bugtraq mailing list - 2015/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 6	²	³	⁴
⁵ 7	⁶ 5	⁷ 4	⁸ 15	⁹ 4	¹⁰	¹¹
¹² 15	¹³ 13	¹⁴ 4	¹⁵ 7	¹⁶ 8	¹⁷	¹⁸
¹⁹ 8	²⁰ 3	²¹ 2	²² 14	²³ 4	²⁴	²⁵
²⁶	²⁷ 16	²⁸ 10	²⁹ 10	³⁰ 8	³¹

Messages by day:

January 1 (6 messages)

[SECURITY] [DSA 3117-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[KIS-2014-14] Osclass <= 3.4.2 (Search::setJsonAlert) SQL Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2014-15] Osclass <= 3.4.2 (ajax.php) Local File Inclusion Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2014-16] Osclass <= 3.4.2 (contact.php) Unrestricted File Upload Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2014-18] Mantis Bug Tracker <= 1.2.17 (ImportXml.php) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2014-19] Symantec Web Gateway <= 5.2.1 (restore.php) OS Command Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

January 5 (7 messages)

[The ManageOwnage Series, part XI]: Remote code execution in ServiceDesk, Asset Explorer, Support Center and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[ MDVSA-2015:004 ] php (security@...driva.com)
[ MDVSA-2015:003 ] ntp (security@...driva.com)
[SECURITY] [DSA 3118-1] strongswan security update (Yves-Alexis Perez <corsac@...ian.org>)
Open-Xchange Security Advisory 2015-01-05 (Martin Heiland <martin.heiland@...n-xchange.com>)
[ MDVSA-2015:002 ] pcre (security@...driva.com)
[ MDVSA-2015:001 ] c-icap (security@...driva.com)

January 6 (5 messages)

[SECURITY] [DSA 3119-1] libevent security update (Salvatore Bonaccorso <carnil@...ian.org>)
ESA-2014-180: EMC Documentum Web Development Kit Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
Re: [The ManageOwnage Series, part X]: 0-day administrator account creation in Desktop Central (Pedro Ribeiro <pedrib@...il.com>)
[ MDVSA-2015:005 ] subversion (security@...driva.com)
ZTE Datacard MF19 0V1.0.0B PCW - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 7 (4 messages)

Self-XSS in Microsoft Dynamics CRM 2013 SP1 (High-Tech Bridge Security Research <advisory@...ridge.com>)
Brother MFC Administration Reflected Cross-Site Scripting (vulns@...nach.com)
[SECURITY] [DSA 3120-1] mantis security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBMU03118 rev.3 - HP Systems Insight Manager (SIM) on Linux and Windows, Multiple Remote Vulnerabilities (security-alert@...com)

January 8 (15 messages)

[ MDVSA-2015:006 ] mediawiki (security@...driva.com)
[ MDVSA-2015:007 ] unrtf (security@...driva.com)
[ MDVSA-2015:008 ] pwgen (security@...driva.com)
[ MDVSA-2015:009 ] krb5 (security@...driva.com)
[ MDVSA-2015:010 ] file (security@...driva.com)
[ MDVSA-2015:011 ] nail (security@...driva.com)
[ MDVSA-2015:012 ] jasper (security@...driva.com)
[ MDVSA-2015:013 ] znc (security@...driva.com)
[ MDVSA-2015:014 ] libjpeg (security@...driva.com)
[ MDVSA-2015:015 ] sox (security@...driva.com)
[ MDVSA-2015:016 ] unzip (security@...driva.com)
[ MDVSA-2015:017 ] libevent (security@...driva.com)
[ MDVSA-2015:018 ] asterisk (security@...driva.com)
Recon 2015 Call For Papers - June 19 - 21, 2015 - Montreal, Canada (root@...on.cx (root))
[SECURITY] [DSA 3121-1] file security update (Moritz Muehlenhoff <jmm@...ian.org>)

January 9 (4 messages)

