bugtraq mailing list - 2014/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 2	² 4	³ 4	⁴ 1	⁵	⁶
⁷ 14	⁸ 5	⁹ 16	¹⁰ 12	¹¹	¹²	¹³
¹⁴ 7	¹⁵ 5	¹⁶ 11	¹⁷ 5	¹⁸ 5	¹⁹	²⁰
²¹ 7	²² 6	²³ 7	²⁴ 9	²⁵ 5	²⁶	²⁷
²⁸ 7	²⁹	³⁰ 18	³¹ 8

Messages by day:

July 1 (2 messages)

Kerio Control <= 8.3.1 Boolean-based blind SQL Injection (info@...eidani.com)
SEC Consult SA-20140701-0 :: Stored cross-site scripting vulnerabilities in EMC Documentum eRoom (SEC Consult Vulnerability Lab <research@...-consult.com>)

July 2 (4 messages)

CVE-2014-3149 - Reflected Cross-Site Scripting (XSS) in "Invision Power IP.Board" (Christian Schneider <mail@...istian-Schneider.net>)
Cross-Site Request Forgery (CSRF) in Kanboard (High-Tech Bridge Security Research <advisory@...ridge.com>)
[security bulletin] HPSBMU03055 rev.1 - HP Smart Update Manager (HP SUM) running OpenSSL, Remote Denial of Service (DoS), Code Execution, … (security-alert@...com)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Domain Manager (Cisco Systems Product Security Incident Response Team <psirt@c…)

July 3 (4 messages)

[SECURITY] [DSA 2971-1] dbus security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBMU03064 rev.1 - HP Universal CMDB, Remote Information Disclosure, Execution of Code (security-alert@...com)
[security bulletin] HPSBMU03059 rev.1 - HP SiteScope, Remote Authentication Bypass (security-alert@...com)
POC2014 Call for Paper (pocadm@...il.com)

July 4 (1 message)

[security bulletin] HPSBMU03051 rev.2 - HP System Management Homepage running OpenSSL on Linux and Windows, Remote Denial of Service (DoS)… (security-alert@...com)

July 7 (14 messages)

Lime Survey 2-05+ Multiple Vulnerabilities (g-damore@...look.com)
[SECURITY] [DSA 2972-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Android KeyStore Stack Buffer Overflow (CVE-2014-3100) (a.blas@...isec.com)
CVE-2014-3863 - Stored XSS in JChatSocial (Teodor Lupan <teodor.lupan@...etech.ro>)
iTunes 11.2.2 for Windows: completely outdated and vulnerable 3rd party libraries ("Stefan Kanthak" <stefan.kanthak@...go.de>)
{CVE-ID request} - OCS-Inventory-NG Multiple Stored Cross Site Scripting Vulnerabilities. (Madhu Akula <madhu.akula@...mail.com>)
Backdoor access to Techboard/Syac devices (roberto.paleari@...ze.net)
PayPal Inc Bug Bounty #74 - Persistent Core Backend Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Paypal Inc Bug Bounty #109 Multi Shipping Application API - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <admin@...nerability-lab.com>)
Yahoo! Bug Bounty #25 Flickr API - Persistent Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] CVE-2014-3503 Apache Syncope (Francesco Chicchiriccò <ilgrosso@...che.org>)
Photo Org WonderApplications v8.3 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ESA-2014-064: EMC Documentum Content Server Privilege Escalation Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2014-057: EMC Documentum Foundation Services (DFS) XML External Entity (XXE) Vulnerability (Security Alert <Security_Alert@....com>)

July 8 (5 messages)

[SECURITY] [DSA 2973-1] vlc security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBGN03050 rev.1 - HP IceWall SSO Dfw and HP IceWall MCRP running OpenSSL, Remote Denial of Service (DoS), Code Execu… (security-alert@...com)
Abusing Oracle's CREATE DATABASE LINK Privilege for fun and Profit ("Sumit Siddharth" <sid@...sosecure.com>)
CVE-2014-3074 - Runtime Linker Allows Privilege Escalation Via Arbitrary File Writes in IBM AIX (Portcullis Advisories <advisories@...tcullis-security.com>)
[ MDVSA-2014:126 ] phpmyadmin (security@...driva.com)

July 9 (16 messages)

