bugtraq mailing list - 2014/09

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 10	² 26	³ 8	⁴ 3	⁵	⁶	⁷
⁸ 18	⁹ 5	¹⁰ 6	¹¹ 6	¹² 4	¹³	¹⁴
¹⁵ 6	¹⁶ 1	¹⁷ 14	¹⁸	¹⁹ 16	²⁰	²¹
²² 5	²³ 7	²⁴ 4	²⁵ 27	²⁶ 11	²⁷	²⁸
²⁹ 10	³⁰ 5

Messages by day:

September 1 (10 messages)

Re: Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities (sales@...chatrooms.com)
WordPress Slideshow Gallery 1.4.6 Shell Upload Vulnerability (CVE-2014-5460) (jesus.ramirez.pichardo@...il.com)
WordPress Slideshow Gallery 1.4.6 Shell Upload Vulnerability (CVE-2014-5460) (jesus.ramirez.pichardo@...il.com)
[SECURITY] [DSA 2987-2] openjdk-7 regression update (Florian Weimer <fw@...eb.enyo.de>)
SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
CFP Deadline Approaching - Third International Conference on Informatics & Applications | Malaysia (liezelle@...wc.info)
Re: SSH host key fingerprint - through HTTPS (Micha Borrmann <micha.borrmann@...s.de>)
Avira License Application - Cross Site Request Forgery Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: SSH host key fingerprint - through HTTPS (Chris Nehren <cnehren+bugtraq@...ox.com>)
WWW File Share Pro v7.0 - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

September 2 (26 messages)

Re: [FD] SSH host key fingerprint - through HTTPS (maxigas <maxigas@...rgeek.net>)
[SECURITY] [DSA 3016-1] lua5.2 security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3015-1] lua5.1 security update (Florian Weimer <fw@...eb.enyo.de>)
Re: [FD] SSH host key fingerprint - through HTTPS (Jeroen van der Ham <jeroen@...d.nl>)
Re: [FD] SSH host key fingerprint - through HTTPS (john <mail@...nbond.org>)
Re: SSH host key fingerprint - through HTTPS (Lukasz Biegaj <l.biegaj@...shock.pl>)
Re: SSH host key fingerprint - through HTTPS (Jamie Riden <jamie.riden@...il.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
Re: SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
[ MDVSA-2014:160 ] gpgme (security@...driva.com)
[ MDVSA-2014:161 ] subversion (security@...driva.com)
[ MDVSA-2014:162 ] catfish (security@...driva.com)
[ MDVSA-2014:164 ] phpmyadmin (security@...driva.com)
[ MDVSA-2014:163 ] python-imaging (security@...driva.com)
[ MDVSA-2014:165 ] krb5 (security@...driva.com)
[ MDVSA-2014:166 ] serf (security@...driva.com)
[ MDVSA-2014:167 ] file (security@...driva.com)
[ MDVSA-2014:168 ] libvncserver (security@...driva.com)
[ MDVSA-2014:169 ] bugzilla (security@...driva.com)
[ MDVSA-2014:170 ] jakarta-commons-httpclient (security@...driva.com)
[ MDVSA-2014:171 ] dhcpcd (security@...driva.com)
Defense in depth -- the Microsoft way (part 18): Microsoft Office 2010 registers command lines with unquoted pathnames ("Stefan Kanthak" <stefan.kanthak@...go.…)
Apple iOS v7.1.2 - Merge Apps Service Local Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3017-1] php-cas security update (Thijs Kinkhorst <thijs@...ian.org>)

September 3 (8 messages)

[security bulletin] HPSBGN03099 rev.1 - HP IceWall SSO Dfw, SSO Agent and MCRP running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[CORE-2014-0005] - Advantech WebAccess Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
Re: ntopng 1.2.0 XSS injection using monitored network traffic (Steffen Bauch <mail@...ffenbauch.de>)
[ MDVSA-2014:173 ] busybox (security@...driva.com)
[ MDVSA-2014:172 ] php (security@...driva.com)
[SECURITY] [DSA 3018-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
Reflected Cross-Site Scripting (XSS) in BlackCat CMS (High-Tech Bridge Security Research <advisory@...ridge.com>)
Reflected Cross-Site Scripting (XSS) in MyWebSQL (High-Tech Bridge Security Research <advisory@...ridge.com>)

September 4 (3 messages)

[security bulletin] HPSBMU03083 rev.2 - HP BladeSystem c-Class Virtual Connect Firmware running OpenSSL, Remote Unauthorized Access or Dis… (security-alert@...com)
Avolve Software ProjectDox Multiple Vulnerability Disclosure ("Romano, Christian" <cromano@...nes.com>)
[ MDVSA-2014:174 ] apache (security@...driva.com)

