bugtraq mailing list - 2014/11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 5	⁴ 7	⁵ 15	⁶ 10	⁷ 11	⁸	⁹
¹⁰ 8	¹¹	¹² 17	¹³ 5	¹⁴	¹⁵	¹⁶
¹⁷ 5	¹⁸ 10	¹⁹ 8	²⁰ 4	²¹ 18	²²	²³
²⁴ 2	²⁵ 8	²⁶ 10	²⁷ 6	²⁸ 6	²⁹	³⁰

Messages by day:

November 3 (5 messages)

[SECURITY] [DSA 3061-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
"Aircrack-ng 1.2 Beta 3" multiple vulnerabilities (n.sampanis@...ela.com)
PARSADEV CMS Cross-Site Scripting Vulnerability (iedb.team@...il.com)
[SECURITY] [DSA 3063-1] quassel security update (Luciano Bello <luciano@...ian.org>)
[SECURITY] [DSA 3062-1] wget security update (Luciano Bello <luciano@...ian.org>)

November 4 (7 messages)

CFP: Fourth World Congress - SEMCMI2015 - Malaysia (Conference Updates <jackie@...wc.info>)
Ahrareandeysheh CMS Cross-Site Scripting Vulnerability (iedb.team@...il.com)
Modx CMS CSRF Bypass & XSS Vulnerabilities (bhati.contact@...il.com)
[slackware-security] seamonkey (SSA:2014-307-04) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mariadb (SSA:2014-307-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2014-307-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] php (SSA:2014-307-03) (Slackware Security Team <security@...ckware.com>)

November 5 (15 messages)

[Appcheck-NG] Unpatched Vulnerabilities in Magento E-Commerce Platform (AppCheck_Advisories <advisories@...check-ng.com>)
[SECURITY] [DSA 3064-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Call for Papers - WorldCIST'15 - Best papers published in JCR/SCI journals ("ML" <marialemos72@...il.com>)
Reflected Cross-Site Scripting (XSS) in Flash Version of Flowplayer (subs@...uard.info)
[security bulletin] HPSBUX03162 SSRT101767 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Unauthorized Access, Man-in-the-… (security-alert@...com)
FreeBSD Security Advisory FreeBSD-SA-14:24.sshd (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:25.setlogin (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:26.ftp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read (KoreLogic Disclosures <disclosures@...elogic.com>)
CVE-2014-6617 Softing FG-100 Backdoor Account ("Ingmar Rosenhagen" <ingmar.rosenhagen@...c.de>)
CVE-2014-6616 Softing FG-100 Webui XSS ("Ingmar Rosenhagen" <ingmar.rosenhagen@...c.de>)
Wordpress bulletproof-security <=.51 multiple vulnerabilities (Pietro Oliva <pietroliva@...il.com>)
Two Reflected Cross-Site Scripting (XSS) Vulnerabilities in Forma Lms (High-Tech Bridge Security Research <advisory@...ridge.com>)
Arbitrary File Upload in HelpDEZk (High-Tech Bridge Security Research <advisory@...ridge.com>)
WordPress Wordfence Firewall 5.1.2 Cross Site Scripting (bhati.contact@...il.com)

November 6 (10 messages)

ESA-2014-135: RSA® Web Threat Detection SQL Injection Vulnerability (Security Alert <Security_Alert@....com>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Small Business RV Series Routers (Cisco Systems Product Security Incident Response Team <psirt@...co.…)
i.Hex Local Crash Poc (metacom27@...il.com)
i.Mage Local Crash Poc (metacom27@...il.com)
i-FTP Buffer Overflow SEH (metacom27@...il.com)
[The ManageOwnage Series, part VI]: 0day database info and superuser credential disclosure in EventLog Analyser (Pedro Ribeiro <pedrib@...il.com>)
Cisco RV Series multiple vulnerabilities ("Securify B.V." <lists@...urify.nl>)
SEC Consult SA-20141106-0 :: XXE & XSS & Arbitrary File Write vulnerabilities in Symantec Endpoint Protection (SEC Consult Vulnerability Lab <research@...-cons…)
[CVE-2014-8338] Cross Site Scripting (XSS) vulnerability in videowhisper (mdgh9@...oo.com)
[SECURITY] [DSA 3065-1] libxml-security-java security update (Sebastien Delafond <seb@...ian.org>)

