bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 10	²	³
⁴ 8	⁵ 9	⁶ 9	⁷ 15	⁸ 12	⁹	¹⁰
¹¹ 8	¹² 5	¹³ 4	¹⁴ 3	¹⁵	¹⁶	¹⁷
¹⁸ 8	¹⁹ 6	²⁰ 12	²¹ 4	²² 7	²³	²⁴
²⁵ 9	²⁶ 4	²⁷ 6	²⁸ 6	²⁹ 1	³⁰	³¹

Messages by day:

August 1 (10 messages)

[ MDVSA-2014:145 ] php-ZendFramework (security@...driva.com)
[ MDVSA-2014:146 ] file (security@...driva.com)
[SECURITY] [DSA 2993-1] tor security update (Salvatore Bonaccorso <carnil@...ian.org>)
TigerCom iFolder+ v1.2 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2994-1] nss security update (Raphael Geissert <geissert@...ian.org>)
[ MDVSA-2014:147 ] sendmail (security@...driva.com)
[ MDVSA-2014:148 ] dbus (security@...driva.com)
[security bulletin] HPSBMU03081 rev.1 - HP Enterprise Maps, Remote Information Disclosure (security-alert@...com)
C++11 <regex> insecure by default (submit@...ec.org)
Photo WiFi Transfer 1.01 - Directory Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 4 (8 messages)

Microsoft Exchange Multiple Vulnerabilities (np@...uritypentest.com)
[slackware-security] samba (SSA:2014-213-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] dhcpcd (SSA:2014-213-02) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 2995-1] lzo2 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2996-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
ownCloud Unencrypted Private Key Exposure (Senderek Web Security <support@...derek.ie>)
Video WiFi Transfer 1.01 - Directory Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FreeDisk v1.01 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

August 5 (9 messages)

Ebay Inc Magento ProStore CP #4 - Filter Validation Bypass & Persistent (Payment Information) Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBMU03083 rev.1 - HP BladeSystem c-Class Virtual Connect Firmware running OpenSSL, Remote Unauthorized Access or Dis… (security-alert@...com)
Re: ownCloud Unencrypted Private Key Exposure (Frank Stanek <frank@...nk-stanek.de>)
CVE-2014-2595 - Authentication Bypass in Barracuda Web Application Firewall (Portcullis Advisories <advisories@...tcullis-security.com>)
[security bulletin] HPSBMU03037 rev.2 - HP Multimedia Service Environment (MSE), (HP Network Interactive Voice Response (NIVR)), Remote Di… (security-alert@...com)
[CVE- Requested][Vembu Storegrid - Multiple Critical Vulnerabilities] (Mike Antcliffe <mikeantcliffe@...icallysecure.com>)
Apache Cordova 3.5.1 (Marcel Kinard <cmarcelk@...il.com>)
SEC Consult SA-20140805-0 :: Multiple vulnerabilities in Readsoft Invoice Processing and Process Director (SEC Consult Vulnerability Lab <research@...-consult.…)
Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities (mike.manzotti@...nach.com)

August 6 (9 messages)

Re: ownCloud Unencrypted Private Key Exposure (Anthony Dubuissez <anthony.dubuissez@...era.fr>)
RE: ownCloud Unencrypted Private Key Exposure - version (6.0.4) reported not vulnerable ("Choulat, Trace" <tchoula@....edu>)
CVE-2014-5075 MitM Vulnerability in the Smack XMPP Library for Java (Georg Lukas <lukas@...solutions.de>)
[SECURITY] [DSA 2997-1] reportbug security update (Salvatore Bonaccorso <carnil@...ian.org>)
Re: ownCloud Unencrypted Private Key Exposure (Jack Brennan <mail@...rcenix.com>)
[security bulletin] HPSBMU03085 rev.1 - HP Application Lifecycle Management / Quality Center, Elevation of Privilege (security-alert@...com)
PhotoSync Wifi & Bluetooth v1.0 - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2014:149 ] php (security@...driva.com)
PhotoSync v2.2 iOS - Command Inject Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 7 (15 messages)

