bugtraq mailing list - 2014/02

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 4	⁴ 1	⁵ 1	⁶ 13	⁷ 3	⁸	⁹
¹⁰ 11	¹¹ 5	¹²	¹³ 16	¹⁴ 6	¹⁵	¹⁶
¹⁷ 21	¹⁸ 2	¹⁹ 5	²⁰ 17	²¹ 8	²²	²³
²⁴ 16	²⁵ 8	²⁶ 10	²⁷ 5	²⁸ 3

Messages by day:

February 3 (4 messages)

[SECURITY] [DSA 2850-1] libyaml security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2014-1213 - Denial of Service in Sophos Anti Virus ("advisories" <advisories@...tcullis-security.com>)
[SECURITY] [DSA 2851-1] drupal6 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Security advisory, LedgerSMB 1.3.0-1.3.36 (Chris Travers <chris@...atrontech.com>)

February 4 (1 message)

[slackware-security] pidgin (SSA:2014-034-01) (Slackware Security Team <security@...ckware.com>)

February 5 (1 message)

Security Advisory: NETGEAR Router D6300B Firmware: V1.0.0.14_1.0.14 (marcel.mangold@...s.de)

February 6 (13 messages)

ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability (Security Alert <Security_Alert@....com>)
Multiple SQL Injection Vulnerabilities in AuraCMS (High-Tech Bridge Security Research <advisory@...ridge.com>)
SQL Injection in doorGets CMS (High-Tech Bridge Security Research <advisory@...ridge.com>)
[SECURITY] [DSA 2853-1] horde3 security update (Luciano Bello <luciano@...ian.org>)
Inteno DG301 Command Injection (post@...ripto.no)
[ISecAuditors Security Advisories] Multiple reflected XSS vulnerabilities in Atmail WebMail (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[SECURITY] [DSA 2855-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS (Mark Thomas <markt@...che.org>)
German Telekom Bug Bounty #9 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
CVE-2014-1214 - Remote Code Execution in Projoom NovaSFH Plugin ("advisories" <advisories@...tcullis-security.com>)
German Telekom Bug Bounty #10 - Arbitrary File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
German Telekom Bug Bounty #11 - Remote SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
AlienVault OSSIM SQL Injection vulnerability (jakx.ppr@...il.com)

February 7 (3 messages)

CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability (CORE Advisories Team <advisories@...esecurity.com>)
[SECURITY] [DSA 2852-1] libgadu security update (Florian Weimer <fw@...eb.enyo.de>)
Information on recently-fixed Oracle VM VirtualBox vulnerabilities (Matthew Daley <mattd@...fuzz.com>)

February 10 (11 messages)

gpEasy v4.3.x CMS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Facebook Bug Bounty #12 - Client Side Exception Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
WHMCS Denial of Service Vulnerability (iedb.team@...il.com)
[SECURITY] [DSA 2856-1] libcommons-fileupload-java security update (Florian Weimer <fw@...eb.enyo.de>)
[oCERT-2014-001] MantisBT input sanitization errors (Andrea Barisani <lcars@...rt.org>)
[SECURITY] [DSA 2857-1] libspring-java security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] mozilla-firefox (SSA:2014-039-01) (Slackware Security Team <security@...ckware.com>)
#CONFidence 2014- Call for Papers, only 0111 days left to become CONFidence ninja (Andrzej Targosz <andrzej.targosz@...idea.org.pl>)
[slackware-security] seamonkey (SSA:2014-039-03) (Slackware Security Team <security@...ckware.com>)
ASUS AiCloud Enabled Routers 12 Models - Authentication bypass and Sensitive file/path disclosure (kyle Lovett <krlovett@...il.com>)
[slackware-security] mozilla-thunderbird (SSA:2014-039-02) (Slackware Security Team <security@...ckware.com>)

February 11 (5 messages)

Phpbb Forum Denial of Service Vulnerability (iedb.team@...il.com)
Open-Xchange Security Advisory 2014-02-10 (Martin Braun <martin.braun@...n-xchange.com>)
[SECURITY] [DSA 2858-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2859-1] pidgin security update (Moritz Muehlenhoff <jmm@...ian.org>)
[mwrlabs advisory][CVE-2014-0748] Cray Aprun/Apinit Privilege Escalation (john.fitzpatrick@...infosecurity.com)

February 13 (16 messages)

Wordpress all_in_one_carousel Plugin /XSS/CSRF/ Vuln (iedb.team@...il.com)
WiFi Camera Roll v1.2 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2014:025 ] pidgin (security@...driva.com)
[SECURITY] [DSA 2860-1] parcimonie security update (Salvatore Bonaccorso <carnil@...ian.org>)
[CVE-2014-1903] FreePBX 2.9 through 12 RCE (rob.thomas@...moozecom.com)
[SECURITY] [DSA 2850-2] libyaml regression update (Salvatore Bonaccorso <carnil@...ian.org>)
jDisk (stickto) v2.0.3 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2014:026 ] openldap (security@...driva.com)
Mybb All Version Denial of Service Vulnerability (iedb.team@...il.com)
APPLE-SA-2014-02-11-1 Boot Camp 5.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
ASUS RT Series Routers FTP Service - Default anonymous access (kyle Lovett <krlovett@...il.com>)
[ MDVSA-2014:027 ] php (security@...driva.com)
Re: ASUS RT Series Routers FTP Service - Default anonymous access (kyle Lovett <krlovett@...il.com>)
Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability (Pietro Oliva <pietroliva@...il.com>)
Wordpress plugin Buddypress <= 1.9.1 privilege escalation vulnerability (Pietro Oliva <pietroliva@...il.com>)
[ISecAuditors Security Advisories] - Reflected XSS vulnerability in Boxcryptor (www.boxcryptor.com) (ISecAuditors Security Advisories <advisories@...cauditors.…)

