bugtraq mailing list - 2015/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 14	²	³	⁴	⁵
⁶ 18	⁷ 7	⁸ 11	⁹	¹⁰ 15	¹¹	¹²
¹³ 5	¹⁴ 1	¹⁵ 6	¹⁶ 8	¹⁷ 2	¹⁸	¹⁹
²⁰ 11	²¹ 3	²² 13	²³ 3	²⁴ 4	²⁵	²⁶
²⁷ 6	²⁸ 4	²⁹ 10	³⁰ 5	³¹ 3

Messages by day:

July 1 (14 messages)

APPLE-SA-2015-06-30-5 QuickTime 7.7.7 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 3298-1] jackrabbit security update (Moritz Muehlenhoff <jmm@...ian.org>)
APPLE-SA-2015-06-30-6 iTunes 12.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Extra information for CVE-2014-4626 - EMC Documentum Content Server: authenticated user is able to elevate privileges, hijack Content Serv… (<andrew@...filov.tel>)
Pinterest Bug Bounty #1 - Persistent contact_name Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Ebay Magento Bug Bounty #14 - Persistent Description Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FCS Scanner v1.0 & v1.4 - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Blueberry Express v5.9.x - SEH Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Path Traversal in BlackCat CMS (High-Tech Bridge Security Research <advisory@...ridge.ch>)
ESA-2015-111: EMC Documentum WebTop Client Products Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2015-108: EMC Documentum D2 Multiple DQL Injection Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability (Security Alert <Security_Alert@....com>)
Exploit Code for ipTIME firmwares < 9.58 (root RCE against 127 router models) (Pierre Kim <pierre.kim.sec@...il.com>)
iTunes 12.2 and QuickTime 7.7.7 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNE… ("Stefan Kanthak" <stefan.kanthak@...go.…)

July 6 (18 messages)

ToorCon 17 Call For Papers! (h1kari <h1kari@...rcon.org>)
[SECURITY] [DSA 3299-1] stunnel4 security update (Salvatore Bonaccorso <carnil@...ian.org>)
ipTIME n104r3 vulnerable to CSRF and XSS attacks (Pierre Kim <pierre.kim.sec@...il.com>)
SQL Injection in easy2map wordpress plugin v1.24 ("Larry W. Cashdollar" <larry0@...com>)
CVE-2015-3442 Authentication Bypass in Xpert.Line Version 3.0 (Alessandro Zala <Alessandro.Zala@...c.ch>)
Ruxcon 2015 Final Call For Presentations (cfp@...con.org.au)
WK UDID v1.0.1 iOS - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3300-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
Google HTTP Live Headers v1.0.6 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Microsoft Office - OLE Packager allows code execution in all versions, with macros disabled (Kevin Beaumont <kevin.beaumont@...il.com>)
Snorby 2.6.2 - Stored Cross-site Scripting Vulnerability (Federico Fazzi <federico.fazzi@...il.com>)
Ebay Inc Magento Bug Bounty #16 - CSRF Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
127 ipTIME router models vulnerable to an unauthenticated RCE by sending a crafted DHCP request (Pierre Kim <pierre.kim.sec@...il.com>)
[SECURITY] [DSA 3301-1] haproxy security update (Salvatore Bonaccorso <carnil@...ian.org>)
Google Chrome Address Spoofing - Google's Opinion (David Leo <david.leo@...sen.co.uk>)
phpLiteAdmin v1.1 CSRF & XSS Vulnerabilities (apparitionsec@...il.com)
Re: Google HTTP Live Headers v1.0.6 - Client Side Cross Site Scripting Web Vulnerability (Reindl Harald <h.reindl@...lounge.net>)
[CORE-2015-0012] - AirLive Multiple Products OS Command Injection (CORE Advisories Team <advisories@...esecurity.com>)

July 7 (7 messages)

