101767 rev.3 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Unauthorized Access, Man-in-the-… (security-alert@...com)
ESA-2014-164: EMC Isilon InsightIQ Cross-Site Scripting Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2014-163: RSA Archer® GRC Platform Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2014-173: RSA® Authentication Manager Unvalidated Redirect Vulnerability (Security Alert <Security_Alert@....com>)

December 15 (22 messages)

[ MDVSA-2014:246 ] openvpn (security@...driva.com)
[ MDVSA-2014:247 ] jasper (security@...driva.com)
[ MDVSA-2014:248 ] graphviz (security@...driva.com)
[ MDVSA-2014:249 ] qemu (security@...driva.com)
[ MDVSA-2014:250 ] cpio (security@...driva.com)
[ MDVSA-2014:251 ] rpm (security@...driva.com)
CVE-2014-2025 Remote Code Execution (RCE) in "Intrexx Professional" (Christian Schneider <mail@...istian-Schneider.net>)
CVE-2014-2026 Reflected Cross-Site Scripting (XSS) in "Intrexx Professional" (Christian Schneider <mail@...istian-Schneider.net>)
[ MDVSA-2014:245 ] mutt (security@...driva.com)
[ MDVSA-2014:244 ] openafs (security@...driva.com)
[ MDVSA-2014:243 ] phpmyadmin (security@...driva.com)
[ MDVSA-2014:239 ] flac (security@...driva.com)
[SECURITY] [DSA 3100-1] mediawiki security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3101-1] c-icap security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2014:238 ] bind (security@...driva.com)
Defense in depth -- the Microsoft way (part 23): two quotes or not to quote... ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[SECURITY] [DSA 3102-1] libyaml security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3103-1] libyaml-libyaml-perl security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2014:242 ] yaml (security@...driva.com)
Vulnerabilities in Ekahau Real-Time Location Tracking System [MZ-14-01] (modzero <security@...zero.ch>)
Persistent XSS Vulnerability in CMS Papoo Light v6.0.0 Rev. 4701 (steffen.roesemann1986@...il.com)
[ MDVSA-2014:253 ] apache-mod_wsgi (security@...driva.com)

December 16 (8 messages)

[ MDVSA-2014:252 ] nss (security@...driva.com)
CA20141215-01: Security Notice for CA LISA Release Automation ("Williams, Ken" <Ken.Williams@...com>)
[SE-2014-02] Google App Engine Java security sandbox bypasses (status update) (Security Explorations <contact@...urity-explorations.com>)
"Ettercap 8.0 - 8.1" multiple vulnerabilities ("Nick Sampanis" <n.sampanis@...ela.com>)
[Onapsis Security Advisory 2014-034] SAP Business Objects Search Token Privilege Escalation via CORBA (Onapsis Research Labs <research@...psis.com>)
W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface (Mazin Ahmed <mazen150@...mail.com>)
[SECURITY] [DSA 3104-1] bsd-mailx security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3105-1] heirloom-mailx security update (Florian Weimer <fw@...eb.enyo.de>)

December 17 (15 messages)

iWifi for Chat v1.1 iOS - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Fuzzylime v3.03b CMS - CS Cross Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Elefant CMS v1.3.9 - Persistent Name Update Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Konakart v7.3.0.1 CMS - CS Cross Site Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
RelateIQ Bug Bounty #1 - Persistent Signup Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBMU03221 rev.1 - HP Connect-IT running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBOV03225 rev.1 - HP OpenVMS running POP, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBOV03226 rev.1 - HP TCP/IP Services for OpenVMS, BIND 9 Resolver, Multiple Remote Vulnerabilities (security-alert@...com)
[security bulletin] HPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote Code Execution (security-alert@...com)
[REVIVE-SA-2014-002] Revive Adserver 3.0.6 and 3.1.0 fix multiple vulnerabilities (Matteo Beccati <php@...cati.com>)
FreeBSD Security Advisory FreeBSD-SA-14:30.unbound (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
secuvera-SA-2014-01: Reflected XSS in W3 Total Cache (Tobias Glemser <tglemser@...uvera.de>)
Cross-Site Scripting (XSS) in Revive Adserver (High-Tech Bridge Security Research <advisory@...ridge.com>)
Bird Feeder v1.2.3 WP Plugin - CSRF & XSS Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Morfy CMS v1.05 - Command Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

December 18 (5 messages)

Jease CMS v2.11 - Persistent UI Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Apple iOS v8.x - Message Context & Privacy Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Facebook Bug Bounty #16 (Studio) - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
E-Journal CMS (ID) - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
iTwitter v0.04 WP Plugin - XSS & CSRF Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

