bugtraq mailing list - 2013/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2013/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 11	³ 3	⁴ 3	⁵	⁶ 1	⁷	⁸
⁹ 16	¹⁰ 9	¹¹ 7	¹² 5	¹³ 12	¹⁴	¹⁵
¹⁶ 18	¹⁷ 15	¹⁸ 18	¹⁹ 2	²⁰	²¹	²²
²³ 17	²⁴ 3	²⁵	²⁶ 4	²⁷ 1	²⁸	²⁹
³⁰ 3	³¹ 2

Messages by day:

December 2 (11 messages)

[security bulletin] HPSBGN02942 rev.2 - HP Service Manager and ServiceCenter, Remote Code Execution (security-alert@...com)
[SECURITY] [DSA 2807-1] links2 security update (Moritz Muehlenhoff <jmm@...ian.org>)
WorldCIST'14 - Submission deadline: December 7 ("WorldCIST" <marialemos72@...il.com>)
[Full-disclosure] [ANN] Struts 2.3.15.3 GA release available - security fix (Lukasz Lenart <lukaszlenart@...che.org>)
[Full-disclosure] [CVE-2013-4295] Apache Shindig information disclosure vulnerability (Ryan Baxter <rbaxter85@...che.org>)
[Full-disclosure] NEW VMSA-2013-0012 VMware vSphere updates address multiple vulnerabilities ("\"VMware Security Response Center\"" <security@...are.com>)
[Full-disclosure] [CVE-2013-5702] Watchguard Server Center v11.7.4 Multiple Non-Persistent Cross-Site Scripting Vulnerabil… (Julien Ahrens <info@...security.com>)
[Full-disclosure] CORE-2013-0704 - Vivotek IP Cameras RTSP Authentication Bypass (CORE Advisories Team <advisories@...esecurity.com>)
Photo Transfer Wifi 1.4.4 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 13): surprising and inconsistent behaviour, sloppy co… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[Full-disclosure] Defense in depth -- the Microsoft way (part 13): surprising and inconsistent behaviour, sloppy coding… ("Stefan Kanthak" <stefan.kanthak@...go.…)

December 3 (3 messages)

D-Link DIR-XXX remote root access exploit. ("ScripT setInterval\(function\(\){for\( \){alert\('fixme'\)} } 10\) /scRIpt" <tytusromekiatomek@...ox.com>)
Multiple issues in OpenSSL - BN (multiprecision integer arithmetics). ("ScripT setInterval\(function\(\){for\( \){alert\('fixme'\)} } 10\) /scRIpt" <tytusrome…)
[SECURITY] [DSA 2808-1] openjpeg security update (Raphael Geissert <geissert@...ian.org>)

December 4 (3 messages)

bugs in IJG jpeg6b & libjpeg-turbo (Michal Zalewski <lcamtuf@...edump.cx>)
NEW VMSA-2013-0014 VMware Workstation, Fusion, ESXi and ESX patches address a guest privilege escalation ("\"VMware Security Response Center\"" <security@...ar…)
[PT-2013-63] Hash Length Extension in HTMLPurifier (noreply@...ecurity.com)

December 6 (1 message)

Cross-Site Scripting (XSS) in Jamroom (High-Tech Bridge Security Research <advisory@...ridge.com>)

December 9 (16 messages)

Imagam iFiles v1.16.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2809-1] ruby1.8 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2810-1] ruby1.9.1 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability (0Day) (Vulnerability Lab <research@...nerability-lab.com>)
Wireless Transfer App 3.7 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[KIS-2013-10] openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
NEW VMSA-2013-0015 VMware ESX updates to third party libraries (Edward Hawkins <security@...are.com>)
[slackware-security] mozilla-nss (SSA:2013-339-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-thunderbird (SSA:2013-339-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2013-339-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] hplip (SSA:2013-339-04) (Slackware Security Team <security@...ckware.com>)
Opencart Multiple Vulnerabilities (trueend5@...oo.com)
[SECURITY] [DSA 2811-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
LiveZilla 5.1.0.0 Reflected XSS in translations (zoczus@...il.com)
Print n Share v5.5 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
ESA-2013-080: RSA Security Analytics Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)

