bugtraq mailing list - 2015/02

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 11	³ 13	⁴ 11	⁵	⁶	⁷	⁸
⁹ 35	¹⁰ 15	¹¹ 11	¹² 9	¹³ 4	¹⁴	¹⁵
¹⁶ 7	¹⁷ 6	¹⁸ 4	¹⁹ 4	²⁰	²¹	²²
²³ 13	²⁴	²⁵	²⁶ 27	²⁷ 5	²⁸

Messages by day:

February 2 (11 messages)

Defense in depth -- the Microsoft way (part 27): the command line you get differs from the command line I use to call yo… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
[SECURITY] [DSA 3148-1] chromium-browser end of life (Michael Gilbert <mgilbert@...ian.org>)
Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384 (Onur Yilmaz <onur@...sparker.com>)
Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities ("ITAS Team" <itas.team@...s.vn>)
Microweber 0.95 - SQL Injection Vulnerability ("ITAS Team" <itas.team@...s.vn>)
Fork CMS 3.8.3 - XSS Vulnerability ("ITAS Team" <itas.team@...s.vn>)
[security bulletin] HPSBMU03236 rev.1 - HP Systems Insight Manager for Windows running Bash Shell, Remote Code Execution (security-alert@...com)
[SECURITY] [DSA 3150-1] vlc security update (Alessandro Ghedini <ghedo@...ian.org>)
[security bulletin] HPSBMU03239 rev.1 - HP UCMDB, Remote Disclosure of Information (security-alert@...com)
[SECURITY] [DSA 3149-1] condor security update (Sebastien Delafond <seb@...ian.org>)

February 3 (13 messages)

[security bulletin] HPSBGN03247 rev.1 - HP IceWall SSO Dfw using glibc, Remote Execution of Abitrary Code (security-alert@...com)
[security bulletin] HPSBGN03237 rev.1 - HP Insight Remote Support v7 Clients running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU03232 rev.3 - HP SiteScope, Remote Elevation of Privilege (security-alert@...com)
[CVE-2014-9331] ManageEngine Desktop Central CSRF vulnerability to add an Admin user advisory (mohamed.idris@...pag.com)
Re: [SECURITY] [DSA 3149-1] condor security update (xfrendnugroho@...oo.co.id)
articleFR CMS 3.0.5 - XSS vulnerability ("Tien Tran Dinh" <tien.d.tran@...s.vn>)
articleFR CMS 3.0.5 - SQL injection vulnerability ("Tien Tran Dinh" <tien.d.tran@...s.vn>)
articleFR CMS 3.0.5 - Arbitrary File Upload ("Tien Tran Dinh" <tien.d.tran@...s.vn>)
[SECURITY] [DSA 3151-1] python-django security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2014-5360 Landesk Management Suite XSS (Cross-Site Scripting) Security Vulnerability (alex_haynes@...look.com)
[SECURITY] [DSA 3152-1] unzip security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2015-1437 XSS In ASUS Router. (kingkaustubh@...com)
MITKRB5-SA-2015-001 Vulnerabilities in kadmind, libgssrpc, gss_process_context_token (Greg Hudson <ghudson@....edu>)

February 4 (11 messages)

[SECURITY] [DSA 3153-1] krb5 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[CVE-2015-1467] Fork CMS - SQL Injection in Version 3.8.5 (sven@...daemon.org)
Re: CVE-2015-1437 XSS In ASUS Router. (Henri Salo <henri@...v.fi>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
Re: CVE-2015-1437 XSS In ASUS Router. (Michael Meyer <micha@...ma-nix.de>)
ESA-2014-158: RSA BSAFE® Micro Edition Suite, SSL-J and SSL-C Triple Handshake Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2015-010: EMC Documentum D2 Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
Bitdefender Internet Security - (jerold@...d00sec.com)
Re: CVE-2015-1437 XSS In ASUS Router. (Darko Vršič <darko@...nost.si>)
Cisco Security Advisory: Cisco Security Advisory Cisco WebEx Meetings Server Command Injection Vulnerability (Cisco Systems Product Security Incident Response …)
Re: Re: CVE-2015-1437 XSS In ASUS Router. (kingkaustubh@...com)

February 9 (35 messages)

