bugtraq mailing list - 2014/05

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹	² 14	³	⁴
⁵ 12	⁶ 5	⁷ 5	⁸ 9	⁹ 5	¹⁰	¹¹
¹² 8	¹³ 8	¹⁴	¹⁵ 13	¹⁶ 19	¹⁷	¹⁸
¹⁹ 5	²⁰ 8	²¹ 7	²² 11	²³ 5	²⁴	²⁵
²⁶ 3	²⁷ 2	²⁸ 12	²⁹ 5	³⁰ 3	³¹

Messages by day:

May 2 (14 messages)

[security bulletin] HPSBMU03029 rev.1 - HP Insight Control Server Migration running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU03028 rev.1 - HP Matrix Operating Environment and CloudSystem Matrix Software Components running OpenSSL, Remote… (security-alert@...com)
[security bulletin] HPSBMU03033 rev.1 - HP Insight Control Software Components running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU03030 rev.1 - HP Service Pack for ProLiant (SPP) Bundled Software running OpenSSL, Remote Disclosure of Informat… (security-alert@...com)
[security bulletin] HPSBMU03032 rev.1 - HP Virtual Connect Firmware Smart Components Installer Software running OpenSSL, Remote Disclosure… (security-alert@...com)
[security bulletin] HPSBMU03009 rev.2 - HP CloudSystem Foundation and Enterprise Software v8.0 running OpenSSL, Remote Disclosure of Infor… (security-alert@...com)
[security bulletin] HPSBMU02998 rev.3 - HP System Management Homepage (SMH) running OpenSSL on Linux and Windows, Remote Disclosure of Inf… (security-alert@...com)
[ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact (Rene Gielen <rgielen@...che.org>)
Re: [ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact ("Eric Reed" <EREED2@...L.NYSED.GOV>)
[security bulletin] HPSBST03004 rev.1 - HP IBRIX X9320 Storage running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBGN03034 rev.1 - HP OneView, Remote Elevation of Privileges (security-alert@...com)
[security bulletin] HPSBST03027 rev.1 - HP StoreVirtual 4000 Storage and HP P4000 G2 Storage using HP System Management Homepage (SMH) run… (security-alert@...com)
[security bulletin] HPSBMU03018 rev.2 - HP Software Asset Manager running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU02987 rev.2 - HP Universal Configuration Management Database Integration Service, Remote Code Execution (security-alert@...com)

May 5 (12 messages)

[security bulletin] HPSBMU03024 rev.2 - HP Insight Control Server Deployment on Linux and Windows running OpenSSL with System Management H… (security-alert@...com)
[security bulletin] HPSBMU03033 rev.2 - HP Insight Control Software Components running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[SECURITY] [DSA 2919-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2920-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 2921-1] xbuffy security update (Yves-Alexis Perez <corsac@...ian.org>)
Ruxcon 2014 Call For Papers (cfp@...con.org.au)
ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities (Security Alert <Security_Alert@....com>)
[ANN] Struts 2.3.16.3 GA release available - security fix (Lukasz Lenart <lukaszlenart@...che.org>)
[SECURITY] [DSA 2923-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2922-1] strongswan security update (Yves-Alexis Perez <corsac@...ian.org>)
[SECURITY] [DSA 2924-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBGN03010 rev.4 - HP Software Server Automation running OpenSSL, Remote Disclosure of Information (security-alert@...com)

May 6 (5 messages)

CVE-2014-2845 - Cyberduck (Windows): Failure validating some certificates (using FTP-SSL) with untrusted root certifica… (Micha Borrmann <micha.borrmann@...s.de>)
[security bulletin] HPSBMU03037 rev.1 - HP Multimedia Service Environment (MSE), (HP Network Interactive Voice Response (NIVR)), Remote Di… (security-alert@...com)
CVE-2014-2881 - Poor Quality Implementation of Diffie-Hellman Key Exchange in Citrix Netscaler (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2014-2882 - Lack of SSL Certificate Validation in Citrix Netscaler (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2014-0930 - Kernel Memory Leak And Denial Of Service Condition in IBM AIX (Portcullis Advisories <advisories@...tcullis-security.com>)

May 7 (5 messages)

[security bulletin] HPSBMU02994 rev.4 - HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL, Remote Disclosure of Informatio… (security-alert@...com)
Breakpoint 2014 Call For Presentations (cfp@...con.org.au)
Cross-Site Scripting (XSS) in Offiria (High-Tech Bridge Security Research <advisory@...ridge.com>)
[security bulletin] HPSBMU03018 rev.3 - HP Software Asset Manager running OpenSSL, Remote Disclosure of Information (security-alert@...com)
Cisco Security Advisory: Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Play… (Cisco Systems Product Security Incident…)