December 10 (9 messages)

[SECURITY] [DSA 2812-1] samba security update (Moritz Muehlenhoff <jmm@...ian.org>)
Vulnerabilities in Apache Solr < 4.6.0 (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
[SECURITY] [DSA 2814-1] varnish security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2813-1] gimp security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2815-1] munin security update (Salvatore Bonaccorso <carnil@...ian.org>)
[CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application (Daniel Wood <daniel.wood@...sp.org>)
EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet Remote Code Execution (nospam@...il.it)
Air Gallery 1.0 Air Photo Browser - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
LiveZilla 5.1.1.0 Stored XSS in operator clients (zoczus@...il.com)

December 11 (7 messages)

[security bulletin] HPSBUX02943 rev.1 - HP-UX Running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilit… (security-alert@...com)
[security bulletin] HPSBUX02944 rev.1 - HP-UX Running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilit… (security-alert@...com)
CORE-2013-1107 - IcoFX Buffer Overflow Vulnerability (CORE Advisories Team <advisories@...esecurity.com>)
[security bulletin] HPSBPI02945 rev.1 - HP Officejet Pro 8500 (A909) All-in-One Printer, Cross-Site Scripting (XSS) (security-alert@...com)
Android Fragment Injection vulnerability (Roee Hay <roeeh@...ibm.com>)
SQL Injection in InstantCMS (High-Tech Bridge Security Research <advisory@...ridge.com>)
Photo Video Album Transfer 1.0 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

December 12 (5 messages)

FlashCanvas 1.5 proxy.php XSS Vulnerability (code@...ements.co.uk)
[SOJOBO-ADV-13-05] - Vtiger 5.4.0 Reflected Cross Site Scripting (advisories@...omio.com)
ESA-2013-089: EMC Connectrix Manager Converged Network Edition Remote Code Execution Vulnerabilities (Security Alert <Security_Alert@....com>)
CORE-2013-0807 - Divide Error in Windows Kernel (CORE Advisories Team <advisories@...esecurity.com>)
Re: CORE-2013-0807 - Divide Error in Windows Kernel (CORE Advisories Team <advisories@...esecurity.com>)

December 13 (12 messages)

[CVE-2013-5112] Evernote Android Insecure Storage of PIN data / Bypass of PIN protection (mailing lists <lists@....cc>)
[CVE-2013-5116] Evernote Android Insecure Password Change (one-click setup) (mailing lists <lists@....cc>)
SAMSPADE 1.14 BUFFER OVERFLOW (vishal_mishra@...e.com)
Microsoft PhotoStory - CS Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Microsoft Yammer - Persistent Profile Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2816-1] php5 security update (Thijs Kinkhorst <thijs@...ian.org>)
[security bulletin] HPSBGN02952 rev.1 - HP Application Lifecycle Manager (ALM) Running JBoss Application Server, Remote Code Execution (security-alert@...com)
[security bulletin] HPSBGN02951 rev.1 - HP Operations Orchestration, Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) (security-alert@...com)
[security bulletin] HPSBMU02872 rev.4 - HP Service Manager Web Tier, Remote Disclosure of Information, Cross Site Scripting (XSS) (security-alert@...com)
[security bulletin] HPSBMU02874 rev.3 - HP Service Manager and ServiceCenter, Java Runtime Environment (JRE) Security Update (security-alert@...com)
[security bulletin] HPSBMU02931 rev.3 - HP Service Manager and ServiceCenter, Injection of Arbitrary Code, Remote Privilege Elevation, Rem… (security-alert@...com)

December 16 (18 messages)