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
Very Important Info About "Major Internet Explorer Vulnerability - NOT Patched" (David Leo <david.leo@...sen.co.uk>)
RE: [FD] Major Internet Explorer Vulnerability - NOT Patched ("Dimitris Strevinas" <d.strevinas@...ela.com>)
CVE-2015-1172 Wordpress-theme remote arbitrary code (borg@...vernet.se)
[ MDVSA-2015:030 ] bugzilla (security@...driva.com)
[ MDVSA-2015:029 ] binutils (security@...driva.com)
[oCERT-2015-002] e2fsprogs input sanitization errors (Andrea Barisani <lcars@...rt.org>)
ESA-2015-012: EMC Captiva Capture Sensitive Information Disclosure Vulnerability (Security Alert <Security_Alert@....com>)
[ MDVSA-2015:032 ] php (security@...driva.com)
[ MDVSA-2015:031 ] busybox (security@...driva.com)
[SECURITY] [DSA 3154-1] ntp security update (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
LG On Screen Phone authentication bypass (CVE-2014-8757) (Imre Rad <imre.rad@...rch-lab.hu>)
[ MDVSA-2015:033 ] java-1.7.0-openjdk (security@...driva.com)
[ MDVSA-2015:034 ] jasper (security@...driva.com)
[ MDVSA-2015:036 ] python-django (security@...driva.com)
[ MDVSA-2015:035 ] libvirt (security@...driva.com)
BMC Footprints Service Core 11.5 - Multiple Cross Site Scripting Vulnerabilities (XSS) (ayman.abdelaziz@...pag.com)
[ MDVSA-2015:037 ] vorbis-tools (security@...driva.com)
[SECURITY] [DSA 3155-1] postgresql-9.1 security update (Luciano Bello <luciano@...ian.org>)
[SECURITY] [DSA 2978-2] libxml2 security update (Alessandro Ghedini <ghedo@...ian.org>)
[security bulletin] HPSBUX03166 SSRT101489 rev.2 - HP-UX running PAM libpam_updbe, Remote Authentication Bypass (security-alert@...com)
[security bulletin] HPSBUX03235 SSRT101750 rev.2 - HP-UX Running BIND, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBGN03253 rev.1 - HP Business Process Insight (BPI) running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU03224 rev.1 - HP LoadRunner and Performance Center, Load Generator Virtual Machine Images, running Windows, Remo… (security-alert@...com)
[security bulletin] HPSBGN03254 rev.1 - HP Service Health Analyzer running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBMU03216 rev.2 - HP Service Manager running SSLv3, Multiple Remote Vulnerabilities (security-alert@...com)
[SECURITY] [DSA 3154-2] ntp security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3156-1] liblivemedia security update (Alessandro Ghedini <ghedo@...ian.org>)
Radexscript CMS 2.2.0 - SQL Injection vulnerability ("ITAS Team" <itas.team@...s.vn>)
Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072) (bhdresh@...il.com)
[SECURITY] CVE-2014-0227 Apache Tomcat Request Smuggling (Mark Thomas <markt@...che.org>)
Suspicious URL:Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (Shawn Hsiao <phsiao@...padvisor.com>)
[SECURITY] [DSA 3157-1] ruby1.9.1 security update (Alessandro Ghedini <ghedo@...ian.org>)
[security bulletin] HPSBGN03252 rev.1 - HP AppPulse Active running SSLv3, Remote Disclosure of Information (security-alert@...com)

February 10 (15 messages)

[SECURITY] [DSA 3158-1] unrtf security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBGN03251 rev.1 - HP Storage Essentials running SSLv3, Remote Disclosure of Information (security-alert@...com)
Mooplayer 1.3.0 'm3u' SEH Buffer Overflow POC (saman.j.l33t@...il.com)
Re: Suspicious URL:Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (Christoph Gruber <list@...u.at>)
[ MDVSA-2015:039 ] glibc (security@...driva.com)
[RT-SA-2014-013] Cross-Site Scripting in IBM Endpoint Manager Relay Diagnostics Page (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[security bulletin] HPSBGN03255 rev.1 - HP OpenCall Media Platform (OCMP) running SSLv3, Remote Denial of Service (DoS),Disclosure of Info… (security-alert@...com)
[security bulletin] HPSBMU03245 rev.1 - HP Insight Control server deployment Linux Preboot Execution Environment running Bash Shell, Multi… (security-alert@...com)
[security bulletin] HPSBMU03246 rev.1 - HP Insight Control for Linux Central Management Server Pre-boot Execution Environment running Bash… (security-alert@...com)
Re: Suspicious URL:Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (Joshua Rogers <honey@...ernot.info>)
[ MDVSA-2015:040 ] zarafa (security@...driva.com)
[ MDVSA-2015:041 ] cabextract (security@...driva.com)
[ MDVSA-2015:042 ] clamav (security@...driva.com)
[ MDVSA-2015:043 ] otrs (security@...driva.com)
[SECURITY] [DSA 3159-1] ruby1.8 security update (Alessandro Ghedini <ghedo@...ian.org>)