[SECURITY] [DSA 3122-1] curl security update (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [SECURITY] [DSA 3122-1] curl security update (U2ME236@...IL.COM)
Re: ResourceSpace Multiple Cross Site Scripting, and HTML and SQL Injection Vulnerabilities (dan@...tala.com)
[ MDVSA-2015:019 ] openssl (security@...driva.com)

January 12 (15 messages)

[security bulletin] HPSBOV03227 rev.1 - HP SSL for OpenVMS, Remote Disclosure of Information, Denial of Service (DoS) and Other Vulnerabil… (security-alert@...com)
Wordpress plugin Pods <= 2.4.3 XSS and CSRF vulnerabilities (Pietro Oliva <pietroliva@...il.com>)
[SECURITY] [DSA 3124-1] otrs2 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3125-1] openssl security update (Salvatore Bonaccorso <carnil@...ian.org>)
Blitz CMS Community - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Heroku API Deep Dive Bug Bounty #3 - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Heroku API Bug Bounty #1 - Persistent Invitation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ZTE Datacard PCW(Telecom MF180) - Multiple Software Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2015:020 ] libssh (security@...driva.com)
[ MDVSA-2015:021 ] curl (security@...driva.com)
[ MDVSA-2015:022 ] wireshark (security@...driva.com)
[RT-SA-2014-015] Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
CVE-2014-8870: Arbitrary Redirect in Tapatalk Plugin for WoltLab Burning Board 4.0 (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
Corel Software DLL Hijacking (CORE Advisories Team <advisories@...esecurity.com>)
[SECURITY] [DSA 3126-1] php5 security update (Thijs Kinkhorst <thijs@...ian.org>)

January 13 (13 messages)

Stored XSS Vulnerability in F5 BIG-IP Application Security Manager (Peter Lapp <lappsec@...il.com>)
[Corrected] Stored XSS Vulnerability in F5 BIG-IP Application Security Manager (Peter Lapp <lappsec@...il.com>)
[security bulletin] HPSBOV03228 rev.1 - HP OpenVMS running Bash Shell, Remote Code Execution (security-alert@...com)
MS14-080 CVE-2014-6365 Technical Details Without "Nonsense" (Diéyǔ <dieyu@...yu.org>)
SEC Consult SA-20150113-0 :: Multiple critical vulnerabilities in all snom desktop IP phones (SEC Consult Vulnerability Lab <research@...-consult.com>)
CVE-2015-0203: Apache Qpid's qpidd can be crashed by authenticated user (Gordon Sim <gsim@...che.org>)
SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower (SEC Consult Vulnerability Lab <research@...-consult.com>)
SEC Consult SA-20150113-2 :: Cross-Site Request Forgery in XBMC / Kodi (SEC Consult Vulnerability Lab <research@...-consult.com>)
[security bulletin] HPSBMU03230 rev.1 - HP Insight Control server deployment Remote Disclosure of Information (security-alert@...com)
Foxit MobilePDF v4.4.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Sitefinity Enterprise v7.2.53 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3123-2] binutils-mingw-w64 security update (Thijs Kinkhorst <thijs@...ian.org>)
[security bulletin] HPSBGN03233 rev.1 - HP OneView running OpenSSL, Remote Denial of Service (DoS), Unauthorized Access, and Disclosure of… (security-alert@...com)

January 14 (4 messages)

AusCERT2015 Call for Papers: closes 18th January (AusCERT <auscert@...cert.org.au>)
MS14-080 CVE-2014-6365 Code (Diéyǔ <dieyu@...yu.org>)
Two XSS vulnerabilities in Simple Security WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)
[SECURITY] [DSA 3127-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)

January 15 (7 messages)

FreeBSD Security Advisory FreeBSD-SA-15:01.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 3128-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2015:023 ] libvirt (security@...driva.com)
[ MDVSA-2015:024 ] libsndfile (security@...driva.com)
[ MDVSA-2015:026 ] untrf (security@...driva.com)
[ MDVSA-2015:025 ] mpfr (security@...driva.com)
Alienvault OSSIM/USM Command Execution Vulnerability (Peter Lapp <lappsec@...il.com>)

January 16 (8 messages)