Microsoft Online, Office & Cloud - Persistent Encoding Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
DC4420 - DefCon London: Christmas Social (= no talks), Tuesday 17th December 2013 (Tony Naggs <tonynaggs@...il.com>)
Advisory 01/2013: PHP openssl_x509_parse() Memory Corruption Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
Call for Papers -YSTS 8 - Information Security Conference, Brazil (Luiz Eduardo <le@...s.org>)
Last Call - 2sd World Conference on IST; Submission: December 29 ("WorldCIST" <marialemos72@...il.com>)
[SECURITY] [DSA 2817-1] libtar security update (Luciano Bello <luciano@...ian.org>)
LiveZilla 5.1.2.0 Multiple Stored XSS in webbased operator client (zoczus@...il.com)
LiveZilla 5.1.2.0 Insecure password storage (zoczus@...il.com)
Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line ("Larry W. Cashdollar" <larry0@...com>)
Command injection vulnerability in Ruby Gem sprout 0.7.246 ("Larry W. Cashdollar" <larry0@...com>)
LiveZilla 5.1.2.0 PHP Object Injection (zoczus@...il.com)
Command injection in Ruby Gem Webbynode 1.0.5.3 ("Larry W. Cashdollar" <larry0@...com>)
Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
User Identity Spoofing in Bitrix Site Manager (High-Tech Bridge Security Research <advisory@...ridge.com>)
[SECURITY] [DSA 2818-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBHF02953 rev.1 - HP B-series SAN Network Advisor, Remote Code Execution (security-alert@...com)
[SECURITY] [DSA 2819-1] End-of-life announcement for iceape (Moritz Muehlenhoff <jmm@...ian.org>)
XSS and Full Path Disclosure in MijoSearch Joomla Extension (High-Tech Bridge Security Research <advisory@...ridge.com>)

December 17 (15 messages)

APPLE-SA-2013-12-16-2 OS X Mavericks v10.9.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
AST-2013-006: Buffer Overflow when receiving odd length 16 bit SMS message ("Asterisk Security Team" <security@...erisk.org>)
AST-2013-007: Asterisk Manager User Dialplan Permission Escalation ("Asterisk Security Team" <security@...erisk.org>)
QuickHeal AntiVirus 7.0.0.1 - Stack Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[slackware-security] mozilla-firefox (SSA:2013-350-04) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 2820-1] nspr security update (Raphael Geissert <geissert@...ian.org>)
[slackware-security] libiodbc (SSA:2013-350-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-thunderbird (SSA:2013-350-05) (Slackware Security Team <security@...ckware.com>)
[slackware-security] llvm (SSA:2013-350-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] libjpeg (SSA:2013-350-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] ruby (SSA:2013-350-06) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2013-350-07) (Slackware Security Team <security@...ckware.com>)
Hancom Office '.hml' file heap-based buffer overflow (diroverflow@...il.com)

December 18 (18 messages)

[ MDVSA-2013:287-1 ] drupal (security@...driva.com)
[ MDVSA-2013:288 ] subversion (security@...driva.com)
InfoSec Southwest 2014 CFP now open! (ISSW CFP <cfp@...osecsouthwest.com>)
CORE-2013-0903 - RealPlayer Heap-based Buffer Overflow Vulnerability (CORE Advisories Team <advisories@...esecurity.com>)
[CVE-2013-5573] Jenkins v1.523 Default markup formatter permits offsite-bound forms (Christian Catalano <ch.catalano@...il.com>)
[CVE-2013-5676] Plain Text Password In SonarQube Jenkins Plugin (Christian Catalano <ch.catalano@...il.com>)
[CVE-2013-2764] Secure Entry Server - URL Redirection ("Alexandre Herzog" <alexandre.herzog@...c.ch>)
[CVE-2013-2627, CVE-2013-2628, CVE-2013-2629] Leed (Light Feed) - Multiple vulnerabilities ("Alexandre Herzog" <alexandre.herzog@...c.ch>)
[ MDVSA-2013:291 ] kernel (security@...driva.com)
[ MDVSA-2013:290 ] mediawiki (security@...driva.com)
[ MDVSA-2013:289 ] owncloud (security@...driva.com)
[ MDVSA-2013:291 ] kernel (security@...driva.com)
[ MDVSA-2013:292 ] links (security@...driva.com)
[ MDVSA-2013:293 ] gimp (security@...driva.com)
[ MDVSA-2013:294 ] gimp (security@...driva.com)
[SECURITY] [DSA 2821-1] gnupg security update (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 2823-1] pixman security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2822-1] xorg-server security update (Moritz Muehlenhoff <jmm@...ian.org>)