September 8 (18 messages)

Uninit memory disclosure via truncated images in Firefox (Michal Zalewski <lcamtuf@...edump.cx>)
[SECURITY] [DSA 3019-1] procmail security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2014:175 ] glibc (security@...driva.com)
[WorldCIST'15]: Call for Workshops Proposals; Best papers published in ISI Journals ("ML" <marialemos72@...il.com>)
apache tomcat cookie handling problem - characters out of 0x80 - 0xff causing internal server error (Elar Lang <elarlang@...il.com>)
[ MDVSA-2014:176 ] libgcrypt (security@...driva.com)
[ MDVSA-2014:177 ] squid (security@...driva.com)
[ MDVSA-2014:178 ] ppp (security@...driva.com)
[ MDVSA-2014:179 ] python-django (security@...driva.com)
[slackware-security] mozilla-firefox (SSA:2014-247-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-thunderbird (SSA:2014-247-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] php (SSA:2014-247-01) (Slackware Security Team <security@...ckware.com>)
[security bulletin] HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat or PHP, Remote Execution of Arbitrary C… (security-alert@...com)
Defense in depth -- the Microsoft way (part 19): still no "perfect forward secrecy" per default in Windows 8/7/Vista/Ser… ("Stefan Kanthak" <stefan.kanthak@...go.…)
t2’14 Challenge to be released 2014-09-13 10:00 EEST ("Tomi Tuominen" <tomi.tuominen@...fi>)
CVE-2014-5391 DOM-based Cross-Site Scripting (XSS) in "JobScheduler" (Christian Schneider <mail@...istian-Schneider.net>)
CVE-2014-5393 Path Traversal to Sensitive Files in Webroot in "JobScheduler" (Christian Schneider <mail@...istian-Schneider.net>)
CVE-2014-5392 XML eXternal Entity (XXE) in "JobScheduler" (Christian Schneider <mail@...istian-Schneider.net>)

September 9 (5 messages)

[security bulletin] HPSBST03106 rev.1 - HP P2000 G3 MSA Array System running OpenSSL, Remote Unauthorized Access or Disclosure of Informat… (security-alert@...com)
IBM WebSphere Application Server (WAS) Integrated Solutions Console Login Page username Parameter Reflected XSS Security Vulnerability (main@...cnamara.com)
Cisco Security Advisory: Cisco Unified Computing System E-Series Blade Servers Cisco Integrated Management Controller SS… (Cisco Systems Product Security Incident…)
FreeBSD Security Advisory FreeBSD-SA-14:18.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 3021-1] file security update (Luciano Bello <luciano@...ian.org>)

September 10 (6 messages)

Re: Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities (sales@...chatrooms.com)
NEW VMSA-2014-0008 VMware vSphere product updates to third party libraries (VMware Security Response Center <security@...are.com>)
[security bulletin] HPSBMU03075 rev.1 - HP Network Node Manager I (NNMi) for Windows and Linux, Remote Execution of Arbitrary Code (security-alert@...com)
[slackware-security] seamonkey (SSA:2014-252-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] CVE-2013-4444 Remote Code Execution in Apache Tomcat (Mark Thomas <markt@...che.org>)
[SECURITY] [DSA 3020-1] acpi-support security update (Raphael Geissert <geissert@...ian.org>)

September 11 (6 messages)

[SECURITY] [DSA 3022-1] curl security update (Yves-Alexis Perez <corsac@...ian.org>)
[SECURITY] [DSA 3021-2] file regression update (Luciano Bello <luciano@...ian.org>)
PhotoSync v2.2 iOS - Command Inject Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Photorange v1.0 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Call for Participation: Semantic Web Business and Innovation (SWBI2015) * Switzerland (jackie@...wc.info)

September 12 (4 messages)

NEW VMSA-2014-0009 VMware NSX and vCNS product updates address a critical information disclosure vulnerability (VMware Security Response Center <security@...ar…)
[SECURITY] [DSA 3023-1] bind9 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3024-1] gnupg security update (Thijs Kinkhorst <thijs@...ian.org>)
HttpFileServer 2.3.x Remote Command Execution (danielelinguaglossa@...il.com)

September 15 (6 messages)

[security bulletin] HPSBOV03099 rev.1 - HP OpenVMS running OpenSSL, Remote Denial of Service (DoS) or Disclosure of Information (security-alert@...com)
Re: HttpFileServer 2.3.x Remote Command Execution (danielelinguaglossa@...il.com)
Multiple Vulnerabilities with Aztech Modem Routers (Federick Joe P Fajardo <fjpfajardo@...ibm.com>)
Open-Xchange Security Advisory 2014-09-15 (Martin Heiland <martin.heiland@...n-xchange.com>)
Passwords^14 Norway - CFP (Per Thorsheim <per@...rsheim.net>)
Briefcase 4.0 iOS - Code Execution & File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