[SECURITY] [DSA 3302-1] libwmf security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3303-1] cups-filters security update (Alessandro Ghedini <ghedo@...ian.org>)
[security bulletin] HPSBMU03234 rev.1 - HP Vertica Analytics Platform running SSLv3, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBGN03361 rev.1 - HP UCMDB, HP UCMDB Configuration Manager, HP UCMDB Browser, and HP Universal Discovery running TLS… (security-alert@...com)
RE: [security bulletin] HPSBGN03351 rev.1 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, … ("Patterson, Derrick A CTR \(US\)" <derr…)
[security bulletin] HPSBGN03354 rev.1 - HP Connect-IT Using RC4, Remote Disclosure of Information (security-alert@...com)
[security bulletin] HPSBGN03352 rev.2 - HP Asset Manager Using RC4, Remote Disclosure of Information (security-alert@...com)

July 8 (11 messages)

FreeBSD Security Advisory FreeBSD-SA-15:11.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[slackware-security] mozilla-firefox (SSA:2015-188-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] cups (SSA:2015-188-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] ntp (SSA:2015-188-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] bind (SSA:2015-188-04) (Slackware Security Team <security@...ckware.com>)
Symantec EP 12.1.4013 Disabling Vulnerability (apparitionsec@...il.com)
Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 ("Larry W. Cashdollar" <larry0@...com>)
SQL Injection in easy2map-photos wordpress plugin v1.09 ("Larry W. Cashdollar" <larry0@...com>)
Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution (hdau@...oitte.fr)
[security bulletin] HPSBUX03363 rev.1 - HP-UX Apache Web Server running OpenSSL, Remote Disclosure of Information (security-alert@...com)
[CORE-2015-0011] - AirLink101 SkyIPCam1620W OS Command Injection (CORE Advisories Team <advisories@...esecurity.com>)

July 10 (15 messages)

[SECURITY] [DSA 3305-1] python-django security update (Alessandro Ghedini <ghedo@...ian.org>)
Extra information for CVE-2014-2513 - EMC Documentum Content Server: arbitrary code execution (<andrew@...filov.tel>)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA Software (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
FreeBSD Security Advisory FreeBSD-SA-15:12.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[slackware-security] openssl (SSA:2015-190-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 3306-1] pdns security update (Alessandro Ghedini <ghedo@...ian.org>)
[SECURITY] [DSA 3307-1] pdns-recursor security update (Alessandro Ghedini <ghedo@...ian.org>)
NEW VMSA-2015-0005 : VMware Workstation, Player and Horizon View Client for Windows updates address a host privilege es… (VMware Security Response Center <securi…)
CVE-2014-7952, Android ADB backup APK injection vulnerability (Imre RAD <imre.rad@...rch-lab.hu>)
ESA-2015-115: EMC RecoverPoint for Virtual Machines (VMs) Restriction Bypass Vulnerability (Security Alert <Security_Alert@....com>)
[security bulletin] HPSBGN03371 rev.1 - HP IceWall Products running OpenSSL, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBGN03351 rev.2 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of In… (security-alert@...com)
Cisco Security Advisory: OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Produc… (Cisco Systems Product Security Incident…)
[security bulletin] HPSBGN03373 rev.1 - HP Release Control running TLS, Remote Disclosure of Information (security-alert@...com)
SQL Injection, Reflected XSS, Path Traversal, Function Execution in ZenPhoto 1.4.8 (Tim Coen <tc.coen@...il.com>)

July 13 (5 messages)

[slackware-security] mozilla-thunderbird (SSA:2015-192-01) (Slackware Security Team <security@...ckware.com>)
phpSQLiteCMS CSRF, Unrestricted File Type Upload, Privilege Escalation & XSS CSRF, Unrestricted File Type Upload, Privilege Escalation … (apparitionsec@...il.com)
[SYSS-2015-031] sysPass - SQL Injection (disclosure@...s.de)
CVE-2015-4670 - AjaxControlToolkit File Upload Directory Traversal (Brian Cardinale <brian@...dinaleconsulting.com>)
CFP: Passwords 2015, Dec 7-9, Cambridge, UK (Per Thorsheim <per@...rsheim.net>)