December 19 (10 messages)

SEC Consult SA-20141218-2 :: Multiple high risk vulnerabilities in NetIQ Access Manager (SEC Consult Vulnerability Lab <research@...-consult.com>)
SEC Consult SA-20141218-1 :: OS command execution vulnerability in GParted (SEC Consult Vulnerability Lab <research@...-consult.com>)
[oCERT-2014-012] JasPer input sanitization errors (Andrea Barisani <lcars@...rt.org>)
APPLE-SA-2014-12-18-1 Xcode 6.2 beta 3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
SEC Consult SA-20141219-0 :: XSS & Memory Disclosure vulnerabilities in NetIQ eDirectory NDS iMonitor (SEC Consult Vulnerability Lab <research@...-consult.com>)
iBackup v10.0.0.45 - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Mobilis MobiConnect 3G ZDServer v1.0.1.2 - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Facebook BB #18 - IDOR Issue & Privacy Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
TWiki Security Advisory - XSS Vulnerability - CVE-2014-9325 (Onur Yilmaz <onur@...sparker.com>)
TWiki Security Advisory - XSS Vulnerability - CVE-2014-9367 (Onur Yilmaz <onur@...sparker.com>)

December 22 (8 messages)

[SECURITY] [DSA 3106-1] jasper security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3107-1] subversion security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3108-1] ntp security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3107-2] subversion regression update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3109-1] firebird2.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
VP-2014-004 SysAid Server Arbitrary File Disclosure (Bernhard Mueller <bernhard@...tagepoint.sg>)
[oCERT-2014-010] SoX input sanitization errors (Andrea Barisani <lcars@...rt.org>)
[oCERT-2014-011] UnZip input sanitization errors (Andrea Barisani <lcars@...rt.org>)

December 23 (5 messages)

APPLE-SA-2014-12-22-1 OS X NTP Security Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 3111-1] cpio security update (Michael Gilbert <mgilbert@...ian.org>)
[slackware-security] ntp (SSA:2014-356-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] php (SSA:2014-356-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] xorg-server (SSA:2014-356-03) (Slackware Security Team <security@...ckware.com>)

December 24 (6 messages)

Stored XSS Vulnerability in CMS Serendipity v.2.0-rc1 (steffen.roesemann1986@...il.com)
[SECURITY] [DSA 3112-1] sox security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3110-1] mediawiki security update (Sebastien Delafond <seb@...ian.org>)
FreeBSD Security Advisory FreeBSD-SA-14:31.ntp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Cisco Security Advisory: Multiple Vulnerabilities in ntpd Affecting Cisco Products (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Reflecting XSS Vulnerability in CMS Contenido 4.9.x-4.9.5 (steffen.roesemann1986@...il.com)

December 25 (8 messages)

DRAM unreliable under specific access patern (Pavel Machek <pavel@....cz>)
Facebook Bug Bounty #17 - Migrate Privacy Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Mobilis MobiConnect 3G ZDServer 1.x - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ZTE Ucell 3G Modem App - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Pimcore v3.0 & v2.3.0 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
PHPLIST v3.0.6 & v3.0.10 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Lazarus Guestbook v1.22 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

December 29 (3 messages)

[SECURITY] [DSA 3114-1] mime-support security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3113-1] unzip security update (Salvatore Bonaccorso <carnil@...ian.org>)
nullcon HackIM Challenge 9-11 Jan 2015 (nullcon <nullcon@...lcon.net>)

December 30 (5 messages)

[SECURITY] [DSA 3115-1] pyyaml security update (Moritz Muehlenhoff <jmm@...ian.org>)
Remote Code Execution via Unauthorised File upload in Cforms 14.7 (z.fedotkin@...osec.ru)
[SECURITY] [DSA 3116-1] polarssl security update (Moritz Muehlenhoff <jmm@...ian.org>)
ESA-2014-158: RSA BSAFE® Micro Edition Suite and SSL-J Triple Handshake Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2014-179: EMC Replication Manager and EMC AppSync Unquoted Service Path Enumeration Vulnerability (Security Alert <Security_Alert@....com>)

December 31 (2 messages)

Defense in depth -- the Microsoft way (part 26): "Set Program Access and Computer Defaults" hides applications like Outl… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[The ManageOwnage Series, part X]: 0-day administrator account creation in Desktop Central (Pedro Ribeiro <pedrib@...il.com>)

178 messages

Powered by blists - more mailing lists