[ MDVSA-2014:150 ] tor (security@...driva.com)
nullcon CFP is open (nullcon <nullcon@...lcon.net>)
TomatoCart v1.x (latest-stable) Multiple Vulnerabilities (Kenny Mathis <kenny@...aking.technology>)
Re: ownCloud Unencrypted Private Key Exposure (Frank Stanek <frank@...nk-stanek.de>)
RE: ownCloud Unencrypted Private Key Exposure ("Mikhail A. Utin" <mutin@...monwealthcare.org>)
RE: ownCloud Unencrypted Private Key Exposure ("Mikhail A. Utin" <mutin@...monwealthcare.org>)
Cisco Security Advisory: Cisco IOS Software and Cisco IOS XE Software EnergyWise Crafted Packet Denial of Service Vulner… (Cisco Systems Product Security Incident…)
[ MDVSA-2014:151 ] cups (security@...driva.com)
[ MDVSA-2014:153 ] mediawiki (security@...driva.com)
[ MDVSA-2014:154 ] readline (security@...driva.com)
[ MDVSA-2014:152 ] glibc (security@...driva.com)
[SECURITY] [DSA 2998-1] openssl security update (Raphael Geissert <geissert@...ian.org>)
(CVE-2014-3501/2/3) Apache Cordova for Android - Multiple Vulnerabilities (David Kaplan <davidkaps@...look.com>)
[ MDVSA-2014:155 ] kernel (security@...driva.com)
(kind of) new tool: american fuzzy lop (Michal Zalewski <lcamtuf@...edump.cx>)

August 8 (12 messages)

[ MDVSA-2014:156 ] ocsinventory (security@...driva.com)
Easy FTP Pro v4.2 iOS - Command Inject Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBHF03084 rev.1 HP PCs with UEFI Firmware, Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMU03086 rev.1 - HP Operations Agent running Glance, Local Elevation of Privilege (security-alert@...com)
Beginners error: QuickTime for Windows runs rogue program C:\Program.exe when opening associated files ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[security bulletin] HPSBUX03087 SSRT101413 rev.1 - HP-UX CIFS Server (Samba), Remote Denial of Service (DoS), Execution of Arbitrary Code,… (security-alert@...com)
[WorldCIST'15]: Call for Workshops Proposals - Proceedings by Springer ("ML" <marialemos72@...il.com>)
[ MDVSA-2014:157 ] ipython (security@...driva.com)
ESA-2014-055: EMC Network Configuration Manager (NCM) Report Advisor Session Fixation Vulnerability (Security Alert <Security_Alert@....com>)
[ MDVSA-2014:159 ] wireshark (security@...driva.com)
[ MDVSA-2014:158 ] openssl (security@...driva.com)
[security bulletin] HPSBMU03062 rev.1 - HP Insight Control server deployment on Linux and Windows running OpenSSL, Multiple Vulnerabilitie… (security-alert@...com)

August 11 (8 messages)

[slackware-security] openssl (SSA:2014-220-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 2999-1] drupal7 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3000-1] krb5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3001-1] wordpress security update (Salvatore Bonaccorso <carnil@...ian.org>)
MITKRB5-SA-2014-001 Buffer overrun in kadmind with LDAP backend (Benjamin Kaduk <kaduk@....EDU>)
[SECURITY] [DSA 3002-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3003-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3004-1] kde4libs security update (Moritz Muehlenhoff <jmm@...ian.org>)

August 12 (5 messages)

IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915) (Jamie Riden <jamie.riden@...il.com>)
[SECURITY] [DSA 2984-2] acpi-support regression update (Raphael Geissert <geissert@...ian.org>)
[security bulletin] HPSBMU03089 rev.1 - HP Executive Scorecard, Running OpenSSL, Disclosure of Information (security-alert@...com)
Apache Cordova 3.5.1: CVE-2014-3502 update (Marcel Kinard <cmarcelk@...il.com>)
CVE-2014-5035 - Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service (Gregory Pickett <gpickett71@...oo.com>)

August 13 (4 messages)