September 16 (1 message)

ESA-2014-091: EMC Documentum Content Server Multiple Privilege Escalation Vulnerabilities (Security Alert <Security_Alert@....com>)

September 17 (14 messages)

FreeBSD Security Advisory FreeBSD-SA-14:19.tcp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Osclass Security Advisory - LFI Vulnerability - CVE-2014-6308 (Onur Yilmaz <onur@...sparker.com>)
Osclass Security Advisory - Multiple XSS Vulnerabilities - CVE-2014-6280 (Onur Yilmaz <onur@...sparker.com>)
USB&WiFi Flash Drive v1.3 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3025-1] apt security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3026-1] dbus security update (Florian Weimer <fw@...eb.enyo.de>)
[CORE-2014-0006] - Delphi and C++ Builder VCL library Heap Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)
Android Bluetooth Pairing Packet Processing Vulnerability（by wangzq from NCNIPC） (vuln@...c.org.cn)
MIUI Wifi Connection Message Vulnerability (vuln@...c.org.cn)
MIUI Torch Open Vulnerability (vuln@...c.org.cn)
Path Traversal in webEdition (High-Tech Bridge Security Research <advisory@...ridge.com>)
Reflected Cross-Site Scripting (XSS) in MODX Revolution (High-Tech Bridge Security Research <advisory@...ridge.com>)
APPLE-SA-2014-09-17-1 iOS 8 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-09-17-2 Apple TV 7 (Apple Product Security <product-security-noreply@...ts.apple.com>)

September 19 (16 messages)

[SECURITY] [DSA 3027-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3028-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE ID Syntax Change - Deadline Approaching ("Christey, Steven M." <coley@...re.org>)
APPLE-SA-2014-09-17-4 Safari 6.2 and Safari 7.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-09-17-3 OS X Mavericks 10.9.5 and Security Update 2014-004 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-09-17-5 OS X Server 3.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-09-17-6 OS X Server 2.2.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Apple iOS / OSX Foundation NSXMLParser XML eXternal Entity (XXE) Flaw (VSR Advisories <advisories@...curity.com>)
Apple iOS / OSX Foundation NSXMLParser XML eXternal Entity (XXE) Flaw (VSR Advisories <advisories@...curity.com>)
Oracle Corporation MyOracle - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
APPLE-SA-2014-09-17-7 Xcode 6.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
CVE ID Syntax Change - Deadline Approaching ("Christey, Steven M." <coley@...re.org>)
AST-2014-009: Remote crash based on malformed SIP subscription requests ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-010: Remote crash when handling out of call message in certain dialplan configurations ("Asterisk Security Team" <security@...erisk.org>)
[SECURITY] [DSA 3025-2] apt regression update (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Multiple Vulnerabilities with Aztech Modem Routers (Federick Joe P Fajardo <fjpfajardo@...ibm.com>)

September 22 (5 messages)

[SECURITY] [DSA 3029-1] nginx security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3030-1] mantis security update (Moritz Muehlenhoff <jmm@...ian.org>)
TP-LINK WDR4300 - Stored XSS & DoS (ozelisyan@...il.com)
Strength and Weakness of Methods to Confirm SSH Host Key (John Leo <johnleo@...ckssh.com>)
CVE-2014-5516 CSRF protection bypass in "KonaKart" Java eCommerce product (Christian Schneider <mail@...istian-Schneider.net>)

September 23 (7 messages)

[ MDVSA-2014:180 ] gnupg (security@...driva.com)
Glype proxy cookie jar path traversal allows code execution ("Securify B.V." <lists@...urify.nl>)
Re: TP-LINK WDR4300 - Stored XSS & DoS (ozelisyan@...il.com)
[security bulletin] HPSBPI03107 rev.1 - Certain HP LaserJet Printers, MFPs and Certain HP OfficeJet Enterprise Printers using OpenSSL, Rem… (security-alert@...com)
Glype proxy local address filter bypass ("Securify B.V." <lists@...urify.nl>)
Re: TP-LINK WDR4300 - Stored XSS & DoS (Simon Waters <simon.waters@...evine.com>)
Glype proxy privacy settings can be disabled via CSRF ("Securify B.V." <lists@...urify.nl>)

September 24 (4 messages)

[KIS-2014-09] X2Engine <= 4.1.7 (SiteController.php) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2014-10] X2Engine <= 4.1.7 (FileUploadsFilter.php) Unrestricted File Upload Vulnerability (Egidio Romano <research@...mainsecurity.com>)
CVE-2014-6603 suricata 2.0.3 Out-of-bounds access in SSH parser (Steffen Bauch <mail@...ffenbauch.de>)
[SECURITY] [DSA 3031-1] apt security update (Salvatore Bonaccorso <carnil@...ian.org>)

