bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 8	² 6	³ 5	⁴	⁵ 13	⁶	⁷
⁸ 11	⁹ 7	¹⁰ 11	¹¹ 9	¹² 6	¹³	¹⁴
¹⁵ 10	¹⁶ 3	¹⁷ 5	¹⁸ 2	¹⁹ 7	²⁰	²¹
²²	²³ 12	²⁴ 4	²⁵ 12	²⁶	²⁷	²⁸
²⁹ 28	³⁰ 6

Messages by day:

June 1 (8 messages)

[SECURITY] [DSA 3275-1] fusionforge security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3269-2] postgresql-9.1 regression update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3276-1] symfony security update (Moritz Muehlenhoff <jmm@...ian.org>)
Ektron CMS 9.10 SP1 - CSRF Vulnerability (jerold@...d00sec.com)
Ektron CMS 9.10 SP1 - XSS Vulnerability (jerold@...d00sec.com)
WebDrive Buffer OverFlow PoC (banana88@...ox.com)
CVE-2015-4038 - WordPress WP Membership plugin [Privilege escalation] (pan.vagenas@...il.com)
CVE-2015-4039 - WordPress WP Membership plugin [Stored XSS] (pan.vagenas@...il.com)

June 2 (6 messages)

t2'15: Call for Papers 2015 (Helsinki / Finland) ("Tomi Tuominen" <tomi.tuominen@...fi>)
Freebox OS Web interface 3.0.2 XSS, CSRF (huyngocbk@...il.com)
Enhanced SQL Portal 5.0.7961 XSS Vulnerability (apparitionsec@...il.com)
vfront-0.99.2 CSRF & Persistent XSS (apparitionsec@...il.com)
WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3277-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)

June 3 (5 messages)

[SECURITY] [DSA 3249-2] jqueryui security update (Sebastien Delafond <seb@...ian.org>)
Safari Address Spoofing - Impact, Code, How It Works, History (David Leo <david.leo@...sen.co.uk>)
Jildi FTP Client 1.5.2 b1138 - Buffer Overflow Vulnerability (banana88@...ox.com)
Local PHP File Inclusion in ResourceSpace (High-Tech Bridge Security Research <advisory@...ridge.ch>)
ESA-2015-091: RSA® Web Threat Detection Cross-Site Request Forgery Vulnerability (Security Alert <Security_Alert@....com>)

June 5 (13 messages)

[SECURITY] [DSA 3278-1] libapache-mod-jk security update (Markus Koschany <apo@...baru.de>)
[Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc) (Pedro Ribeiro <pedrib@...il.com>)
IBM Watson (Cognea) - XSS and Redirect Vulnerabilities (jerold@...d00sec.com)
CVE-2015-4153 - WordPress zM Ajax Login & Register Plugin [Local File Inclusion] (pan.vagenas@...il.com)
[security bulletin] HPSBGN03343 rev.1 - HP WebInspect, Remote Unauthorized Access (security-alert@...com)
CA20150604-01: Security Notice for CA Common Services ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[CVE-2015-4107] Wing FTP Server Remote Code Execution vulnerability (alex_haynes@...look.com)
[CVE-2015-4108] Wing FTP Server Cross-site Request Forgery vulnerabilities (alex_haynes@...look.com)
Wing FTP Server Remote Code Execution vulnerability (alex_haynes@...look.com)
1 Click Audio Converter v2.3.6 - Activex Buffer Overflow (Vulnerability Lab <research@...nerability-lab.com>)
1 Click Audio Converter v2.3.6 - Activex Buffer Overflow (Vulnerability Lab <research@...nerability-lab.com>)
1 Click Extract Audio v2.3.6 - Activex Buffer Overflow (Vulnerability Lab <research@...nerability-lab.com>)
CVE-2015-4109 - WordPress Users Ultra Plugin [SQL injection] (pan.vagenas@...il.com)

June 8 (11 messages)