May 8 (9 messages)

SEC Consult SA-20140508-0 :: Multiple critical vulnerabilities in AVG Remote Administration (SEC Consult Vulnerability Lab <research@...-consult.com>)
[RT-SA-2014-003] Metadata Information Disclosure in OrbiTeam BSCW (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[security bulletin] HPSBMU02935 rev.3 - HP LoadRunner Virtual User Generator, Remote Code Execution, Disclosure of information (security-alert@...com)
[ MDVSA-2014:081 ] apache-mod_security (security@...driva.com)
[ MDVSA-2014:080 ] openssl (security@...driva.com)
[ MDVSA-2014:082 ] python-imaging (security@...driva.com)
[ MDVSA-2014:083 ] mediawiki (security@...driva.com)
Directory Traversal Vulnerability in VMTurbo Operations Manager 4.5 or earlier (jpecou@...il.com)
[SECURITY] [DSA 2925-1] rxvt-unicode security update (Moritz Muehlenhoff <jmm@...ian.org>)

May 9 (5 messages)

[security bulletin] HPSBGN03008 rev.2 - HP Software Service Manager, "HeartBleed" OpenSSL Vulnerability, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU03035 rev.1 - HP Network Node Manager I (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Cross-Site Scripti… (security-alert@...com)
SSH key cloning problem in OnApp templates (James Renken <jrenken@...dwich.net>)
[security bulletin] HPSBST03038 rev.1 - HP H-series Fibre Channel Switches, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBHF02946 rev.1 - HP Servers with NVIDIA GPU Computing Driver, Elevation of Privilege (security-alert@...com)

May 12 (8 messages)

[security bulletin] HPSBST03015 rev.3 - HP 3PAR OS running OpenSSL, Remote Disclosure of Information (security-alert@...com)
ESA-2014-027: RSA® NetWitness and RSA® Security Analytics Authentication Bypass Vulnerability (Security Alert <Security_Alert@....com>)
[slackware-security] seamonkey (SSA:2014-131-01) (Slackware Security Team <security@...ckware.com>)
[ MDVSA-2014:084 ] libpng (security@...driva.com)
[ MDVSA-2014:085 ] ldns (security@...driva.com)
[ MDVSA-2014:086 ] libxml2 (security@...driva.com)
[security bulletin] HPSBMU02931 rev.6 - HP Service Manager and ServiceCenter, Injection of Arbitrary Code, Remote Privilege Elevation, Rem… (security-alert@...com)
[SECURITY] [DSA 2926-1] linux security update (Moritz Muehlenhoff <jmm@...ian.org>)

May 13 (8 messages)

ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability (Security Alert <Security_Alert@....com>)
[security bulletin] HPSBPI03031 rev.2 - HP Officejet Pro X Printers, Certain Officejet Pro Printers, Remote Disclosure of Information (security-alert@...com)
CVE-2014-2046 - Unauthenticated Credential And Configuration Retrieval In Broadcom Ltd PIPA C211 (Portcullis Advisories <advisories@...tcullis-security.com>)
Multiple Stored XSS in FOG Image deployment system - FD ("Dolev Farhi" <dolevf87@...il.com>)
[security bulletin] HPSBMU02964 rev.2 - HP Service Manager, Cross-Site Scripting (XSS), Remote Denial of Service (DoS), Execution of Arbit… (security-alert@...com)
FD - Cobbler Arbitrary File Read CVE-2014-3225 ("Dolev Farhi" <dolevf87@...il.com>)
[security bulletin] HPSBMU02998 rev.4 - HP System Management Homepage (SMH) running OpenSSL on Linux and Windows, Remote Disclosure of Inf… (security-alert@...com)
[security bulletin] HPSBMU03022 rev.2 - HP Systems Insight Manager (SIM) Bundled Software running OpenSSL, Remote Disclosure of Informatio… (security-alert@...com)

May 15 (13 messages)

[SECURITY] [DSA 2927-1] libxfont security update (Salvatore Bonaccorso <carnil@...ian.org>)
FreeBSD Security Advisory FreeBSD-SA-14:10.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
CSRF and Remote Code Execution in EGroupware (High-Tech Bridge Security Research <advisory@...ridge.com>)
[security bulletin] HPSBMU03040 rev.1 - HP LoadRunner & HP Performance Center, running OpenSSL, Remote Disclosure of Information (security-alert@...com)
Paypal Inc Bug Bounty #109 MOS - Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2928-1] linux-2.6 security update (dann frazier <dannf@...ian.org>)
Bilyoner mobile apps prone to various SSL/TLS attacks (harun.esur@...ptive.com)
[REVIVE-SA-2014-001] Revive Adserver 3.0.5 fixes CSRF vulnerability (Matteo Beccati <php@...cati.com>)
[ MDVSA-2014:087 ] php (security@...driva.com)
[CVE-2014-0749] TORQUE Buffer Overflow (john.fitzpatrick@...infosecurity.com)
[ MDVSA-2014:088 ] python-lxml (security@...driva.com)
[security bulletin] HPSBMU02995 rev.7 - HP Software HP Service Manager, Asset Manager, UCMDB Browser, UCMDB Configuration Manager, Executi… (security-alert@...com)
APPLE-SA-2014-05-15-1 OS X Mavericks v10.9.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)