[security bulletin] HPSBMU03065 rev.1 - HP Operations Analytics, OpenSSL Vulnerability, SSL/TLS, Remote Code Execution, Denial of Service … (security-alert@...com)
[SECURITY] [DSA 2974-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
FreeBSD Security Advisory FreeBSD-SA-14:17.kmem (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Domain Manager (Cisco Systems Product Security Incident Response Team <psirt@…)
CVE-2014-4331 OctavoCMS reflected XSS vulnerability (andreu.antonio@...il.com)
Android NFC Service Denial of Service (vuln@...c.org.cn)
[ MDVSA-2014:127 ] gnupg (security@...driva.com)
[ MDVSA-2014:128 ] iodine (security@...driva.com)
[ MDVSA-2014:130 ] php (security@...driva.com)
[ MDVSA-2014:129 ] ffmpeg (security@...driva.com)
[ MDVSA-2014:131 ] file (security@...driva.com)
[ MDVSA-2014:132 ] libxfont (security@...driva.com)
OS Command Injection Infoblox Network Automation (nate@...thsecurity.com)
Weak Local Database Credentials in Infoblox Network Automation (nate@...thsecurity.com)
Cisco Security Advisory: Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products (Cisco Systems Product Security Incident Response Team <psi…)
[SECURITY] [DSA 2975-1] phpmyadmin security update (Thijs Kinkhorst <thijs@...ian.org>)

July 10 (12 messages)

[security bulletin] HPSBMU03069 rev.1 - HP Software Operation Orchestration, OpenSSL Vulnerability, SSL/TLS, Remote Code Execution, Denial… (security-alert@...com)
[security bulletin] HPSBMU03070 rev.1 - HP Cloud Service Automation, OpenSSL Vulnerability, Unauthorized Access, Disclosure of Information (security-alert@...com)
SEC Consult SA-20140710-0 :: Multiple critical vulnerabilities in Shopizer webshop (SEC Consult Vulnerability Lab <research@...-consult.com>)
SEC Consult SA-20140710-2 :: Multiple critical vulnerabilites in Schrack MICROCONTROL emergency light system (SEC Consult Vulnerability Lab <research@...-consu…)
SEC Consult SA-20140710-3 :: Design Issue / Password Disclosure in WAGO-I/O-SYSTEM with CODESYS V2.3 WebVisu (SEC Consult Vulnerability Lab <research@...-consu…)
[ MDVSA-2014:133 ] gd (security@...driva.com)
SEC Consult SA-20140710-1 :: Multiple high risk vulnerabilities in Shopizer webshop (SEC Consult Vulnerability Lab <research@...-consult.com>)
[ MDVSA-2014:134 ] liblzo (security@...driva.com)
[ MDVSA-2014:135 ] python (security@...driva.com)
Yahoo! Bug Bounty #29 YM - Filter Bypass & Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Yahoo! Bug Bounty #30 YM - Application-Side Mail Encoding (File Attachment) Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2976-1] eglibc security update (Florian Weimer <fw@...eb.enyo.de>)

July 14 (7 messages)

[ MDVSA-2014:136 ] samba (security@...driva.com)
[ MDVSA-2014:137 ] apache-mod_wsgi (security@...driva.com)
[SECURITY] [DSA 2977-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2978-1] libxml2 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2014:138 ] asterisk (security@...driva.com)
[slackware-security] php (SSA:2014-192-01) (Slackware Security Team <security@...ckware.com>)
[KIS-2014-08] OpenCart <= 1.5.6.4 (cart.php) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

July 15 (5 messages)

[security bulletin] HPSBST03039 rev.1 - HP StoreVirtual 4000 Storage and StoreVirtual VSA, Remote Disclosure of Information, Elevation of … (security-alert@...com)
[security bulletin] HPSBHF02913 rev.1 - HP Intelligent Management Center (iMC) and HP Branch Intelligent Management System (BIMS), Remote … (security-alert@...com)
Ruxcon 2014 Final Call For Presentations (cfp@...con.org.au)
[security bulletin] HPSBGN03068 rev.1 - HP OneView running OpenSSL, Remote Denial of Service (DoS), Unauthorized Access, Disclosure of Inf… (security-alert@...com)
Node Browserify RCE vuln (<= 4.2.0) ("Cal Leeming \[Simplicity Media Ltd\]" <cal.leeming@...plicitymedialtd.co.uk>)

July 16 (11 messages)