Expedia Product Security Advisory: Cruise Ship Centers Information Disclosure (Mike Sheward <msheward@...edia.com>)
Xloner v3.1.2 wordpress plugin authenticated command execution and XSS ("Larry W. Cashdollar" <larry0@...com>)
CVE-2015-4010 - Cross-site Request Forgery & Cross-site Scripting in Encrypted Contact Form Wordpress Plugin v1.0.4 (venkatesh.nitin@...il.com)
Symphony CMS 2.6.2 (apparitionsec@...il.com)
[SECURITY] [DSA 3279-1] redis security update (Alessandro Ghedini <ghedo@...ian.org>)
Hardcoded AES 256 bit key used in Kankun IoT/Smart socket and its mobile App (Payatu Research <research@...atu.com>)
[SECURITY] [DSA 3280-1] php5 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3281-1] Debian Security Team PGP/GPG key change notice (Thijs Kinkhorst <thijs@...ian.org>)
AnimaGallery 2.6 (theme and lang cookie parameter) Local File Include Vulnerability (d4rkr0id@...il.com)
Symphony CMS XSS Vulnerability (apparitionsec@...il.com)
[SECURITY] [DSA 3282-1] strongswan security update (Yves-Alexis Perez <corsac@...ian.org>)

June 9 (7 messages)

Symphony CMS XSS Vulnerability [Corrected Post] (apparitionsec@...il.com)
SilverStripe CMS Unvalidated Redirect & XSS vulnerabilities (apparitionsec@...il.com)
SilverStripe CMS Unvalidated Redirect & XSS vulnerabilities (apparitionsec@...il.com)
CFP The 2nd International Conference on Information Systems Security and Privacy ICISSP 2016 (icissp.secretariat@...ticc.org)
NEW VMSA-2015-0004 - VMware Workstation, Fusion and Horizon View Client updates address critical security issues (VMware Security Response Center <security@vmw…)
[security bulletin] HPSBST03346 rev.1 - HP P6000 Command View Software running Jetty, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBMU03349 rev.1- HP Helion CloudSystem, Local Denial of Service (DoS), Arbitrary Code Execution (security-alert@...com)

June 10 (11 messages)

[SECURITY] [DSA 3283-1] cups security update (Salvatore Bonaccorso <carnil@...ian.org>)
Logstash vulnerability CVE-2015-4152 (Kevin Kluge <kevin@...stic.co>)
Kibana vulnerability CVE-2015-4093 (Kevin Kluge <kevin@...stic.co>)
Elasticsearch vulnerability CVE-2015-4165 (Kevin Kluge <kevin@...stic.co>)
[security bulletin] HPSBUX03341 SSRT102068 rev.1 - HP-UX Apache Tomcat v7.x, Remote Denial of Service (DoS) and Other Vulnerabilities (security-alert@...com)
[RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session ID (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2015-004] Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
Arbitrary File Disclosure and Open Redirect in Bonita BPM (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Multiple Vulnerabilities in ISPConfig (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Use-After-Free in PHP (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Heroku Bug Bounty #2 - (API) Re Auth Session Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

June 11 (9 messages)

XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 ) (stasvolfus@...il.com)
Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 ("Larry W. Cashdollar" <larry0@...com>)
[security bulletin] HPSBUX03337 SSRT102066 rev.1 - HP-UX Apache Web Server Suite running Apache Web Server, Tomcat v6.x, or PHP v5.4.x, Re… (security-alert@...com)
D-Link DSP-W110 - multiple vulnerabilities (Peter Adkins <peter.adkins@...nelpicnic.net>)
Cisco Security Advisory: Cisco IOS XR Software Crafted IPv6 Packet Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt…)
Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
[KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2015-02] Concrete5 <= 5.7.3.1 Multiple Reflected Cross-Site Scripting Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

June 12 (6 messages)

Nakid-CMS CSRF, Persistent XSS & LFI (apparitionsec@...il.com)
[slackware-security] php (SSA:2015-162-02) (Slackware Security Team <security@...ckware.com>)
ZCMS SQL Injection & Persistent XSS (apparitionsec@...il.com)
[SYSS-2015-020] ZENWorks Mobile Management - Cross-Site Scripting (ludwig.stage@...s.de)
FreeBSD Security Advisory FreeBSD-SA-15:10.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[slackware-security] openssl (SSA:2015-162-01) (Slackware Security Team <security@...ckware.com>)

June 15 (10 messages)