May 16 (19 messages)

APPLE-SA-2014-05-15-2 iTunes 11.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2014:089 ] nagios (security@...driva.com)
Two Cross-Site Scripting (XSS) Vulnerabilities in Seo Panel (High-Tech Bridge Security Research <advisory@...ridge.com>)
[ MDVSA-2014:092 ] cups (security@...driva.com)
[ MDVSA-2014:095 ] struts (security@...driva.com)
[ MDVSA-2014:098 ] rawtherapee (security@...driva.com)
[ MDVSA-2014:094 ] rxvt-unicode (security@...driva.com)
[ MDVSA-2014:096 ] python-jinja2 (security@...driva.com)
CA20140413-01: Security Notice for OpenSSL Heartbleed Vulnerability ("Williams, James K" <Ken.Williams@...com>)
[ MDVSA-2014:102 ] mariadb (security@...driva.com)
[ MDVSA-2014:100 ] java-1.7.0-openjdk (security@...driva.com)
[ MDVSA-2014:103 ] wordpress (security@...driva.com)
[ MDVSA-2014:091 ] cups (security@...driva.com)
[ MDVSA-2014:097 ] libvirt (security@...driva.com)
[ MDVSA-2014:099 ] dovecot (security@...driva.com)
[ MDVSA-2014:093 ] couchdb (security@...driva.com)
[ MDVSA-2014:101 ] owncloud (security@...driva.com)
[ MDVSA-2014:104 ] egroupware (security@...driva.com)

May 19 (5 messages)

[security bulletin] HPSBHF02946 rev.2 - HP Servers with NVIDIA GPU Computing Driver, Elevation of Privilege (security-alert@...com)
APPLE-SA-2014-05-16-1 iTunes 11.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 2930-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 2931-1] openssl security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2932-1] qemu security update (Giuseppe Iuculano <iuculano@...ian.org>)

May 20 (8 messages)

[SECURITY] [DSA 2933-1] qemu-kvm security update (Giuseppe Iuculano <iuculano@...ian.org>)
FTP Rush: missing X.509 validation (FTP with TLS) (Micha Borrmann <micha.borrmann@...s.de>)
JavaMail SMTP Header Injection via method setSubject [CSNC-2014-001] ("Alexandre Herzog" <alexandre.herzog@...c.ch>)
[security bulletin] HPSBMU03022 rev.3 - HP Systems Insight Manager (SIM) Bundled Software running OpenSSL, Remote Disclosure of Informatio… (security-alert@...com)
[SECURITY] [DSA 2934-1] python-django security update (Salvatore Bonaccorso <carnil@...ian.org>)
t2'14: Call for Papers 2014 (Helsinki / Finland) ("Tomi Tuominen" <tomi.tuominen@...fi>)
Construtiva CIS Manager CMS POST SQLi (edge@...message.ch)
[security bulletin] HPSBGN03007 rev.1 - HP IceWall MCRP and HP IceWall SSO, Remote Denial of Service (DoS) (security-alert@...com)

May 21 (7 messages)

CVE-2014-3448 - Remote Code Execution Via Unauthenticated File Upload in BSS Continuity CMS (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2014-3450 - Privilege Escalation in Panda Security (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2014-3447 - Remote Denial Of Service in BSS Continuity CMS (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2014-3446 - Unauthenticated Blind SQL Injection in BSS Continuity CMS (Portcullis Advisories <advisories@...tcullis-security.com>)
APPLE-SA-2014-15-20-1 OS X Server 3.1.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Beginners error: Hewlett-Packards driver software executes rogue binary C:\Program.exe ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Wordpress Booking System (Booking Calendar) plugin SQL Injection (info sec <omgpdrv@...il.com>)

May 22 (11 messages)