February 14 (6 messages)

Critical security flaws in Nagios NRPE client/server crypto (Aaron Zauner <azet@...t.org>)
RE: CVE-2014-1219 - Unauthenticated Privilege Escalation in CA 2E Web Option ("Williams, James K" <Ken.Williams@...com>)
[ MDVSA-2014:028 ] mariadb (security@...driva.com)
[slackware-security] ntp (SSA:2014-044-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] curl (SSA:2014-044-01) (Slackware Security Team <security@...ckware.com>)
[ MDVSA-2014:029 ] mysql (security@...driva.com)

February 17 (21 messages)

ESA-2014-009: RSA BSAFE® SSL-J Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
[ MDVSA-2014:034 ] yaml (security@...driva.com)
[ MDVSA-2014:031 ] drupal (security@...driva.com)
[ MDVSA-2014:033 ] socat (security@...driva.com)
[ MDVSA-2014:032 ] flite (security@...driva.com)
CISTI'2014: List of Workshops ("ML" <marialemos72@...il.com>)
[SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection (no-reply@...ureworks.com)
phpMyBackupPro-2.4 Cross-Site Scripting vulnerability (iedb.team@...il.com)
Full Disclosure - Linksys EA2700, EA3500, E4200 and EA4500 - Authentication Bypass to Administrative Console (kyle Lovett <krlovett@...il.com>)
Office Assistant Pro v2.2.2 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
mbDriveHD v1.0.7 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
File Hub v1.9.1 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2861-1] file security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2862-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE (Ronen Z <ronen@...ji.com>)
My PDF Creator & DE DM v1.4 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2014:035 ] libpng (security@...driva.com)
[ MDVSA-2014:036 ] varnish (security@...driva.com)
Recon 2014 Call For Papers - June 27-29, 2014 - Montreal, Quebec (cfp2014@...on.cx)
[ MDVSA-2014:037 ] ffmpeg (security@...driva.com)
[ MDVSA-2014:038 ] kernel (security@...driva.com)

February 18 (2 messages)

Re: [Full-disclosure] CVE-2013-1643 - Unauthorised Access To Other Users Email Messages in Symantec PGP Universal Web Messenger (Tim Brown <tmb@...35.com>)
SEC Consult SA-20140218-0 :: Multiple critical vulnerabilities in Symantec Endpoint Protection (SEC Consult Vulnerability Lab <research@...-consult.com>)

February 19 (5 messages)

[ MDVSA-2014:040 ] puppet (security@...driva.com)
CVE-2014-1215 - Local Code Execution in CoreFTP Core FTP Server (Portcullis Advisories <advisories@...tcullis-security.com>)
[SECURITY] [DSA 2863-1] libtar security update (Luciano Bello <luciano@...ian.org>)
[ MDVSA-2014:039 ] libgadu (security@...driva.com)
CA20140218-01: Security Notice for CA 2E Web Option ("Williams, James K" <Ken.Williams@...com>)

February 20 (17 messages)

[ MDVSA-2014:041 ] python (security@...driva.com)
[ MDVSA-2014:043 ] gnutls (security@...driva.com)
[ MDVSA-2014:042 ] tomcat6 (security@...driva.com)
Barracuda Message Archiver 650 - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Cisco Security Advisory: Cisco UCS Director Default Credentials Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Firewall Services Module Cut-Through Proxy Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team…)
Cisco Security Advisory: Unauthorized Access Vulnerability in Cisco Unified SIP Phone 3905 (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco IPS Software (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Post Exploitation - Getting username and password in the Lotus Sametime 8.5.1 (adrianomarciomonteiro@...il.com)
[ MDVSA-2014:044 ] zarafa (security@...driva.com)
VideoCharge Studio v2.12.3.685 cc.dll CHTTPResponse::GetHttpResponse() Buffer Overflow Remote Code Execution (Julien Ahrens <info@...security.com>)
[HITB-Announce] Haxpo CFP (Hafez Kamal <aphesz@...kinthebox.org>)
[slackware-security] kernel (SSA:2014-050-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mariadb, mysql (SSA:2014-050-02) (Slackware Security Team <security@...ckware.com>)
SQL Injection in AdRotate (High-Tech Bridge Security Research <advisory@...ridge.com>)
[ MDVSA-2014:045 ] libtar (security@...driva.com)
Android & iOS Hands-on Exploitation at SyScan 2014 (xys3c team <security@...ec.com>)