[security bulletin] HPSBMU03072 SSRT101644 rev.1 - HP Data Protector, Remote Execution of Arbitrary Code (security-alert@...com)
KL-001-2014-001 : Oracle VirtualBox Guest Additions Arbitrary Write Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
SEC Consult SA-20140716-0 :: Multiple SSRF vulnerabilities in Alfresco Community Edition (SEC Consult Vulnerability Lab <research@...-consult.com>)
VUPEN Security Research - Microsoft Internet Explorer CSS @import Memory Corruption (Pwn2Own 2014) (VUPEN Security Research <advisories@...en.com>)
VUPEN Security Research - Microsoft Internet Explorer "Request" Object Confusion Sandbox Bypass (Pwn2Own 2014) (VUPEN Security Research <advisories@...en.com>)
VUPEN Security Research - Microsoft Internet Explorer "ShowSaveFileDialog()" Sandbox Bypass (Pwn2Own 2014) (VUPEN Security Research <advisories@...en.com>)
VUPEN Security Research - Microsoft Windows "DirectShow" Privilege Escalation Vulnerability (Pwn2Own 2014) (VUPEN Security Research <advisories@...en.com>)
Reflected Cross-Site Scripting (XSS) in e107 (High-Tech Bridge Security Research <advisory@...ridge.com>)
SEC Consult SA-20140716-1 :: Remote Code Execution via CSRF in OpenVPN Access Server "Desktop Client" (SEC Consult Vulnerability Lab <research@...-consult.com>)
SEC Consult SA-20140716-2 :: Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller and Citrix Ne… (SEC Consult Vulnerability Lab <research…)
SEC Consult SA-20140716-3 :: Multiple critical vulnerabilities in Bitdefender GravityZone (SEC Consult Vulnerability Lab <research@...-consult.com>)

July 17 (5 messages)

Cisco Security Advisory: Cisco Wireless Residential Gateway Remote Code Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@c…)
[SECURITY] [DSA 2765-2] davfs regression update (Thijs Kinkhorst <thijs@...ian.org>)
IP.Board 3.4 cross-site scripting in Referer header (stormhacker@...mail.com)
[HITB-Announce] REMINDER: #HITB2014KUL CFP Deadline: 1st August (Hafez Kamal <aphesz@...kinthebox.org>)
Ignore the amount customers confirm is no security vulnerability according to PayPal (Jan Kechel <jan@...hel.de>)

July 18 (5 messages)

[SECURITY] [DSA 2979-1] fail2ban security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2980-1] openjdk-6 security update (Moritz Muehlenhoff <jmm@...ian.org>)
Barracuda Networks Message Archiver 650 - Persistent Input Validation Vulnerability (BNSEC 703) (Vulnerability Lab <research@...nerability-lab.com>)
Microsoft MSN HBE - Blind SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ESA-2014-074: EMC RecoverPoint Appliance Security Control Bypass Vulnerability (Security Alert <Security_Alert@....com>)

July 21 (7 messages)

CVE-2014-4980 Parameter Tampering in Nessus Web UI - Remote Information Disclosure (i amroot <i@...oot.com>)
[SECURITY] [DSA 2981-1] polarssl security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2014-4326 Remote command execution in Logstash zabbix and nagios_nsca outputs. (Jordan Sissel <jordan.sissel@...sticsearch.com>)
KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
[SECURITY] [DSA 2982-1] ruby-activerecord-3.2 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2983-1] drupal7 security update (Moritz Muehlenhoff <jmm@...ian.org>)

July 22 (6 messages)

Call for Papers / Speakers for ISACA Ireland Conference on 3rd Oct in Dublin (president@...ca.ie)
[oCERT-2014-004] Ansible input sanitization errors (Andrea Barisani <lcars@...rt.org>)
Cross-site Scripting in EventLog Analyzer 9.0 build #9000 (audit1@...ecure.com)
Web Login Bruteforce in Symantec Endpoint Protection Manager 12.1.4023.4080 (audit1@...ecure.com)
Barracuda Networks Spam&Virus Firewall v6.0.2 (600 & Vx) - Client Side Cross Site Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBMU03071 rev.1 - HP Autonomy IDOL, Running OpenSSL, Remote Unauthorized Access, Disclosure of Information (security-alert@...com)

July 23 (7 messages)

Barracuda Networks #35 Web Firewall 610 v6.0.1 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2984-1] acpi-support security update (Luciano Bello <luciano@...ian.org>)
[SECURITY] [DSA 2985-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Multiple Vulnerabilities in Parallels� Plesk Sitebuilder (cseye_ut@...oo.com)
[oCERT-2014-005] LPAR2RRD input sanitization errors (Daniele Bianco <danbia@...rt.org>)
SQL Injection in Е2 (High-Tech Bridge Security Research <advisory@...ridge.com>)
[security bulletin] HPSBMU03073 rev.1 - HP Network Virtualization, Remote Execution of Code, Disclosure of Information (security-alert@...com)

July 24 (9 messages)