SEC Consult SA-20140521-0 :: Multiple critical vulnerabilities in CoSoSys Endpoint Protector 4 (SEC Consult Vulnerability Lab <research@...-consult.com>)
[security bulletin] HPSBMU03042 rev.1 - HP Operations Manager i, Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMU03044 rev.1 - HP Business Process Monitor, running OpenSSL, Remote Disclosure of Information (security-alert@...com)
Cisco Security Advisory: Cisco Wide Area Application Services Remote Code Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt…)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco NX-OS-Based Products (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SECURITY] [DSA 2935-1] libgadu security update (Moritz Muehlenhoff <jmm@...ian.org>)
[KIS-2014-05] Dotclear <= 2.6.2 (XML-RPC Interface) Authentication Bypass Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2014-06] Dotclear <= 2.6.2 (Media Manager) Unrestricted File Upload Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2014-07] Dotclear <= 2.6.2 (categories.php) SQL Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
APPLE-SA-2014-05-21-1 Safari 6.1.4 and Safari 7.0.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Full Disclosure - DIR-652/DIR-835/DIR-855L/DGL-5500/DHP-1565 - Clear Text Password/XSS/Information Disclosure (kyle Lovett <krlovett@...il.com>)

May 23 (5 messages)

ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability (Security Alert <Security_Alert@....com>)
[security bulletin] HPSBMU02995 rev.8 - HP Software HP Service Manager, Asset Manager, UCMDB Browser, UCMDB Configuration Manager, Executi… (security-alert@...com)
[security bulletin] HPSBMU03025 rev.2 - HP Diagnostics running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[SECURITY] [DSA 2936-1] torque security update (Salvatore Bonaccorso <carnil@...ian.org>)
ESA-2014-021: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities (Security Alert <Security_Alert@....com>)

May 26 (3 messages)

[security bulletin] HPSBMU03009 rev.3 - HP CloudSystem Foundation and HP CloudSystem Enterprise Software running OpenSSL, Remote Disclosur… (security-alert@...com)
[security bulletin] HPSBUX02960 SSRT101419 rev.3 - HP-UX Running NTP, Remote Denial of Service (DoS) (security-alert@...com)
VUPEN Security Research - Adobe Acrobat & Reader XI-X Barcode Heap Overflow (Pwn2Own) (VUPEN Security Research <advisories@...en.com>)

May 27 (2 messages)

[security bulletin] HPSBGN03041 rev.1 - HP IceWall Configuration Manager running Apache Struts, Remote Execution of Arbitrary Code (security-alert@...com)
call for papers- ＣＳＳＥ２０１４ ("cfp-conf2014.org" <cfp-conf2014.org@...urityfocus.com>)

May 28 (12 messages)

[SECURITY] CVE-2014-0075 Apache Tomcat denial of service (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2014-0096 Apache Tomcat information disclosure (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2014-0095 Apache Tomcat denial of service (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2014-0097 Apache Tomcat information disclosure (Mark Thomas <markt@...che.org>)
CVE-2014-3445 - Unauthenticated Backup and Password Disclosure in HandsomeWeb SOS Webpages (Portcullis Advisories <advisories@...tcullis-security.com>)
[SECURITY] CVE-2014-0119 Apache Tomcat information disclosure (Mark Thomas <markt@...che.org>)
Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure (Mark Thomas <markt@...che.org>)
[SECURITY] [DSA 2937-1] mod-wsgi security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2938-1] Availability of LTS support for Debian 6.0 / squeeze (Moritz Muehlenhoff <jmm@...ian.org>)
LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability ("LSE Leading Security Experts GmbH \(Security Advisori…)
SEC Consult SA-20140528-0 :: Root Backdoor & Unauthenticated access to voice recordings in NICE Recording eXpress (SEC Consult Vulnerability Lab <research@...-…)
Multiple vulnerabilities in Sharetronix (High-Tech Bridge Security Research <advisory@...ridge.com>)

May 29 (5 messages)

[RT-SA-2014-004] Remote Command Execution in webEdition CMS Installer Script (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2014-005] SQL Injection in webEdition CMS File Browser Installer Script (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
Defense in depth -- the Microsoft way (part 15): unquoted arguments in 120 (of 462) command lines ("Stefan Kanthak" <stefan.kanthak@...go.de>)
OpenCart 1.5.6.4 Directory Traversal Vulnerability (iedb.team@...il.com)
Mybb Sendthread Page Denial of Service Vulnerability (iedb.team@...il.com)

May 30 (3 messages)

NEW VMSA-2014-0005 - VMware Workstation, Player, Fusion, and ESXi patches address a guest privilege escalation ("\"VMware Security Response Center\"" <security…)
Google Compute Engine - Lateral Compromise ("Scott T. Cameron" <routehero@...il.com>)
Google Compute Engine Multiple DOS Vulnerabilities ("Scott T. Cameron" <routehero@...il.com>)

159 messages

Powered by blists - more mailing lists