BlackBerry Z 10 - Storage and Access File-Exchange Authentication By-Pass [MZ-13-04] (security <security@...zero.ch>)
[oCERT-2014-006] Ganeti insecure archive permission (Andrea Barisani <lcars@...rt.org>)
Reflected Cross-Site Scripting (XSS) in Jamroom (High-Tech Bridge Security Research <advisory@...ridge.com>)
[security bulletin] HPSBHF03088 rev.1 - HP Integrity SD2 CB900s i2 and i4 Servers running OpenSSL, Remote Unauthorized Access or Disclosur… (security-alert@...com)

August 14 (3 messages)

[security bulletin] HPSBMU03090 rev.1 - HP SiteScope, running Apache Struts, Remote Execution of Arbitrary Code (security-alert@...com)
APPLE-SA-2014-08-13-1 Safari 6.1.6 and Safari 7.0.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 3005-1] gpgme1.0 security update (Salvatore Bonaccorso <carnil@...ian.org>)

August 18 (8 messages)

Beginners error: Apple's Software Update runs rogue program C:\Program.exe (and some more) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Beginners error: Windows Live Mail 2011 runs rogue C:\Program.exe when opening associated URLs ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Beginners error: Apple's iCloudServices for Windows run rogue program C:\Program.exe (and some more) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
CVE-2014-5289 - Kolibri WebServer 2.0 Vulnerable to RCE via Overly Long POST Request (tekwizz123@...eup.net)
Outlook.com for Android fails to validate server certificates ("Securify B.V." <lists@...urify.nl>)
CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack (Dirk-Willem van Gulik <dirkx@...weaving.org>)
[SECURITY] [DSA 3006-1] xen security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack (Dirk-Willem van Gulik <dirkx@...weaving.org>)

August 19 (6 messages)

ESA-2014-073: EMC Documentum Multiple Cross-Site Request Forgery Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2014-059: EMC Documentum Multiple Cross-Site Scripting Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2014-067: EMC Documentum D2 Privilege Escalation Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2014-079: EMC Documentum Content Server Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
[CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability (Jacopo Cappellato <jacopoc@...che.org>)
ESA-2014-071: RSA Archer® GRC Platform Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)

August 20 (12 messages)

[Call For Papers] RiseCON - Rosario, Argentina (Info RiseCON <info@...econ.org>)
[security bulletin] HPSBMU03094 rev.1 - HP Connect-IT, running OpenSSL, Remote Disclosure of Information or Unauthorized Access (security-alert@...com)
[security bulletin] HPSBMU03101 rev.1 - HP Asset Manager, CloudSystem Chargeback, running OpenSSL, Remote Disclosure of Information or Una… (security-alert@...com)
[security bulletin] HPSBUX03091 SSRT101667 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information, and Other V… (security-alert@...com)
[security bulletin] HPSBUX03092 SSRT101668 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other V… (security-alert@...com)
[security bulletin] HPSBUX03095 SSRT101674 rev.1 - HP-UX running OpenSSL, Multiple Vulnerabilities (security-alert@...com)
ICETC2014 - IEEE Extended Submission until Aug. 28, 2014 (jackie@...wc.info)
Deutsche Telekom CERT Advisory [DTC-A-20140820-001] check_mk vulnerabilities (<CERT@...ekom.de>)
[SECURITY] [DSA 3007-1] cacti security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2014-5307 - Privilege Escalation in Panda Security Products (Portcullis Advisories <advisories@...tcullis-security.com>)
SQL Injection Vulnerability in ArticleFR (High-Tech Bridge Security Research <advisory@...ridge.com>)
CVE-2014-4973 - Privilege Escalation in ESET Windows Products (Portcullis Advisories <advisories@...tcullis-security.com>)

August 21 (4 messages)

ArcGIS for Server Vulnerability Disclosure ("Romano, Christian" <cromano@...nes.com>)
ToorCon 16 Call For Papers! (h1kari@...rcon.org)
[SECURITY] [DSA 3008-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2940-1] libstruts1.2-java security update (Moritz Muehlenhoff <jmm@...ian.org>)

August 22 (7 messages)

