bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 3	² 9	³ 8	⁴ 7	⁵	⁶
⁷ 3	⁸ 1	⁹ 14	¹⁰ 3	¹¹ 7	¹² 3	¹³
¹⁴ 6	¹⁵ 4	¹⁶ 9	¹⁷ 4	¹⁸	¹⁹	²⁰
²¹ 9	²² 6	²³ 12	²⁴ 4	²⁵ 7	²⁶	²⁷
²⁸ 13	²⁹ 7	³⁰ 9

Messages by day:

September 1 (3 messages)

[security bulletin] HPSBMU03339 rev.1 - HP LoadRunner Controller, Local Execution of Arbitrary Code (security-alert@...com)
[CORE-2015-0013] - FortiClient Antivirus Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
KL-001-2015-003 : SiS Windows VGA Display Manager Multiple Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)

September 2 (9 messages)

KL-001-2015-004 : XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
CVE-2015-5603: JIRA and the HipChat For JIRA plugin - Velocity Template Injection (David Black <dblack@...assian.com>)
[slackware-security] gdk-pixbuf2 (SSA:2015-244-01) (Slackware Security Team <security@...ckware.com>)
Cross-Site Request Forgery in Cerb (High-Tech Bridge Security Research <advisory@...ridge.ch>)
ESA-2015-137: EMC Atmos XML External Entity Injection Vulnerability (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3347-1] pdns security update (SĆ©bastien Delafond <seb@...ian.org>)
Cisco Security Advisory: Cisco Integrated Management Controller Supervisor and Cisco UCS Director Remote File Overwrite … (Cisco Systems Product Security Incident…)
[SECURITY] [DSA 3349-1] qemu-kvm security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3348-1] qemu security update (Salvatore Bonaccorso <carnil@...ian.org>)

September 3 (8 messages)

FreeBSD Security Advisory FreeBSD-SA-15:23.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 3350-1] bind9 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] bind (SSA:2015-245-01) (Slackware Security Team <security@...ckware.com>)
[SYSS-2015-016] Avaya one-X® Agent - Hard-coded Cryptographic Key (sven.freund@...s.de)
Checkmarx CxQL Sandbox bypass (CVE-2014-8778) (hdau@...oitte.fr)
Zhone ADSL2+ 4P Bridge & Router (Broadcom) - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
ESA-2015-144: EMC Documentum Content Server Privilege Escalation Vulnerability (Security Alert <Security_Alert@....com>)
[CVE-2014-7216] Yahoo! Messenger emoticons.xml Multiple Key Value Handling Local Buffer Overflow (Julien Ahrens <info@...security.com>)

September 4 (7 messages)

[SECURITY] [DSA 3351-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[slackware-security] seamonkey (SSA:2015-246-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 3352-1] screen security update (Laszlo Boszormenyi <gcs@...ian.org>)
Oracle Hyperion password disclosure... (Jeff Kayser <jeff.kayser@...econsulting.com>)
Defense in depth -- the Microsoft way (part 32): yet another (trivial) UAC bypass resp. privilege escalation ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability (David Coomber <davidcoomber.infosec@...il.com>)
Webroot SecureAnywhere Mobile Protection - MITM SSL Certificate Vulnerability (David Coomber <davidcoomber.infosec@...il.com>)

September 7 (3 messages)

JSPMySQL Administrador CSRF & XSS Vulnerabilities (apparitionsec@...il.com)
[SECURITY] [DSA 3353-1] openslp-dfsg security update (Alessandro Ghedini <ghedo@...ian.org>)
NETGEAR Wireless Management System - Authentication Bypass and Privilege Escalation. (Elliott Lewis <elliott.lewis.uk@...il.com>)

September 8 (1 message)

[CVE-2015-3623] Qlikview blind XXE Security Vulnerability (alex_haynes@...look.com)

September 9 (14 messages)

Re: Oracle Hyperion password disclosure... (jeff.kayser@...econsulting.com)
[SECURITY] [DSA 3354-1] spice security update (Salvatore Bonaccorso <carnil@...ian.org>)
Defense in depth -- the Microsoft way (part 33): arbitrary code execution (and UAC bypass) via RegEdit.exe ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: Integer overflow in .NET Framework System.DirectoryServices.Protocols.Utility class ("Securify B.V." <lists@...urify.nl>)
[security bulletin] HPSBOV03506 rev.1 - TCP/IP Services for OpenVMS running BIND, Remote Denial of Service (DoS) (security-alert@...com)
ESA-2015-140: RSAĀ® Identity Management & Governance Multiple Cross-Site Scripting Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2015-110: EMC Documentum Thumbnail Server Directory Traversal Vulnerability (Security Alert <Security_Alert@....com>)
[ERPSCAN-15-014] SAP Mobile Platform 3 ā€“ XXE in Add Repository (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-015] SAP NetWeaver AS ABAPā€“ Hardcoded Credentials (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-016] SAP NetWeaver ā€“ Hardcoded credentials (ERPScan inc <erpscan.online@...il.com>)
[security bulletin] HPSBOV03505 rev.1 - TCP/IP Services for OpenVMS running NTP, Remote Code Execution, Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBGN03504 rev.1 - HP UCMDB, Local Disclosure of Sensitive Information (security-alert@...com)
Synology Video Station command injection and multiple SQL injection vulnerabilities ("Securify B.V." <lists@...urify.nl>)
Multiple Cross-Site Scripting vulnerabilities in Synology Download Station ("Securify B.V." <lists@...urify.nl>)