[SECURITY] [DSA 3129-1] rpm security update (Moritz Muehlenhoff <jmm@...ian.org>)
CatBot v0.4.2 (PHP) - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
VeryPhoto v3.0 iOS - Command Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Pandora FMS v5.1 SP1 - Persistent SNMP Editor Vulnerability ("admin@...lution-sec.com" <admin@...lution-sec.com>)
File Pro Mini v5.2 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Facebook Bug Bounty #19 - Filter Bypass Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[ MDVSA-2015:027 ] kernel (security@...driva.com)

January 19 (8 messages)

[slackware-security] mozilla-thunderbird (SSA:2015-016-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] freetype (SSA:2015-016-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2015-016-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2015-016-04) (Slackware Security Team <security@...ckware.com>)
CVE-2015-1032 Kiwix Cross-Site Scripting Vulnerability (Riley Baird <BM-2cVqnDuYbAU5do2DfJTrN7ZbAJ246S4Xix@...message.ch>)
[SECURITY] [DSA 3131-1] xdg-utils security update (Michael Gilbert <mgilbert@...ian.org>)
MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities (Advisories <advisories@...waisecurity.de>)
[SECURITY] [DSA 3132-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)

January 20 (3 messages)

CVE-2015-1175-xss-prestashop (Sudhanshu Chauhan <sudhanshu@...ogence.com>)
ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3133-1] privoxy security update (Moritz Muehlenhoff <jmm@...ian.org>)

January 21 (2 messages)

[SECURITY] [DSA 3134-1] sympa security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBUX03235 SSRT101750 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) (security-alert@...com)

January 22 (14 messages)

[oCERT-2015-001] JasPer input sanitization errors (Andrea Barisani <lcars@...rt.org>)
PhotoSync v1.1.3 Android - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[RT-SA-2014-010] AVM FRITZ!Box Firmware Signature Bypass (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
iExplorer 3.6.3 - DLL Hijacking Exploit itunesmobiledevice.dll (Vulnerability Lab <research@...nerability-lab.com>)
Remote Desktop v0.9.4 Android - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[slackware-security] samba (SSA:2015-020-01) (Slackware Security Team <security@...ckware.com>)
CVE-2015-1176-xss-osticket (Sudhanshu Chauhan <sudhanshu@...ogence.com>)
SEC Consult SA-20150122-0 :: Multiple critical vulnerabilities in Symantec Data Center Security: Server Advanced (SDCS:… (SEC Consult Vulnerability Lab <research…)
CVE-2015-1177-xss-exponent (Sudhanshu Chauhan <sudhanshu@...ogence.com>)
CVE-2015-1178-xss-x-cart-ecommerce (Sudhanshu Chauhan <sudhanshu@...ogence.com>)
CVE-2015-1179-xss-mango-automation-scada (Sudhanshu Chauhan <sudhanshu@...ogence.com>)
CVE-2015-1180-xss-eventsentry (Sudhanshu Chauhan <sudhanshu@...ogence.com>)
Program-O v2.4.6 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
PhotoSync 1.1.3 Android - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 23 (4 messages)

[HITB-Announce] #HITB2015AMS Call for Papers 1st Round is Closing in 10 Days (Hafez Kamal <aphesz@...kinthebox.org>)
REWTERZ-20140101 - ManageEngine ServiceDesk SQL Injection Vulnerability (Rewterz - Research Group <advisories@...terz.com>)
REWTERZ-20140102 - ManageEngine ServiceDesk Plus User Enumeration Vulnerability (Rewterz - Research Group <advisories@...terz.com>)
Fwd: REWTERZ-20140103 - ManageEngine ServiceDesk Plus User Privileges Management Vulnerability (Rewterz - Research Group <advisories@...terz.com>)

January 27 (16 messages)