July 14 (1 message)

[CVE-2015-2862/2863 / CERT VU#919604] Kaseya VSA arbitrary file download / open redirect (Pedro Ribeiro <pedrib@...il.com>)

July 15 (6 messages)

XSS vulnerability in OFBiz forms (lilian_iatco@...oo.com)
XSS, Code Execution, DOS, Password Leak, Weak Authentication in GetSimpleCMS 3.3.5 (Tim Coen <tc.coen@...il.com>)
Cisco Security Advisory: Cisco Videoscape Delivery System Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.co…)
15 TOTOLINK router models vulnerable to multiple RCEs (Pierre Kim <pierre.kim.sec@...il.com>)
4 TOTOLINK router models vulnerable to CSRF and XSS attacks (Pierre Kim <pierre.kim.sec@...il.com>)
Backdoor credentials found in 4 TOTOLINK router models (Pierre Kim <pierre.kim.sec@...il.com>)

July 16 (8 messages)

Backdoor and RCE found in 8 TOTOLINK router models (Pierre Kim <pierre.kim.sec@...il.com>)
[CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure (Cédric Champeau <cedric.champeau@...il.com>)
Re: [FD] 15 TOTOLINK router models vulnerable to multiple RCEs (Joshua Wright <jwright@...borg.com>)
ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2015-123: EMC Documentum WebTop Open Redirect Vulnerability (Security Alert <Security_Alert@....com>)
Elasticsearch CVE-2015-5377 (Kevin Kluge <kevin@...stic.co>)
Elasticsearch CVE-2015-5531 (Kevin Kluge <kevin@...stic.co>)
SEC Consult SA-20150716-0 :: Permanent Cross-Site Scripting in Oracle Application Express (SEC Consult Vulnerability Lab <research@...-consult.com>)

July 17 (2 messages)

Novell GroupWise 2014 WebAccess vulnerable to XSS attacks (adrian.vollmer@...s.de)
Oracle E-Business Suite Servlet URL Redirection Vulnerability (owais.md.khan@...il.com)

July 20 (11 messages)

UDID+ v2.5 iOS - Mail Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FoxyCart Bug Bounty #1 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
AirDroid ID - Client Side JSONP Callback Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[slackware-security] php (SSA:2015-198-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] httpd (SSA:2015-198-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 3308-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3309-1] tidy security update (Alessandro Ghedini <ghedo@...ian.org>)
[SECURITY] [DSA 3310-1] freexl security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3311-1] mariadb-10.0 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBUX03379 SSRT101976 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBMU03377 rev.1 - HP Release Control running RC4, Remote Disclosure of Information (security-alert@...com)

July 21 (3 messages)

[security bulletin] HPSBMU03380 rev.1 - HP System Management Homepage (SMH) on Linux and Windows, Multiple Vulnerabilities (security-alert@...com)
CVE-2015-5379: Axigen XSS vulnerability for html attachments (Ioan Indreias <ioan.indreias@...gen.com>)
WorldCIST'2016 - Brazil: Call for Workshops Proposals - Best Papers published by ISI/SCI Journals ("Maria Lemos" <marialemos72@...il.com>)

July 22 (13 messages)

Logstash vulnerability CVE-2015-5378 (Kevin Kluge <kevin@...stic.co>)
FreeBSD Security Advisory FreeBSD-SA-15:13.tcp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Open-Web-Analytics-1.5.7 Cryptographic, Password Disclosure & XSS Vulnerabilities (apparitionsec@...il.com)
NetCracker Resource Management 8.0 - XSS Vulnerability (jychia.sec@...il.com)
NetCracker Resource Management 8.0 - SQL Injection Vulnerability (jychia.sec@...il.com)
[SECURITY] [DSA 3312-1] cacti security update (Alessandro Ghedini <ghedo@...ian.org>)
SQL Injection in Count Per Day WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Multiple XSS Vulnerabilities in Paid Memberships Pro WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Multiple (remote and local) Vulnerabilities in Xceedium Xsuite [MZ-15-02] (modzero <security@...zero.ch>)
ESA-2015-118: EMC Avamar Directory Traversal Vulnerability (Security Alert <Security_Alert@....com>)
Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability (Cisco Systems Product Security Incident Response Team …)
Cisco Security Advisory: Cisco Unified MeetingPlace Unauthorized Password Change Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@ci…)
Cisco Security Advisory: Cisco IOS Software TFTP Server Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)

