bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2013/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 6	² 3	³ 4	⁴ 3	⁵	⁶
⁷ 12	⁸ 3	⁹ 9	¹⁰ 8	¹¹ 3	¹²	¹³
¹⁴ 9	¹⁵ 3	¹⁶ 6	¹⁷ 6	¹⁸ 1	¹⁹	²⁰
²¹ 11	²² 10	²³ 3	²⁴ 8	²⁵ 2	²⁶	²⁷
²⁸	²⁹ 13	³⁰ 2	³¹ 7

Messages by day:

January 1 (6 messages)

Charybdis: Improper assumptions in the server handshake code may lead to a remote crash (muztapha@...il.com)
Re: CubeCart 5.0.7 and lower versions | Insecure Backup File Handling (YGN Ethical Hacker Group <lists@...g.net>)
CubeCart 5.x | Cross Site Request Forgery (CSRF) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CubeCart 5.x | Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
Re: GnuPG 1.4.12 and lower - memory access errors and keyring database corruption (Kurt Seifried <kseifried@...hat.com>)
AthCon 2013 CFP OPEN (cfp@...con.org)

January 2 (3 messages)

Re: GnuPG 1.4.12 and lower - memory access errors and keyring database corruption (Kurt Seifried <kseifried@...hat.com>)
ShakaCon 2013 - Call for Papers ("Shakacon" <info@...kacon.org>)
[ MDVSA-2013:001 ] gnupg (security@...driva.com)

January 3 (4 messages)

AST-2012-014: Crashes due to large stack allocations when using TCP ("Asterisk Security Team" <security@...erisk.org>)
AST-2012-015: Denial of Service Through Exploitation of Device State Caching ("Asterisk Security Team" <security@...erisk.org>)
Aastra IP Telephone encrypted .tuz configuration file leakage (Timo Juhani Lindfors <timo.lindfors@....fi>)
Simple Webserver 2.3-rc1 Directory Traversal (cwggenius@...il.com)

January 4 (3 messages)

CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF) ("i@...oot.com" <i@...oot.com>)
CVE-2012-6494 - Nexpose Security Console - Session Hijacking ("i@...oot.com" <i@...oot.com>)
TomatoCart 1.x | Unrestricted File Creation (YGN Ethical Hacker Group <lists@...g.net>)

January 7 (12 messages)

CFP: InfoSec Southwest 2013 (todb@...asploit.com)
[SECURITY] [DSA 2597-1] rails security update (Nico Golde <nion@...ian.org>)
[SECURITY] [DSA 2598-1] weechat security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2599-1] nss security update (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 2600-1] cups security update (Nico Golde <nion@...ian.org>)
[security bulletin] HPSBOV02833 SSRT101043 rev.1 - OpenVMS running Java on Integrity Servers, Remote Unauthorized Access, Disclosure of In… (security-alert@...com)
Chrome for Android - UXSS via com.android.browser.application_id Intent extra (mbsdtest01@...il.com)
Chrome for Android - Download Function Information Disclosure (mbsdtest01@...il.com)
Chrome for Android - Android APIs exposed to JavaScript (mbsdtest01@...il.com)
Chrome for Android - Bypassing SOP for Local Files By Symlinks (mbsdtest01@...il.com)
Chrome for Android - Cookie theft from Chrome by malicious Android app (mbsdtest01@...il.com)
Facebook for Android - Information Diclosure Vulnerability (mbsdtest01@...il.com)

January 8 (3 messages)

ESA-2013-001: EMC NetWorker Buffer Overflow vulnerability (Security Alert <Security_Alert@....com>)
[security bulletin] HPSBUX02829 SSRT100883 rev.1 - HP-UX Running X Font Server (xfs) Software, Local Denial of Service (DoS), Unauthorized… (security-alert@...com)
[SECURITY] [DSA 2602-1] zendframework security update (Florian Weimer <fw@...eb.enyo.de>)

January 9 (9 messages)

Cisco Security Advisory: Cisco Prime LAN Management Solution Command Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co…)
Cisco Security Advisory: Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability (Cisco Systems Product Security Incident Response Team …)
[ MDVSA-2013:002 ] firefox (security@...driva.com)
Cross-Site Scripting (XSS) vulnerability in Quick.Cms and Quick.Cart (advisory@...ridge.com)
Remote Buffer Overflow Vulnerability in Samsung Kies (advisory@...ridge.com)
Nero MediaHome Multiple Remote DoS Vulnerabilities (advisory@...ridge.com)
[ MDVSA-2013:003 ] rootcerts (security@...driva.com)
[SECURITY] [DSA 2603-1] emacs23 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2604-1] rails security update (Thijs Kinkhorst <thijs@...ian.org>)

January 10 (8 messages)