December 19 (2 messages)

APPLE-SA-2013-12-19-1 Motion 5.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
ESA-2013-079: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities (Security Alert <Security_Alert@....com>)

December 23 (17 messages)

[security bulletin] HPSBGN02950 rev.1 - HP Autonomy Ultraseek, Cross-Site Scripting (XSS) (security-alert@...com)
[ MDVSA-2013:295 ] gnupg (security@...driva.com)
[SECURITY] [DSA 2824-1] curl security update (Salvatore Bonaccorso <carnil@...ian.org>)
Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[REVIVE-SA-2013-001] Revive Adserver 3.0.2 fixes SQL injection vulnerability (Matteo Beccati <php@...cati.com>)
[ MDVSA-2013:296 ] wireshark (security@...driva.com)
[ MDVSA-2013:297 ] munin (security@...driva.com)
[SECURITY] [DSA 2825-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2013:298 ] php (security@...driva.com)
[slackware-security] gnupg (SSA:2013-354-01) (Slackware Security Team <security@...ckware.com>)
[ MDVSA-2013:299 ] samba (security@...driva.com)
[SECURITY] [DSA 2826-1] denyhosts security update (Yves-Alexis Perez <corsac@...ian.org>)
NEW VMSA-2013-0016 VMware ESXi and ESX unauthorized file access through vCenter Server and ESX ("\"VMware Security Response Center\"" <security@...are.com>)
ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability (Security Alert <Security_Alert@....com>)
[ MDVSA-2013:300 ] asterisk (security@...driva.com)
Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2013:301 ] nss (security@...driva.com)

December 24 (3 messages)

[SECURITY] [DSA 2827-1] libcommons-fileupload-java security update (Salvatore Bonaccorso <carnil@...ian.org>)
ESA-2013-092: EMC Replication Manager Unquoted File Path Enumeration Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2013-091: EMC Watch4net Information Disclosure Vulnerability (Security Alert <Security_Alert@....com>)

December 26 (4 messages)

[ MDVSA-2013:302 ] pixman (security@...driva.com)
Cross-Site Scripting (XSS) in WP-Cron Dashboard Wordpress plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)
Сross-Site Request Forgery (CSRF) in AskApache Firefox Adsense Wordpress plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)
Cross-Site Scripting (XSS) in Ad-minister Wordpress plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)

December 27 (1 message)

SEC Consult SA-20131227-0 :: IBM Web Content Manager (WCM) XPath Injection (SEC Consult Vulnerability Lab <research@...-consult.com>)

December 30 (3 messages)

[SECURITY] [DSA 2828-1] drupal6 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2829-1] hplip security update (Moritz Muehlenhoff <jmm@...ian.org>)
CALL FOR PAPERS - Hackers 2 Hackers Conference 11th edition ("Rodrigo Rubira Branco \(BSDaemon\)" <rodrigo@...nelhacking.com>)

December 31 (2 messages)

[security bulletin] HPSBMU02959 rev.1 - HP Service Manager WebTier and Windows Client, Cross-Site Scripting (XSS), Execution of Arbitrary … (security-alert@...com)
[SECURITY] [DSA 2830-1] ruby-i18n security update (Florian Weimer <fw@...eb.enyo.de>)

150 messages

Powered by blists - more mailing lists