[SECURITY] [DSA 3285-1] qemu-kvm security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3286-1] xen security update (Moritz Muehlenhoff <jmm@...ian.org>)
Buffer Overflow in My Wifi Router Software (sudson08@...il.com)
[SECURITY] [DSA 3287-1] openssl security update (Alessandro Ghedini <ghedo@...ian.org>)
[SECURITY] [DSA 3288-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3252-2] sqlite3 security update (Alessandro Ghedini <ghedo@...ian.org>)
Productsurf Cms Sql Injection Vulnerability (iedb.team@...il.com)
WebdesignJiNi Cms Sql Injection Vulnerability (iedb.team@...il.com)
[RT-SA-2015-002] SQL Injection in TYPO3 Extension Akronymmanager (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[SECURITY] [DSA 3289-1] p7zip security update (Ben Hutchings <benh@...ian.org>)

June 16 (3 messages)

BlackCat CMS v1.1.1 Arbitrary File Download Vulnerability (d4rkr0id@...il.com)
ESA-2015-106: EMC Unified Infrastructure Manager/Provisioning (UIM/P) Authentication Bypass Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2015-043: RSA® Validation Manager Security Update for Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)

June 17 (5 messages)

OS Command Injection in Vesta Control Panel (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Reflected Cross-Site Scripting (XSS) in SearchBlox (High-Tech Bridge Security Research <advisory@...ridge.ch>)
VCE3570: VCE Vision(TM) Intelligent Operations Cryptographic and Cleartext Vulnerabilities (VCE - PSIRT <VCEPSIRT@....com>)
[security bulletin] HPSBGN03350 rev.1 - HP SiteScope Using RC4, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBGN03338 rev.1 - HP Service Manager running RC4, Remote Disclosure of Information (security-alert@...com)

June 18 (2 messages)

[SECURITY] [DSA 3290-1] linux security update (Ben Hutchings <benh@...ian.org>)
[SECURITY] [DSA 3291-1] drupal7 security update (Sebastien Delafond <seb@...ian.org>)

June 19 (7 messages)

DUO Security push Timing Attack (jpierini@...sw.com)
[SECURITY] [DSA 3292-1] cinder security update (Sebastien Delafond <seb@...ian.org>)
ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Ebay Magento Bug Bounty #10 - Persistent Filename Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Ebay Magento Bug Bounty #17 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Ebay Magento Bug Bounty #12 - Cross Site Request Forgery Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

June 23 (12 messages)

[CVE-2015-3188] Apache Storm remote code execution vulnerability ("P. Taylor Goetz" <ptgoetz@...che.org>)
[SECURITY] [DSA 3293-1] pyjwt security update (Alessandro Ghedini <ghedo@...ian.org>)
mysql-lite-administrator XSS vulnerabilities (apparitionsec@...il.com)
mysql-lite-administrator XSS vulnerabilities (apparitionsec@...il.com)
GeniXCMS XSS Vulnerabilities (apparitionsec@...il.com)
[oCERT-2015-008] FreeRADIUS insufficent CRL application (Andrea Barisani <lcars@...rt.org>)
ManageEngine Asset Explorer v6.1 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
The "localhosed" attack - stealing IE local machine cookies and exposing its internal IP address (Amit Klein <aksecurity@...il.com>)
[security bulletin] HPSBMU03356 rev.1 - HP Business Service Automation Essentials (BSAE) running TLS, Remote Disclosure of Information (security-alert@...com)
KMPlayer 3.9.1.136 Capture Unicode Buffer Overflow (ASLR Bypass) (n4ser.farhadi@...il.com)
ESA-2015-109: EMC Documentum D2 Cross-Site Scripting (Security Alert <Security_Alert@....com>)
ESA-2015-110: EMC Documentum Thumbnail Server Directory Traversal Vulnerability (Security Alert <Security_Alert@....com>)

June 24 (4 messages)

[SECURITY] [DSA 3294-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2015-3443 XSS in Thycotic Secret Server version 8.6.000000 to 8.8.000004 (Marco Delai <Marco.Delai@...c.ch>)
CVE-2015-4464 Insufficient Authorization Checks Request Handling Remote Authentication Bypass for Kguard Digital Video … (Federick Joe P Fajardo <fjpfajardo@...i…)
[SECURITY] [DSA 3295-1] cacti security update (Salvatore Bonaccorso <carnil@...ian.org>)