July 23 (3 messages)

[SECURITY] [DSA 3313-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Qualys Security Advisory <qsa@...lys.com>)

July 24 (4 messages)

[SECURITY] [DSA 3314-1] typo3-src end of life (Moritz Muehlenhoff <jmm@...ian.org>)
Hawkeye-G v3.0.1.4912 CSRF Vulnerability CVE-2015-2878 (apparitionsec@...il.com)
[SECURITY] [DSA 3315-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
Hawkeye-G v3 CSRF Vulnerability ***[UPDATED CORRECTED] (apparitionsec@...il.com)

July 27 (6 messages)

Hawkeye-G v3.0.1 Persistent XSS & Information Leakage (apparitionsec@...il.com)
Integer overflow in .NET Framework System.DirectoryServices.Protocols.Utility class ("Securify B.V." <lists@...urify.nl>)
[SECURITY] [DSA 3316-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3317-1] lxc security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3318-1] expat security update (Laszlo Boszormenyi <gcs@...ian.org>)
Apple iTunes & AppStore - Filter Bypass & Persistent Invoice Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 28 (4 messages)

Another Snorby 2.6.2 - Stored Cross-site Scripting Vulnerability (Federico Fazzi <federico.fazzi@...il.com>)
Multiple unresolved vulnerabilities in Basware Banking/Maksuliikenne (Samuel Lavitt - CVE-2015-0942 <CVE-2015-0942@...cipice.fi>)
SEC Consult SA-20150728-0 :: McAfee Application Control Multiple Vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)
[SECURITY] [DSA 3319-1] bind9 security update (Salvatore Bonaccorso <carnil@...ian.org>)

July 29 (10 messages)

[security bulletin] HPSBGN03372 rev.1 - HP Business Process Monitor using RC4, Remote Disclosure of Information (security-alert@...com)
FreeBSD Security Advisory FreeBSD-SA-15:14.bsdpatch (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-15:15.tcp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-15:16.openssh (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-15:17.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[slackware-security] bind (SSA:2015-209-01) (Slackware Security Team <security@...ckware.com>)
phpFileManager 0.9.8 CSRF Backdoor Shell Vulnerability (apparitionsec@...il.com)
[security bulletin] HPSBGN03367 rev.1 - HP TransactionVision with RC4 Stream Cipher, Remote Disclosure of Information (security-alert@...com)
Cross-Site Scripting (XSS) in qTranslate WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.ch>)
[security bulletin] HPSBGN03366 rev.1 - HP Business Process Insight with RC4 Stream Cipher, Remote Disclosure of Information (security-alert@...com)

July 30 (5 messages)

FreeBSD Security Advisory FreeBSD-SA-15:16.openssh [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Dell Netvault Backup Remote Denial of Service (epoide@...il.com)
Cisco Security Advisory: Cisco ASR 1000 Series Aggregation Services Routers Fragmented Packet Denial of Service Vulnerab… (Cisco Systems Product Security Incident…)
[SECURITY] [DSA 3320-1] openafs security update (Sebastien Delafond <seb@...ian.org>)
viagra generic singapore (info@...t-isotretinoin.com)

July 31 (3 messages)

[SECURITY] [DSA 3321-1] xmltooling security update (Alessandro Ghedini <ghedo@...ian.org>)
HP ArcSight Logger provides incorrect/invalid/incomplete results for queries with boolean operators (roberto@...sat.com)
phpFileManager 0.9.8 Remote Command Execution (hyp3rlinx@...os.com)

149 messages

Powered by blists - more mailing lists