[security bulletin] HPSBMU03074 rev.1 - HP Insight Control server migration on Linux and Windows running OpenSSL, Remote Denial of Service… (security-alert@...com)
Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of other accoun… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[SECURITY] [DSA 2986-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2987-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBMU03076 rev.1 - HP Systems Insight Manager (SIM) on Linux and Windows running OpenSSL, Multiple Vulnerabilities (security-alert@...com)
[slackware-security] httpd (SSA:2014-204-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2014-204-02) (Slackware Security Team <security@...ckware.com>)
Barracuda Networks Firewall 6.1.2 #36 - Filter Bypass & Exception Handling Vulnerability + PoC Video BNSEC-2398 (Vulnerability Lab <research@...nerability-lab.…)
[slackware-security] mozilla-thunderbird (SSA:2014-204-03) (Slackware Security Team <security@...ckware.com>)

July 25 (5 messages)

[SECURITY] [DSA 2988-1] transmission security update (Moritz Muehlenhoff <jmm@...ian.org>)
Security advisory for Bugzilla 4.5.5, 4.4.5, 4.2.10, and 4.0.14 (dkl@...illa.com)
[SECURITY] [DSA 2989-1] apache2 security update (Stefan Fritsch <sf@...ian.org>)
Easy file sharing web server - persist XSS in forum msgs (joseph.giron13@...il.com)
Barracuda Networks Firewall 6.1.5 - Filter Bypass & Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

July 28 (7 messages)

Re: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of oth… (Gynvael Coldwind <gynvael@...dwind.pl>)
Re: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of oth… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Web Encryption Extension security update (Ralf Senderek <support@...derek.ie>)
[security bulletin] HPSBGN02936 rev.1 - HP and H3C VPN Firewall Module Products, Remote Denial of Service (DoS) (security-alert@...com)
[SECURITY] [DSA 2990-1] cups security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2991-1] modsecurity-apache security update (Salvatore Bonaccorso <carnil@...ian.org>)
Barracuda Networks Spam&Virus Firewall v5.1.3 - Client Side Cross Site Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 30 (18 messages)

Kunena Forum Extension for Joomla Multiple SQL Injection Vulnerabilities (vulns@...nach.com)
Kunena Forum Extension for Joomla Multiple Reflected Cross-Site Scripting Vulnerabilities (vulns@...nach.com)
Re: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of oth… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of oth… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[SECURITY] [DSA 2992-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
WiFi HD v7.3.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Barracuda Networks Web Application Firewall v6.1.5 & LoadBalancer v4.2.2 #37 - Filter Bypass & Multiple Vulnerabilities (Vulnerability Lab <research@...nerabili…)
[Onapsis Security Advisory 2014-021] SAP HANA XS Missing encryption in form-based authentication (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2014-025] Multiple Cross Site Scripting Vulnerabilities in SAP HANA XS Administration Tool (Onapsis Research Labs <research@...psis.…)
[Onapsis Security Advisory 2014-026] Missing authorization check in function modules of BW-SYS-DB-DB4 (Onapsis Research Labs <research@...psis.com>)
[ MDVSA-2014:139 ] nss (security@...driva.com)
[Onapsis Security Advisory 2014-022] SAP HANA IU5 SDK Authentication Bypass (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2014-024] Hard-coded Username in SAP FI Manager Self-Service (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2014-023] HTTP verb tampering issue in SAP_JTECHS (Onapsis Research Labs <research@...psis.com>)
[ MDVSA-2014:140 ] owncloud (security@...driva.com)
Vulnerabilities in Facebook and Facebook Messenger for Android [STIC-2014-0529] (Programa STIC <stic@...dacionsadosky.org.ar>)
[ MDVSA-2014:141 ] java-1.7.0-openjdk (security@...driva.com)
[security bulletin] HPSBMU03078 rev.1 - HP CloudSystem Foundation and HP CloudSystem Enterprise Software running OpenSSL, Remote Unauthori… (security-alert@...com)

July 31 (8 messages)

Improper Access Control in ArticleFR (High-Tech Bridge Security Research <advisory@...ridge.com>)
[ MDVSA-2014:142 ] apache (security@...driva.com)
[ MDVSA-2014:143 ] phpmyadmin (security@...driva.com)
[ MDVSA-2014:144 ] live (security@...driva.com)
Re: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of oth… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of oth… ("Stefan Kanthak" <stefan.kanthak@...go.…)
RE: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of ot… (Joe Souza <Joe.Souza@...MotionWireless.…)
Re: [FD] Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of oth… ("Stefan Kanthak" <stefan.kanthak@...go.…)

158 messages

Powered by blists - more mailing lists