February 21 (8 messages)

[SECURITY] [DSA 2864-1] postgresql-8.4 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[CVE-2014-2035] XSS in InterWorx Web Control Panel <= 5.0.12 (Eric Flokstra <erp.flokstra@...il.com>)
[slackware-security] gnutls (SSA:2014-050-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 2865-1] postgresql-9.1 security update (Moritz Muehlenhoff <jmm@...ian.org>)
ASUS router drive-by code execution via XSS and authentication bypass (buqtraq@...er.fi)
Barracuda Bug Bounty #36 Firewall - Client Side Exception Handling Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2014:046 ] phpmyadmin (security@...driva.com)
CNNVD Gov CN #1 - Filter Bypass & Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

February 24 (16 messages)

[ MDVSA-2014:047 ] postgresql (security@...driva.com)
44CON 2014 September 11th - 12th CFP Open (Steve <steve@...on.com>)
CVE-2014-1223 - Cross-site Scripting in Telligent Evolution (Portcullis Advisories <advisories@...tcullis-security.com>)
APPLE-SA-2014-02-21-1 iOS 6.1.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-02-21-2 iOS 7.0.6 (Mihaela Popescu-Stanesti <maru@...le.com>)
APPLE-SA-2014-02-21-3 Apple TV 6.0.2 (Mihaela Popescu-Stanesti <maru@...le.com>)
APPLE-SA-2014-02-21-2 iOS 7.0.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-02-21-1 iOS 6.1.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-02-21-3 Apple TV 6.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
DC4420 - London DEFCON - meeting Tuesday, 25th February 2014 (Major Malfunction <majormal@...ate-radio.org>)
[SECURITY] [DSA 2866-1] gnutls26 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[CISTI'2014]: Iberian Conference on IST; Barcelona; Deadline: February 28 ("ML" <marialemos72@...il.com>)
[SECURITY] [DSA 2867-1] otrs2 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Barracuda Networks Bug Bounty #35 - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
WiFiles HD v1.3 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBMU02964 rev.1 - HP Service Manager, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Remote Denial o… (security-alert@...com)

February 25 (8 messages)

[security bulletin] HPSBST02937 rev.1 - HP StoreVirtual 4000 and StoreVirtual VSA Software dbd_manager, Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMU02971 rev.1 - HP Application Information Optimizer, Remote Execution of Code, Information Disclosure (security-alert@...com)
[SECURITY] CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2013-4322 Incomplete fix for CVE-2012-3544 (Denial of Service) (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2013-4590 Information disclosure via XXE when running untrusted web applications (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information disclosure) (Mark Thomas <markt@...che.org>)
Barracuda Networks Firewall Bug Bounty #32 - Filter Bypass & Persistent Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[RT-SA-2014-001] McAfee ePolicy Orchestrator: XML External Entity Expansion in Dashboard (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

February 26 (10 messages)

APPLE-SA-2014-02-25-1 OS X Mavericks 10.9.2 and Security Update 2014-001 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-02-25-2 Safari 6.1.2 and Safari 7.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBPI02869 SSRT100936 rev.3 - HP LaserJet MFP Printers, HP Color LaserJet MFP Printers, Certain HP LaserJet Printers,… (security-alert@...com)
[security bulletin] HPSBMU02966 rev.1 - HP Operations Orchestration, Unauthorized Access to Information (security-alert@...com)
[security bulletin] HPSBST02955 rev.1 - HP XP P9000 Performance Advisor Software, 3rd party Software Security - Apache Tomcat and Oracle U… (security-alert@...com)
APPLE-SA-2014-02-25-3 QuickTime 7.7.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Authentication-Bypass in CosmoShop ePRO V10.17.00 (and lower, maybe higher) (innate@....de)
Persistent XSS in Media File Renamer V1.7.0 wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
Barracuda Networks Bug Bounty #31 Firewall - Persistent Access Policy Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Cisco Security Advisory: Cisco Prime Infrastructure Command Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)

February 27 (5 messages)

Barracuda Networks Backup Appliance Application - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Office 365 - Account Hijacking Cookie Re-Use Flaw, extended ("Oei, Géry" <geryoei@...-edv.de>)
Update: CVE-2014-0053 Information Disclosure when using Grails (Pivotal Security Team <security@...ivotal.com>)
SEC Consult SA-20140227-0 :: Local Buffer Overflow vulnerability in SAS for Windows (Statistical Analysis System) (SEC Consult Vulnerability Lab <research@...-…)
Multiple Vulnerabilities in VideoWhisper Live Streaming Integration WP Plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)

February 28 (3 messages)

[slackware-security] subversion (SSA:2014-058-01) (Slackware Security Team <security@...ckware.com>)
SEC Consult SA-20140228-0 :: Privilege escalation vulnerability in MICROSENS Profi Line Modular Industrial Switch (SEC Consult Vulnerability Lab <research@...-…)
SEC Consult SA-20140228-1 :: Authentication bypass (SSRF) and local file disclosure in Plex Media Server (SEC Consult Vulnerability Lab <research@...-consult.c…)

155 messages

Powered by blists - more mailing lists