September 25 (27 messages)

Two SQL Injections in All In One WP Security WordPress plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)
[SECURITY] [DSA 3032-1] bash security update (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2014:183 ] phpmyadmin (security@...driva.com)
[ MDVSA-2014:185 ] libgadu (security@...driva.com)
[ MDVSA-2014:181 ] dump (security@...driva.com)
[ MDVSA-2014:182 ] zarafa (security@...driva.com)
[ MDVSA-2014:183 ] phpmyadmin (security@...driva.com)
[ MDVSA-2014:184 ] net-snmp (security@...driva.com)
Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Metadata Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software DHCP Version 6 Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.…)
Cisco Security Advisory: Cisco IOS Software Network Address Translation Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team …)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco IOS Software Multicast Domain Name System (Cisco Systems Product Security Incident Response Team <ps…)
Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team …)
[ MDVSA-2014:186 ] bash (security@...driva.com)
Re: [FD] Strength and Weakness of Methods to Confirm SSH Host Key (Gunnar Wolf <gwolf@...lf.org>)
[security bulletin] HPSBST03103 rev.1 - HP Storage EVA Command View Suite running OpenSSL, Remote Unauthorized Access, Disclosure of Infor… (security-alert@...com)
[SECURITY] [DSA 3033-1] nss security update (Yves-Alexis Perez <corsac@...ian.org>)
CVE-2014-4958: Stored Attribute-Based Cross-Site Scripting (XSS) Vulnerability in Telerik UI for ASP.NET AJAX RadEditor Control (main@...cnamara.com)
[SECURITY] [DSA 3034-1] iceweasel security update (Yves-Alexis Perez <corsac@...ian.org>)
[ MDVSA-2014:188 ] wireshark (security@...driva.com)
[ MDVSA-2014:187 ] curl (security@...driva.com)
[ MDVSA-2014:189 ] nss (security@...driva.com)
LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow (advisories <advisories@...xperts.de>)
[slackware-security] mozilla-nss (SSA:2014-267-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] bash (SSA:2014-267-01) (Slackware Security Team <security@...ckware.com>)
[oCERT-2014-007] libvncserver multiple issues (Andrea Barisani <lcars@...rt.org>)

September 26 (11 messages)

[slackware-security] bash (rebuild for Slackware 13.0 only) (SSA:2014-268-02) (Slackware Security Team <security@...ckware.com>)
Cisco Security Advisory: GNU Bash Environmental Variable Command Injection Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
[SECURITY] [DSA 3035-1] bash security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3036-1] mediawiki security update (Thijs Kinkhorst <thijs@...ian.org>)
[slackware-security] bash (SSA:2014-268-01) (Slackware Security Team <security@...ckware.com>)
[ MDVSA-2014:190 ] bash (security@...driva.com)
GS Foto Uebertraeger v3.0 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Paypal Inc Bug Bounty #32 - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Paypal Inc Bug Bounty #16 - Persistent Mail Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Oracle Corporation MyOracle - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
SmarterTools Smarter Track 6-10 - Information Disclosure Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

September 29 (10 messages)

[SECURITY] [DSA 3037-1] icedove security update (Yves-Alexis Perez <corsac@...ian.org>)
WorldCIST 2015 - 3rd World Conference on Information Systems and Technologies ("ML" <marialemos72@...il.com>)
Hands-on Mobile (Android & iOS) + ARM Exploitation Training at Toorcon (Aditya Gupta <adi0x90@...il.com>)
[SECURITY] [DSA 3038-1] libvirt security update (Salvatore Bonaccorso <carnil@...ian.org>)
[The ManageOwnage Series, part V]: RCE / file upload / arbitrary file deletion in OpManager, Social IT and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[SECURITY] [DSA 3039-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[slackware-security] mozilla-firefox (SSA:2014-271-01) (Slackware Security Team <security@...ckware.com>)
Moab Authentication Bypass [CVE-2014-5300] (john.fitzpatrick@...infosecurity.com)
Moab User Impersonation [CVE-2014-5375] (john.fitzpatrick@...infosecurity.com)
Moab Authentication Bypass (insecure message signing) [CVE-2014-5376] (john.fitzpatrick@...infosecurity.com)

September 30 (5 messages)

[ MDVSA-2014:191 ] perl-XML-DT (security@...driva.com)
[slackware-security] mozilla-thunderbird (SSA:2014-271-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2014-271-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] bash (SSA:2014-272-01) (Slackware Security Team <security@...ckware.com>)
London DEFCON - September 30th 2014 (Major Malfunction <majormal@...ate-radio.org>)

192 messages

Powered by blists - more mailing lists