WebKitGTK+ Security Advisory WSA-2015-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
[CORE-2015-0002] - Android WiFi-Direct Denial of Service (CORE Advisories Team <advisories@...esecurity.com>)
CVE-2015-0224: qpidd can be crashed by unauthenticated user (Gordon Sim <gsim@...che.org>)
CVE-2015-0223: anonymous access to qpidd cannot be prevented (Gordon Sim <gsim@...che.org>)
[SYSS-2014-012] FancyFon FAMOC - Session Fixation (matthias.deeg@...s.de)
[SYSS-2014-011] FancyFon FAMOC - Cross-Site Scripting (matthias.deeg@...s.de)
[SYSS-2014-013] FancyFon FAMOC - Use of a One-Way Hash without a Salt (matthias.deeg@...s.de)
[SECURITY] [DSA 3140-1] xen security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SYSS-2014-010] FancyFon FAMOC - SQL Injection (matthias.deeg@...s.de)
[SECURITY] [DSA 3141-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3142-1] eglibc security update (Florian Weimer <fw@...eb.enyo.de>)
Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Qualys Security Advisory <qsa@...lys.com>)
APPLE-SA-2015-01-27-1 Apple TV 7.0.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-01-27-2 iOS 8.1.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-01-27-3 Safari 8.0.3, Safari 7.1.3, and Safari 6.2.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-01-27-4 OS X 10.10.2 and Security Update 2015-001 (Apple Product Security <product-security-noreply@...ts.apple.com>)

January 28 (10 messages)

FreeBSD Security Advisory FreeBSD-SA-15:02.kmem (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-15:03.sctp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[CORE-2015-0003] - FreeBSD Kernel Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
NEW VMSA-2015-0001 - VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address resolve security issu… (VMware Security Response Center <securi…)
[AMPLIA-ARA100614] OS X Gatekeeper Bypass Vulnerability (Amplia Security Advisories <advisories@...liasecurity.com>)
[CVE-2015-1394] Photo Gallery (Wordpress Plugin) - Multiple XSS Vulnerabilities Version 1.2.8 (sven@...daemon.org)
[CVE-2015-1393] Photo Gallery (Wordpress Plugin) - SQL Injection in Version 1.2.8 (sven@...daemon.org)
Two XSS Vulnerabilities in SupportCenter Plus (High-Tech Bridge Security Research <advisory@...ridge.com>)
Multiple vulnerabilities in MantisBT (High-Tech Bridge Security Research <advisory@...ridge.com>)
[SECURITY] [DSA 3143-1] virtualbox security update (Moritz Muehlenhoff <jmm@...ian.org>)

January 29 (10 messages)

KL-001-2015-001 : Windows 2003 tcpip.sys Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
[slackware-security] glibc (SSA:2015-028-01) (Slackware Security Team <security@...ckware.com>)
AST-2015-001: File descriptor leak when incompatible codecs are offered ("Asterisk Security Team" <security@...erisk.org>)
Cisco Security Advisory: GNU glibc gethostbyname Function Buffer Overflow Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360) (Pedro Ribeiro <pedrib@...il.com>)
CVE-2014-8779: SSH Host keys on Pexip Infinity (giles@...ip.com)
Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385 (Onur Yilmaz <onur@...sparker.com>)
ESA-2015-002: Unisphere Central Security Update for Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
Reflected XSS vulnarbility in Asus RT-N10 Plus Router (kingkaustubh@...com)
Unauthenticated Reflected XSS vulnarbility in Asus RT-N10 Plus router (kingkaustubh@...com)

January 30 (8 messages)

Symantec Encryption Management Server < 3.2.0MP6 - Remote Command Injection (Paul Craig <lists@...tagepoint.sg>)
NEW VMSA-2015-0002 VMware vSphere Data Protection product update addresses a certificate validation vulnerability (VMware Security Response Center <security@vm…)
[SECURITY] [DSA 3144-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3145-1] privoxy security update (Salvatore Bonaccorso <carnil@...ian.org>)
ESA-2015-006: EMC Avamar Missing Certificate Validation Vulnerability (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3146-1] requests security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3147-1] openjdk-6 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBOV03226 rev.2 - HP TCP/IP Services for OpenVMS, BIND 9 Server Resolver, Multiple Remote Vulnerabilities (security-alert@...com)

163 messages

Powered by blists - more mailing lists