February 11 (11 messages)

Two Reflected XSS Vulnerabilities in Easing Slider WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.com>)
Multiple Vulnerabilities in my little forum (High-Tech Bridge Security Research <advisory@...ridge.com>)
Facebook Bug Bounty #23 - Session ID & CSRF Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
BlinkSale Bug Bounty #1 - Encode & Validation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Pandora FMS v5.1 SP1 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
T-Mobile Internet Manager - DLL Hijacking (mfc71enu.dll) (Vulnerability Lab <research@...nerability-lab.com>)
[ANN] MSKB 3004375 available for Windows 2000 and later too (but NOT from Mcirosoft) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Cisco Security Advisory: Cisco Secure Access Control System SQL Injection Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Elasticsearch vulnerability CVE-2015-1427 (Kevin Kluge <kevin.kluge@...sticsearch.com>)
[SECURITY] [DSA 3160-1] xorg-server security update (Moritz Muehlenhoff <jmm@...ian.org>)
Ninja Forms WordPress Plugin Multiple Cross-Site Scripting Vulnerability (sn@....eu)

February 12 (9 messages)

[SECURITY] [DSA 3161-1] dbus security update (Salvatore Bonaccorso <carnil@...ian.org>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA Software (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Shakacon 2015 Last Call for Papers (July 6-9 2015, Honolulu, Hawaii) (Jonathan Brossard <endrazine@...il.com>)
Open-Xchange Security Advisory 2015-02-12 (Martin Heiland <martin.heiland@...n-xchange.com>)
[ MDVSA-2015:044 ] perl-Gtk2 (security@...driva.com)
[ MDVSA-2015:045 ] e2fsprogs (security@...driva.com)
[ MDVSA-2015:046 ] ntp (security@...driva.com)
[ MDVSA-2015:048 ] postgresql (security@...driva.com)
[ MDVSA-2015:047 ] elfutils (security@...driva.com)

February 13 (4 messages)

Re: Shakacon 2015 Last Call for Papers (July 6-9 2015, Honolulu, Hawaii) (Jonathan Brossard <endrazine@...il.com>)
CVE-2015-1574 - Google Email App 4.2.2 remote denial of service (Hector Marco <hecmargi@....es>)
[security bulletin] HPSBGN03258 rev.1 - HP Insight Control server deployment Windows Pre-boot Execution Environment, Microsoft Schannel (W… (security-alert@...com)
UNIT4 Prosoft HRMS XSS Vulnerability (jerold@...d00sec.com)

February 16 (7 messages)

CVE-2015-1600 - Netatmo Weather Station Cleartext Password Leak (jullrich@...s.edu)
CVE-2015-1593 - Linux ASLR integer overflow: Reducing stack entropy by four (Hector Marco <hecmargi@....es>)
[CVE-2015-1585] Fat Free CRM - CSRF Vulnerability in Version 0.13.5 (sven@...daemon.org)
Cosmoshop - XSS on Admin-Login Mask (innate@....de)
Multiple Cross site scripting in wordpress Plugin Image Metadata cruncher (kingkaustubh@...com)
Reflected File Download in AOL Search Website (Ricardo Iramar dos Santos <riramar@...il.com>)
Re: Reflected File Download in AOL Search Website (Mike Antcliffe <mikeantcliffe@...icallysecure.com>)

February 17 (6 messages)

[slackware-security] seamonkey (SSA:2015-047-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] patch (SSA:2015-047-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] sudo (SSA:2015-047-03) (Slackware Security Team <security@...ckware.com>)
CVE-2015-1614 csrf/xss in in wordpress Plugin Image Metadata cruncher (kingkaustubh@...com)
Ebay Inc Magento Bug Bounty #5 - Persistent Validation & Mail Encoding Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
NetGear WNDR Authentication Bypass / Information Disclosure (Peter Adkins <peter.adkins@...nelpicnic.net>)

February 18 (4 messages)

Crushftp 7.2.0 - Multiple CSRF & XSS Vulnerabilities‏ (Rehan Ahmed <knight_rehan@...mail.com>)
[RT-SA-2014-016] Directory Traversal and Arbitrary File Disclosure in hybris Commerce Software Suite (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3 (sven@...daemon.org)
PHP Code Execution in jui_filter_rules Parsing Library (Timo Schmid <tschmid@...w.de>)

February 19 (4 messages)