[slackware-security] mozilla-firefox (SSA:2013-009-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2013-009-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-thunderbird (SSA:2013-009-02) (Slackware Security Team <security@...ckware.com>)
[ MDVSA-2013:004 ] tomcat5 (security@...driva.com)
OrangeHRM 2.7.1 Vacancy Name Persistent XSS ("SBV Research" <research@...verbackventuresllc.com>)
Wordpress gallery-3.8.3 plugin Arbitrary File Read Vulnerability (Beni_vanda@...oo.com)
Detailed examples of two vulnerabilities in whitelisting software: SE46 (Cryptzone) and Application Control (McAfee) (Arne Vidström <arne.vidstrom@....se>)
DefenseCode Security Advisory (UPCOMING): Cisco Linksys Remote Preauth 0day Root Exploit (DefenseCode <defensecode@...ensecode.com>)

January 11 (3 messages)

[SE-2012-01] 'Fix' for Issue 32 exploited by new Java 0-day code (Security Explorations <contact@...urity-explorations.com>)
[security bulletin] HPSBMU02838 SSRT100789 rev.1 - HP Serviceguard on Linux, Remote Denial of Service (DoS) (security-alert@...com)
Re: Wordpress gallery-3.8.3 plugin Arbitrary File Read Vulnerability (Henri Salo <henri@...v.fi>)

January 14 (9 messages)

Arbitrary File Upload and Code Execution in Accusoft Prizm Content Connect (Include Security Research <research@...ludesecurity.com>)
[SECURITY] [DSA 2606-1] proftpd-dfsg security update (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 2605-1] asterisk security update (Thijs Kinkhorst <thijs@...ian.org>)
CVE-2012-5641 Apache CouchDB Information disclosure via unescaped backslashes in URLs on Windows (Jan Lehnardt <jan@...che.org>)
CVE-2012-5650 Apache CouchDB DOM based Cross-Site Scripting via Futon UI (Jan Lehnardt <jan@...che.org>)
CVE-2012-5649 Apache CouchDB JSONP arbitrary code execution with Adobe Flash (Jan Lehnardt <jan@...che.org>)
Updated - CA20121018-01: Security Notice for CA ARCserve Backup ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[IA33] Serva v2.0.0 DNS Server Remote Denial of Service (Inshell Security <info@...hell.net>)
[IA34] Serva v2.0.0 HTTP Server GET Remote Denial of Service (Inshell Security <info@...hell.net>)

January 15 (3 messages)

[SECURITY] [DSA 2607-1] qemu-kvm security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 2608-1] qemu security update (Florian Weimer <fw@...eb.enyo.de>)
Trimble® Infrastructure GNSS Series Receivers Cross Site Scripting (XSS) vulnerability ("Rustein, Fara Denise \(LATCO - Buenos Aires\)" <frustein@...OITTE.com>)

January 16 (6 messages)

[slackware-security] freetype (SSA:2013-015-01) (Slackware Security Team <security@...ckware.com>)
Re: Wordpress gallery-3.8.3 plugin Arbitrary File Read Vulnerability (Paolo Perego <thesp0nge@...il.com>)
Re: [CVE-ID REQUEST] Atlassian Confluence - Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities (rgilbert@...ock.com)
Re: [CVE-ID REQUEST] vBulletin - Multiple Open Redirects (rgilbert@...ock.com)
Cisco Security Advisory: Cisco ASA 1000V Cloud Firewall H.323 Inspection Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team …)
DC4420 - 2013 CFP (Major Malfunction <majormal@...ate-radio.org>)

January 17 (6 messages)

[SECURITY] [DSA 2609-1] rails security update (Florian Weimer <fw@...eb.enyo.de>)
Cisco Security Advisory Update v1.1: Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability (Cisco Systems Product Security Incident Re…)
Secunia Research: Oracle Outside In Technology Paradox Database Handling Denial of Service (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Oracle Outside In Technology Paradox Database Handling Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
NSOADV-2013-001: DELL SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass (/appliance/) (NSO Research <nso-research@...iriu.de>)
NSOADV-2013-002: DELL SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass (/sgms/) (NSO Research <nso-research@...iriu.de>)

January 18 (1 message)

CVE-2012-6452 Axway Secure Messenger Username Disclosure (jason.doyle@...hnetsecurity.com)

January 21 (11 messages)

Recently-revised IETF I-Ds about IPv6 security (Fernando Gont <fgont@...networks.com>)
[SE-2012-01] Java 7 Update 11 confirmed to be vulnerable (Security Explorations <contact@...urity-explorations.com>)
ESA-2013-008: EMC AlphaStor Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
CA20121220-01: Security Notice for CA IdentityMinder [updated] ("Williams, James K" <James.Williams@...com>)
[SECURITY] [DSA 2605-2] asterisk regression update (Thijs Kinkhorst <thijs@...ian.org>)
Mozilla Firefox and Microsoft Internet Explorer stall when using workaround from MS06-020 or MS06-069 ("Stefan Kanthak" <stefan.kanthak@...go.de>)
NoSuchCon CFP / 15-17 May 2013 / Paris, France (Jonathan Brossard <endrazine@...il.com>)
(AUSCERT#20131775e) AusCERT 2013 Call For Presentations - closing in 10 days (auto-bulletins@...cert.org.au)
Multiple Vulnerabilities in Linksys WRT54GL (devnull@...ur1ty.de)
Re: EMC Avamar: World writable cache files (security_alert@....com)
Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin (marcelavbx@...il.com)