June 25 (12 messages)

[ERPSCAN-15-003] SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-004] SAP NetWeaver Portal XMLValidationComponent - XXE (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-006] SAP NetWeaver Portal ReportXmlViewer - XXE (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-005] SAP Mobile Platform - XXE (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-007] SAP Management Console ReadProfile Parameters - Information disclosure (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-009] SAP Afaria 7 XcListener - Missing authorization check (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-010] SYBASE SQL Anywhere 12 and 16 - DoS (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-008] SAP Afaria 7 XcListener - DoS in the module XeClient.Dll (Darya Maenkova <d.maenkova@...scan.com>)
[ERPSCAN-15-011] SAP Mobile Platform 3.0 - XXE (Darya Maenkova <d.maenkova@...scan.com>)
Netgear Prosafe VPN Firewalls - Multiple vulnerabilities (post@...ripto.no)
ESA-2015-102: EMC Unisphere for VMAX Remote Code Execution Vulnerability (Security Alert <Security_Alert@....com>)
Cisco Security Advisory: Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA (Cisco Systems Product Security Incident Response Team <ps…)

June 29 (28 messages)

CVE-2015-3931 Microsec e-Szigno, CVE-2015-3932 Netlock Mokka XSW vulnerability (Imre RAD <imre.rad@...rch-lab.hu>)
ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities (Security Alert <Security_Alert@....com>)
SEC Consult SA-20150626-0 :: Critical vulnerabilities in Polycom RealPresence Resource Manager (RPRM) allow surveillanc… (SEC Consult Vulnerability Lab <research…)
[security bulletin] HPSBGN03351 rev.1 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of In… (security-alert@...com)
[security bulletin] HPSBUX03359 rev.1 - HP-UX pppoec, local elevation of privilege (security-alert@...com)
[security bulletin] HPSBMU03267 rev.3 - HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL, Remote Disclosure of In… (security-alert@...com)
[security bulletin] HPSBGN03362 rev.1 - HP Discovery and Dependency Mapping Inventory (DDMI) with TLS, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBPI03107 rev.1 - HP LaserJet Printers and MFPs, HP OfficeJet Printers and MFPs, and HP JetDirect Networking cards u… (security-alert@...com)
[security bulletin] HPSBPI03360 rev.2 - HP LaserJet Printers and MFPs, HP OfficeJet Printers and MFPs, and HP JetDirect Networking cards u… (security-alert@...com)
Session Fixation, Reflected XSS, Code Execution in PivotX 2.3.10 (Tim <tc.coen@...il.com>)
CSRF Vulnerability in C2Box application CVE-2015-4460 (wissam.bashour@...pag.com)
CollabNet Subversion Edge Hook Script Privilege Escalation (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge Password Hash Leak (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge downloadHook local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge tail local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge insecure password change (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge show local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge missing brute force protection (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge missing clickjacking protection (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge autocomplete on (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge weak password policy (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge missing XSRF protection (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge weak password storage mechanism (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge missing single login restriction (Oliver-Tobias Ripka <otr@...kcay.de>)
CollabNet Subversion Edge indes local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
novius-os.5.0.1 Persistent XSS, LFI & Open Redirect Vulnerabilities (apparitionsec@...il.com)
[SECURITY] [DSA 3296-1] libcrypto++ security update (Alessandro Ghedini <ghedo@...ian.org>)
[SECURITY] [DSA 3297-1] unattended-upgrades security update (Alessandro Ghedini <ghedo@...ian.org>)

June 30 (6 messages)

CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP (Fernando Muñoz <fernando@...l-life.com>)
Google Chrome Address Spoofing (Request For Comment) (David Leo <david.leo@...sen.co.uk>)
APPLE-SA-2015-06-30-1 iOS 8.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-06-30-2 OS X Yosemite v10.10.4 and Security Update 2015-005 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-06-30-4 Safari 8.0.7, Safari 7.1.7, and Safari 6.2.7 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-06-30-3 Mac EFI Security Update 2015-001 (Apple Product Security <product-security-noreply@...ts.apple.com>)

165 messages