November 7 (11 messages)

[SECURITY] [DSA 3066-1] qemu security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3067-1] qemu-kvm security update (Salvatore Bonaccorso <carnil@...ian.org>)
CA20141103-01: Security Notice for CA Cloud Service Management ("Kotas, Kevin J" <Kevin.Kotas@...com>)
ZTE ZXDSL 831CII Direct Object Reference (habte.yibelo@...il.com)
ZTE 831CII Multiple Vulnerablities (habte.yibelo@...il.com)
ZTE ZXDSL 831 Multiple Cross Site Scripting (habte.yibelo@...il.com)
XCloner Wordpress/Joomla! backup Plugin v3.1.1 (Wordpress) v3.5.1 (Joomla!) Vulnerabilities ("Larry W. Cashdollar" <larry0@...com>)
Insecure management of login credentials in PicsArt Photo Studio for Android [STIC-2014-0426] (Programa STIC <stic@...dacionsadosky.org.ar>)
FreeBSD Security Advisory FreeBSD-SA-14:24.sshd [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 3068-1] konversation security update (Moritz Muehlenhoff <jmm@...ian.org>)
Open-Xchange Security Advisory 2014-11-07 (Martin Heiland <martin.heiland@...n-xchange.com>)

November 10 (8 messages)

SeasonApps iTransfer 1.1 - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
BookFresh - Persistent Clients Invite Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
PayPal Inc BugBounty #107 MultiOrder Shipping (API) - Persistent History Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3069-1] curl security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2014-3629: Apache Qpid's qpidd can be induced to make http requests (Gordon Sim <gsim@...hat.com>)
[SECURITY] [DSA 3070-1] kfreebsd-9 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[The ManageOwnage Series, part VII]: Super admin privesc + password DB dump in Password Manager Pro (Pedro Ribeiro <pedrib@...il.com>)
[The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360 (Pedro Ribeiro <pedrib@...il.com>)

November 12 (17 messages)

[security bulletin] HPSBST03155 rev.1 - HP StoreFabric H-series switches running Bash Shell, Remote Code Execution (security-alert@...com)
[security bulletin] HPSBGN03117 rev.2 - HP Remote Device Access: Virtual Customer Access System (vCAS) running Bash Shell, Remote Code Exe… (security-alert@...com)
[security bulletin] HPSBGN03191 rev.1 - HP Remote Device Access: Virtual Customer Access System (vCAS) running lighttpd, Remote Disclosure… (security-alert@...com)
Missing SSL certificate validation in MercadoLibre app for Android [STIC-2014-0211] (Programa STIC <stic@...dacionsadosky.org.ar>)
[SECURITY] [DSA 3071-1] nss security update (Sebastien Delafond <seb@...ian.org>)
[security bulletin] HPSBUX03188 SSRT101487 rev.1 - HP-UX running HP Secure Shell, Remote Denial of Service (DoS) and other Vulnerabilities (security-alert@...com)
[security bulletin] HPSBMU03190 rev.1 - HP Helion Cloud Development Platform Community and Commercial Editions, Remote Unauthenticated Acc… (security-alert@...com)
[security bulletin] HPSBMU03184 rev.1 - HP SiteScope running SSL, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU03165 rev.1 - HP Propel running Bash Shell, Remote Code Execution (security-alert@...com)
[security bulletin] HPSBHF03124 rev.2 - HP Thin Clients running Bash Shell, Remote Execution of Code (security-alert@...com)
[security bulletin] HPSBST03181 rev.1 - HP StoreEver ESL G3 Tape Library running Bash Shell, Remote Code Execution (security-alert@...com)
[security bulletin] HPSBST03154 rev.1 - HP StoreFabric C-series MDS switches and HP C-series Nexus 5K switches running Bash Shell, Remote … (security-alert@...com)
[security bulletin] HPSBGN03164 rev.1 - HP IceWall SSO Dfw, SSO Certd and MCRP running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC) (ESNC Security <secure@...c.de>)
[SECURITY] [DSA 3072-1] file security update (Thijs Kinkhorst <thijs@...ian.org>)
CVE-2014-8731 - RCE in phpMemcachedAdmin <=1.2.2 (cert@...nrw.de)
CVE-2014-8732 (cert@...nrw.de)