[SECURITY] [DSA 3008-2] php5 regression update (Salvatore Bonaccorso <carnil@...ian.org>)
[CVE-2014-5335] CSRF in Innovaphone PBX (rg@...deattacklogic.de)
CVE-2014-3575:OpenOffice Targeted Data Exposure Using Crafted OLE Objects (Herbert Duerr <hdu@...che.org>)
CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability (Herbert Duerr <hdu@...che.org>)
[SECURITY] [DSA 3009-1] python-imaging security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBST03098 rev.1 - HP StoreEver MSL6480 Tape Library running OpenSSL, Remote Unauthorized Access or Disclosure of Inf… (security-alert@...com)
DoS attacks (ICMPv6-based) resulting from IPv6 EH drops (Fernando Gont <fgont@...networks.com>)

August 25 (9 messages)

[security bulletin] HPSBMU03079 rev.1 - HP Service Manager, Multiple Vulnerabilities (security-alert@...com)
[SECURITY] [DSA 3010-1] python-django security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3011-1] mediawiki security update (Salvatore Bonaccorso <carnil@...ian.org>)
Barracuda Networks Web Security Flex Appliance Application v4.x - Filter Bypass & Persistent Vulnerabilities (BNSEC 707… (Vulnerability Lab <research@...nerabili…)
Barracuda Networks Web Security Flex v4.1 - Persistent Vulnerabilities (BNSEC-699) (Vulnerability Lab <research@...nerability-lab.com>)
DNN(DotNetNuke�) Iconbar Control Panel Bad Access Level config (cseye_ut@...oo.com)
DNN(DotNetNuke�) Ribbon Bar Control Panel Bad Access Level config (cseye_ut@...oo.com)
MEHR Automation System Arbitrary File Download Vulnerability(persian portal) (cseye_ut@...oo.com)
[WorldCIST'15]: Call for Workshops Proposals; Proceedings by Springer - Indexed by ISI, Scopus, DBLP, etc. ("WorldCIST" <worldcist@...ti.eu>)

August 26 (4 messages)

[security bulletin] HPSBMU03076 rev.2 - HP Systems Insight Manager (SIM) on Linux and Windows running OpenSSL, Multiple Vulnerabilities (security-alert@...com)
ntopng 1.2.0 XSS injection using monitored network traffic (Steffen Bauch <mail@...ffenbauch.de>)
LSE Leading Security Experts GmbH - LSE-2014-07-13 - Granding Grand MA 300 - Weak Pin Verification (advisories <advisories@...xperts.de>)
ESA-2014-081 RSA® Identity Management and Governance Authentication Bypass Vulnerability (Security Alert <Security_Alert@....com>)

August 27 (6 messages)

Encore Discovery Solution Multiple Vulnerability Disclosure ("Romano, Christian" <cromano@...nes.com>)
Mathematica10.0.0 on Linux /tmp/MathLink vulnerability (paul.szabo@...ney.edu.au)
Fwd: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks (Fernando Gont <fgont@...networks.com>)
SaaS Marketing platform Hubspot export vulnerability (ehoward@...acoast.com)
[SECURITY] [DSA 3012-1] eglibc security update (Florian Weimer <fw@...eb.enyo.de>)
Last CFP: ICETC2014 - IEEE - Poland (Deadline: Aug. 30) (jackie@...wc.info)

August 28 (6 messages)

[SECURITY] [DSA 3013-1] s3ql security update (Florian Weimer <fw@...eb.enyo.de>)
[The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert (Pedro Ribeiro <pedrib@...il.com>)
Aerohive Hive Manager and Hive OS Multiple Vulnerabilities (Disclosure <Disclosure@...urity-assessment.com>)
SEC Consult SA-20140828-0 :: F5 BIG-IP Reflected Cross-Site Scripting (SEC Consult Vulnerability Lab <research@...-consult.com>)
[SECURITY] [DSA 3014-1] squid3 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Re: SaaS Marketing platform Hubspot export vulnerability (security@...spot.com)

August 29 (1 message)

Sierra Library Services Platform Multiple Vulnerability Disclosure ("Romano, Christian" <cromano@...nes.com>)

146 messages