September 10 (3 messages)

[SECURITY] [DSA 3355-1] libvdpau security update (Alessandro Ghedini <ghedo@...ian.org>)
DataTables Security Advisory - XSS Vulnerability - CVE-2015-6584 (Onur Yilmaz <onur@...sparker.com>)
Re: Defense in depth -- the Microsoft way (part 33): arbitrary code execution (and UAC bypass) via RegEdit.exe ("Stefan Kanthak" <stefan.kanthak@...go.de>)

September 11 (7 messages)

Security advisory for Bugzilla 5.0, 4.4.9, and 4.2.14 (dkl@...illa.com)
Security Advisory for Bugzilla 5.0.1, 4.4.10 and 4.2.15 (LpSolit@...il.com)
Yahoo Bug Bounty #32 - Cross Site Request Forgery bulkImport Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Shopify Bug Bounty #8 - (FilePath) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
PayPal Inc - Security Approval & 2FA Session Auth Bypass (API) Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Magento Bug Bounty #19 - Persistent Filename Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[KIS-2015-04] Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability (Egidio Romano <research@...mainsecurity.com>)

September 12 (3 messages)

[security bulletin] HPSBHF03408 rev.2 - HP PCs with HP lt4112 LTE/HSPA+ Gobi 4G Module, Remote Execution of Arbitrary Code (security-alert@...com)
IKEView.exe Fox beta 1 Stack Buffer Overflow (apparitionsec@...il.com)
[SECURITY] [DSA 3356-1] openldap security update (Salvatore Bonaccorso <carnil@...ian.org>)

September 14 (6 messages)

[SECURITY] [DSA 3357-1] vzctl security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3359-1] virtualbox security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3358-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[CVE-2015-5956] Typo3 Core sanitizeLocalUrl() Non-Persistent Cross-Site Scripting ("Ahrens, Julien" <Julien.Ahrens@...unet.com>)
[security bulletin] HPSBMU03392 rev.2 - HP ArcSight Logger, Remote Authorization Bypass (security-alert@...com)
IKEView.exe R60 Stack Buffer Overflow (apparitionsec@...il.com)

September 15 (4 messages)

Openfire 3.10.2 CSRF Vulnerabilities (apparitionsec@...il.com)
Paypal Inc - Open Redirect Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBHF03509 rev.1 - HP ThinPro and Smart Zero Core, Remote Denial of Service, Unauthorized Access to Data (security-alert@...com)
[SECURITY] [DSA 3360-1] icu security update (Laszlo Boszormenyi (GCS) <gcs@...ian.org>)

September 16 (9 messages)

Microsoft Exchange Information Disclosure (apparitionsec@...il.com)
Fwd: [CVE-2015-6940] Pentaho GA PDI & GA BA - Improper authentication allows unauthenticated access to configuration fi… (gregory draperi <gregory.draperi@...il.…)
[security bulletin] HPSBGN03393 rev.2 - HP Operations Manager i, Remote Code Execution (security-alert@...com)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Prime Collaboration Assurance (Cisco Systems Product Security Incident Response Team <psirt@...co.co…)
Cisco Security Advisory: Cisco Prime Collaboration Provisioning Web Framework Access Controls Bypass Vulnerability (Cisco Systems Product Security Incident Res…)
Cisco Security Advisory: Cisco TelePresence Server Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
APPLE-SA-2015-09-16-1 iOS 9 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-09-16-2 Xcode 7.0 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-09-16-3 iTunes 12.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)

September 17 (4 messages)

Apple Safari FTP PASV manipulation vulnerability (CVE-2015-5912) (Amit Klein <aksecurity@...il.com>)
APPLE-SA-2015-09-16-4 OS X Server 5.0.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBST03418 rev.1 - HP P6000 Command View Software, Remote Disclosure of Information (security-alert@...com)
KL-001-2015-005 : VBox Satellite Express Arbitrary Write Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)