November 13 (5 messages)

Prey Anti-Theft for Android missing SSL certificate validation [STIC-2014-0731] (Programa STIC <stic@...dacionsadosky.org.ar>)
[SECURITY] [DSA 3050-3] iceweasel security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBMU03182 rev.1 - HP Server Automation running Bash Shell, Remote Code Execution (security-alert@...com)
Re: CVE-2014-8731 - RCE in phpMemcachedAdmin <=1.2.2 (cert@...nrw.de)
Re: CVE-2014-8732 (cert@...nrw.de)

November 17 (5 messages)

CVE-2014-8682 Multiple Unauthenticated SQL Injections in Gogs (Timo Schmid <tschmid@...w.de>)
CVE-2014-8683 XSS in Gogs Markdown Renderer (Timo Schmid <tschmid@...w.de>)
[security bulletin] HPSBGN03192 rev.1 - HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL, Remote Disclosure … (security-alert@...com)
[SECURITY] [DSA 3073-1] libgcrypt11 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[slackware-security] mozilla-thunderbird (SSA:2014-320-01) (Slackware Security Team <security@...ckware.com>)

November 18 (10 messages)

APPLE-SA-2014-11-17-1 iOS 8.1.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-11-17-2 OS X Yosemite 10.10.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-11-17-3 Apple TV 7.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBMU03072 rev.3 - HP Data Protector, Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMU03183 rev.2 - HP Server Automation and Server Automation Virtual Appliance, running SSL, Remote Disclosure of In… (security-alert@...com)
CVE-2014-8769 tcpdump unreliable output using malformed AOVD payload (Steffen Bauch <mail@...ffenbauch.de>)
CVE-2014-8768 tcpdump denial of service in verbose mode using malformed Geonet payload (Steffen Bauch <mail@...ffenbauch.de>)
CVE-2014-8767 tcpdump denial of service in verbose mode using malformed OLSR payload (Steffen Bauch <mail@...ffenbauch.de>)
[ MDVSA-2014:214 ] dbus (security@...driva.com)
[ MDVSA-2014:213 ] curl (security@...driva.com)

November 19 (8 messages)

[SECURITY] [DSA 3074-1] php5 security update (Yves-Alexis Perez <corsac@...ian.org>)
[ MDVSA-2014:215 ] gnutls (security@...driva.com)
Reflected Cross-Site Scripting (XSS) in Simple Email Form Joomla Extension (High-Tech Bridge Security Research <advisory@...ridge.com>)
[SECURITY] [DSA 3074-2] php5 regression update (Yves-Alexis Perez <corsac@...ian.org>)
CVE-2014-7137 - Multiple SQL Injections in Dolibarr ERP & CRM (Portcullis Advisories <advisories@...tcullis-security.com>)
[CORE-2014-0009] - Advantech EKI-6340 Command Injection (CORE Advisories Team <advisories@...esecurity.com>)
[CORE-2014-0008] - Advantech AdamView Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)
[CORE-2014-0010] - Advantech WebAccess Stack-based Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)

November 20 (4 messages)

[ MDVSA-2014:216 ] php-ZendFramework (security@...driva.com)
[ MDVSA-2014:217 ] clamav (security@...driva.com)
CVE-2014-8877 - Code Injection in Wordpress CM Download Manager plugin (phi.n.le@...s.vn)
[SECURITY] [DSA 3075-1] drupal7 security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 21 (18 messages)