January 22 (10 messages)

[SECURITY] [DSA 2610-1] ganglia security update (Yves-Alexis Perez <corsac@...ian.org>)
[HITB-Announce] REMINDER: #HITB2013AMS Call for Papers Closes 8th Feb (Hafez Kamal <aphesz@...kinthebox.org>)
[SECURITY] [DSA 2611-1] movabletype-opensource security update (Yves-Alexis Perez <corsac@...ian.org>)
Looking for security contacts (DefenseCode <defensecode@...ensecode.com>)
Wordpress Developer Formatter CSRF Vulnerability (illSecResearchGroup@...il.com)
SEC Consult SA-20130122-0 :: F5 BIG-IP XML External Entity Injection vulnerability (SEC Consult Vulnerability Lab <research@...-consult.com>)
SEC Consult SA-20130122-1 :: F5 BIG-IP SQL injection vulnerability (SEC Consult Vulnerability Lab <research@...-consult.com>)
CVE-2013-1402 - DigiLIBE Management Console - Execution After Redirect (EAR) Vulnerability (i@...oot.com)
Wordpress Valums Uploader - File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable (Security Explorations <contact@...urity-explorations.com>)

January 23 (3 messages)

[security bulletin] HPSBMU02841 SSRT100724 rev.1 - HP Diagnostics Server, Remote Execution of Arbitrary Code (security-alert@...com)
[slackware-security] mysql (SSA:2013-022-01) (Slackware Security Team <security@...ckware.com>)
DC4420 - London DEFCON - January 2013 meet. Tuesday 29th January 2013 (Major Malfunction <majormal@...ate-radio.org>)

January 24 (8 messages)

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless LAN Controllers (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
CVE ID Syntax Change - Call for Public Feedback (cve-id-change@...re.org)
CVE-2013-0805 / CSNC-2013-001 (stephan.rickauer@...c.ch)
Cross-Site Scripting (XSS) vulnerability in gpEasy (advisory@...ridge.com)
SQL Injection Vulnerability in ImageCMS (advisory@...ridge.com)
New Blog Post: Attacking the Windows 7/8 Address Space Randomization (king cope <isowarez.isowarez.isowarez@...glemail.com>)
IPv6: How to avoid security issues with VPN leaks on dual-stack networks (Fernando Gont <fgont@...networks.com>)
SEC Consult SA-20130124-0 :: Critical SSH Backdoor in multiple Barracuda Networks Products (SEC Consult Vulnerability Lab <research@...-consult.com>)

January 25 (2 messages)

[SECURITY] [DSA 2612-1] ircd-ratbox security update (Moritz Muehlenhoff <jmm@...ian.org>)
WordPress SolveMedia 1.1.0 CSRF Vulnerability (illSecResearchGroup@...il.com)

January 29 (13 messages)

[SE-2012-01] An issue with new Java SE 7 security features (Security Explorations <contact@...urity-explorations.com>)
[ MDVSA-2013:005 ] perl (security@...driva.com)
nCircle PureCloud Vulnerability Scanner - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Fortinet FortiMail 400 IBE - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
ESA-2013-010: EMC AlphaStor Buffer Overflow Vulnerability (Security Alert <Security_Alert@....com>)
Kohana Framework v2.3.3 - Directory Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[KIS-2013-01] DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
APPLE-SA-2013-01-28-1 iOS 6.1 Software Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2013-01-28-2 Apple TV 5.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Unauthenticated remote access to D-Link DCS cameras (roberto@...yhats.it)
XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget") (Moritz Naumann <security@...itz-naumann.com>)
Adobe Reader XI versions are vulnerable to a heap overflow (n1s0o@...il.com)
Re: Wordpress Valums Uploader - File Upload Vulnerability (fineuploader@...stasio.com)

January 30 (2 messages)

Cisco Security Advisory: Portable SDK for UPnP Devices Contains Buffer Overflow Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@ci…)
[SECURITY] [DSA 2613-1] rails security update (Thijs Kinkhorst <thijs@...ian.org>)

January 31 (7 messages)

Buffalo TeraStation TS-Series multiple vulnerabilities (Andrea Fabrizi <andrea.fabrizi@...il.com>)
CFP Observe. Hack. Make. (Walter Belgers <walter+bugtraq@...gers.com>)
OWASP Zed Attack Proxy 2.0.0 (psiinon <psiinon@...il.com>)
marc4dasm - Atmel MARC microprocessor disassembler published (Adam Laurie <adam@...roup.co.uk>)
[security bulletin] HPSBST02839 SSRT101077 rev.1 - HP XP P9000 Command View Advanced Edition, Remote Denial of Service (DoS) (security-alert@...com)
DefenseCode Security Advisory: Broadcom UPnP Remote Preauth Root Code Execution Vulnerability (DefenseCode <defensecode@...ensecode.com>)
Released: rompar - Semi-automation tool for data extraction of microscopic Masked ROM images (Major Malfunction <majormal@...ate-radio.org>)

132 messages