[SECURITY] [DSA 3162-1] bind9 security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3163-1] libreoffice security update (Alessandro Ghedini <ghedo@...ian.org>)
Defense in depth -- the Microsoft way (part 28): yes, we can (create even empty, but properly quoted pathnames) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
iTunes 12.1.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathnames C:… ("Stefan Kanthak" <stefan.kanthak@...go.…)

February 23 (13 messages)

[security bulletin] HPSBPV03266 rev.1 - Certain HP Networking and H3C Switches and Routers running NTP, Remote Execution of Code, Disclosu… (security-alert@...com)
Cisco Security Advisory: Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psi…)
[security bulletin] HPSBUX03240 SSRT101872 rev.1 - HP-UX Running NTP, Remote Execution of Code, Denial of Service (DoS), or Other Vulnerab… (security-alert@...com)
Stored XSS Vulnerability in ADPlugg Wordpress Plugin (kingkaustubh@...com)
Defense in depth -- the Microsoft way (part 29): contradicting, ambiguous, incomplete documentation ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[SECURITY] [DSA 3164-1] typo3-src security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3165-1] xdg-utils security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 3166-1] e2fsprogs security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 3167-1] sudo security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2014-8487: Kony EMM insecurity Direct Object Reference (michael.hendrickx@...pag.com)
[SECURITY] [DSA 3168-1] ruby-redcloth security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3169-1] eglibc security update (Aurelien Jarno <aurel32@...ian.org>)
[SECURITY] [DSA 3171-1] samba security update (Salvatore Bonaccorso <carnil@...ian.org>)

February 26 (27 messages)

[SECURITY] [DSA 3170-1] linux security update (Moritz Muehlenhoff <jmm@...ian.org>)
N.E.T. E-Commerce Group Cross Site Scripting Vulnerability (iedb.team@...il.com)
FreeBSD Security Advisory FreeBSD-SA-15:04.igmp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-15:05.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[Onapsis Security Advisory 2015-001] Multiple Reflected Cross Site Scripting Vulnerabilities in SAP HANA Web-based Deve… (Onapsis Research Labs <research@...psis…)
[Onapsis Security Advisory 2015-002] SAP Business Objects Unauthorized File Repository Server Read via CORBA (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2015-003] SAP Business Objects Unauthorized File Repository Server Write via CORBA (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2015-005] SAP Business Objects Unauthorized Audit Information Access via CORBA (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisory 2015-004] SAP Business Objects Unauthorized Audit Information Delete via CORBA (Onapsis Research Labs <research@...psis.com>)
[security bulletin] HPSBMU03260 rev.1 - HP System Management Homepage running OpenSSL on Linux and Windows, Remote Disclosure of Informati… (security-alert@...com)
TangoBB 1.5.0-A3 XSS Vulnerability (dennis.veninga@...il.com)
EnanoCMS 1.1.8pl1 XSS Vulnerability (dennis.veninga@...il.com)
GDS Labs Alert [CVE-2015-2080] - JetLeak Vulnerability: Remote Leakage Of Shared Buffers In Jetty Web Server (rgutierrez@...security.com)
[SECURITY] [DSA 3172-1] cups security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3173-1] libgtk2-perl security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3174-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBUX03162 SSRT101885 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites (security-alert@...com)
[SECURITY] [DSA 3175-1] kfreebsd-9 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other V… (security-alert@...com)
[slackware-security] mozilla-thunderbird (SSA:2015-056-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2015-056-01) (Slackware Security Team <security@...ckware.com>)
D-Link and TRENDnet 'ncc2' service - multiple vulnerabilities (Peter Adkins <peter.adkins@...nelpicnic.net>)
DSS TFTP 1.0 Server - Path Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Data Source: Scopus CMS - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Wireless File Transfer Pro Android - Multiple CSRF Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites (security-alert@...com)
[SECURITY] [DSA 3176-1] request-tracker4 security update (Salvatore Bonaccorso <carnil@...ian.org>)

February 27 (5 messages)

Cross-Site-Scripting (XSS) in tcllib's html::textarea (Ben Fuhrmannek <bef@...tioneins.de>)
HelpDezk 1.0.1 Multiple Vulnerabilities (dennis.veninga@...il.com)
[SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags (Jeremy Boynes <jboynes@...che.org>)
Wordpress Media Cleaner Plugin - XSS Vulnerability (iletisim@...ailsaygili.com.tr)
SEC Consult SA-20150227-0 :: Multiple vulnerabilities in Loxone Smart Home (SEC Consult Vulnerability Lab <research@...-consult.com>)

175 messages

Powered by blists - more mailing lists