Multiple SQL Injection in SP Client Document Manager plugin (thai.q.dang@...s.vn)
AST-2014-014: High call load may result in hung channels in ConfBridge. ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-018: AMI permission escalation through DB dialplan function ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-017: <font size="3" style="font-size: 12pt">Permission escalation through ConfBridge actions/dialplan functions… ("Asterisk Security Team" <security@...e…)
AST-2014-016: Remote Crash Vulnerability in PJSIP channel driver ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-015: Remote Crash Vulnerability in PJSIP channel driver ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-013: PJSIP ACLs are not loaded on startup ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-012: Mixed IP address families in access control lists may permit unwanted traffic. ("Asterisk Security Team" <security@...erisk.org>)
WordPress 3 persistent script injection (Jouko Pynnonen <jouko@....fi>)
[ MDVSA-2014:218 ] asterisk (security@...driva.com)
[security bulletin] HPSBHF03052 rev.2 - HP Network Products running OpenSSL, Multiple Remote Vulnerabilities (security-alert@...com)
[ MDVSA-2014:219 ] srtp (security@...driva.com)
[ MDVSA-2014:220 ] qemu (security@...driva.com)
[ MDVSA-2014:221 ] php-smarty (security@...driva.com)
[ MDVSA-2014:222 ] libvirt (security@...driva.com)
[ MDVSA-2014:223 ] wireshark (security@...driva.com)
[ MDVSA-2014:224 ] krb5 (security@...driva.com)
[security bulletin] HPSBUX03087 SSRT101413 rev.2 - HP-UX CIFS Server (Samba), Remote Denial of Service (DoS), Execution of Arbitrary Code,… (security-alert@...com)

November 24 (2 messages)

Exploit for stealing backups on WP sites with WP-DB-Backup v2.2.4 plugin ("Larry W. Cashdollar" <larry0@...com>)
CVE-2014-8419 - CodeMeter Weak Service Permissions (ajs@...rdshield.com)

November 25 (8 messages)

Docker 1.3.2 - Security Advisory [24 Nov 2014] (Eric Windisch <eric.windisch@...ker.com>)
[oCERT 2014-008] libFLAC multiple issues (Daniele Bianco <danbia@...rt.org>)
[ MDVSA-2014:225 ] ruby (security@...driva.com)
[ MDVSA-2014:226 ] imagemagick (security@...driva.com)
[ MDVSA-2014:227 ] ffmpeg (security@...driva.com)
[security bulletin] HPSBMU03214 rev.1 - HP Systinet running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBST03148 rev.1 - HP StoreOnce Gen 2 Backup Systems running Bash Shell, Remote Code Execution (security-alert@...com)
Slider Revolution/Showbiz Pro shell upload exploit (simo@...xploit.com)

November 26 (10 messages)

[security bulletin] HPSBGN03201 rev.1 - HP Asset Manager running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBGN03203 rev.1 - HP CMS: UCMDB Browser running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBUX03166 SSRT101489 rev.1 - HP-UX running PAM libpam_updbe, Remote Authentication Bypass (security-alert@...com)
[SECURITY] [DSA 3076-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2014:228 ] phpmyadmin (security@...driva.com)
Сross-Site Request Forgery (CSRF) in xEpan (High-Tech Bridge Security Research <advisory@...ridge.com>)
CVE-2014-5439 - Root shell on Sniffit [with exploit] (Hector Marco <hecmargi@....es>)
[ MDVSA-2014:229 ] libvncserver (security@...driva.com)
[SECURITY] [DSA 3077-1] openjdk-6 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBGN03202 rev.1 - HP CMS: Configuration Manager running OpenSSL, Remote Disclosure of Information (security-alert@...com)

November 27 (6 messages)

[ MDVSA-2014:230 ] kernel (security@...driva.com)
[ MDVSA-2014:231 ] icecast (security@...driva.com)
[ MDVSA-2014:232 ] glibc (security@...driva.com)
[KIS-2014-13] Tuleap <= 7.6-4 (register.php) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[SECURITY] [DSA 3078-1] libksba security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2014:233 ] wordpress (security@...driva.com)

November 28 (6 messages)

[security bulletin] HPSBGN03209 rev.1 - HP Application Lifecycle Management running SSLv3, Remote Disclosure of Information (security-alert@...com)
Defense in depth -- the Microsoft way (part 22): no DEP in Windows' filesystem (and ASLR barely used) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[ MDVSA-2014:234 ] libksba (security@...driva.com)
[ MDVSA-2014:235 ] perl-Plack (security@...driva.com)
[ MDVSA-2014:236 ] file (security@...driva.com)
[ MDVSA-2014:237 ] perl-Mojolicious (security@...driva.com)

155 messages

Powered by blists - more mailing lists