September 21 (9 messages)

[SECURITY] [DSA 3361-1] qemu security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3362-1] qemu-kvm security update (Salvatore Bonaccorso <carnil@...ian.org>)
Defense in depth -- the Microsoft way (part 35): Windows Explorer ignores "Run as administrator" ... ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[SECURITY] [DSA 3363-1] owncloud-client security update (Luciano Bello <luciano@...ian.org>)
SAP Netwaver - XML External Entity Injection (Lukasz Miedzinski <lukasz.miedzinski@...il.com>)
CVE-2015-5372 SAML SP Authentication Bypass in nevisAuth (Antoine Neuenschwander <Antoine.Neuenschwander@...c.ch>)
Advisory: Insufficient Parameter Sanitization in login.live.com (Microsoft) (securityresearch@...ftek.biz)
Jasig CAS server vulnerabilities (Antoni Klajn <antoni.d.klajn@....edu.pl>)
APPLE-SA-2015-09-21-1 watchOS 2 (Apple Product Security <product-security-noreply@...ts.apple.com>)

September 22 (6 messages)

[SECURITY] [DSA 3364-1] linux security update (Ben Hutchings <benh@...ian.org>)
Air Drive Plus v2.4 iOS - Arbitrary File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
UDID v1.0 iOS - Persistent Mail Encode Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBUX03511 SSRT102248 rev.1 - HP-UX BIND service running named, Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] HPSBGN03391 rev.1 - HP Universal CMDB Foundation, Discovery, Configuration Manager, and CMDB Browser running OpenSSL, … (security-alert@...com)
Cisco AnyConnect elevation of privileges via DLL side loading ("Securify B.V." <lists@...urify.nl>)

September 23 (12 messages)

[slackware-security] mozilla-firefox (SSA:2015-265-01) (Slackware Security Team <security@...ckware.com>)
Open-Xchange Security Advisory 2015-09-23 (Martin Heiland <martin.heiland.lists@...n-xchange.com>)
Reflected Cross-Site Scripting (XSS) in iTop (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Flowdock API Bug Bounty #1 - (Description) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
WiFi Drive CR v1.0 iOS - Persistent Filename Dir List Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
UltraEdit v22.20 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Cisco Security Advisory: Cisco IOS and IOS XE Software IPv6 First Hop Security Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Respon…)
Cisco Security Advisory: Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Te…)
ESA-2015-142: RSA ArcherĀ® GRC Platform Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3365-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
Cisco AnyConnect elevation of privileges via DMG install script ("Securify B.V." <lists@...urify.nl>)

September 24 (4 messages)

[SECURITY] [DSA 3366-1] rpcbind security update (Salvatore Bonaccorso <carnil@...ian.org>)
BMC-2015-0005: File inclusion vulnerability in "BIRT Viewer" servlet used in BMC Remedy AR Reporting (appsec <appsec@....com>)
BMC-2015-0006: File inclusion vulnerability in "BIRT Engine" servlet used in BMC Remedy AR Reporting (appsec <appsec@....com>)
[SECURITY] [DSA 3367-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)

September 25 (7 messages)

Re: CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android (Shazron <shazron@...che.org>)
FortiManager v5.2.2 Multiple XSS Vulnerabilities (apparitionsec@...il.com)
Insecure application-coupling in Good Authentication Delegation [MZ-15-03] (modzero <security@...zero.ch>)
CVE-2015-5076 - Vulnerability title: Reflective XSS In X2Engine Inc. X2Engine (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2015-5074 - Arbitrary File Upload In X2Engine Inc. X2Engine (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2015-5075 - Cross-Site Request Forgery In X2Engine Inc. X2Engine (Portcullis Advisories <advisories@...tcullis-security.com>)
[SECURITY] [DSA 3368-1] cyrus-sasl2 security update (Salvatore Bonaccorso <carnil@...ian.org>)

September 28 (13 messages)

[security bulletin] HPSBHF03513 rev.1 - HP PCs and Workstations running Windows and Linux with NVidia Graphics Driver, Local Denial of Ser… (security-alert@...com)
Git-1.9.5 ssh-agent.exe Buffer Overflow (apparitionsec@...il.com)
CVE-2015-7319 - SQL Injection in Appointment Booking Calendar 1.1.7 WordPress plugin (ibemed@...il.com)
CVE-2015-7320 - Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin (ibemed@...il.com)
Subject mail: CVE-2015-7320 - Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin (ibemed@...il.com)
Git-1.9.5 ssh-agent.exe Buffer Overflow (apparitionsec@...il.com)
My.WiFi USB Drive v1.0 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Flowdock API Bug Bounty #3 - (Invite) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
WinRAR SFX v5.21 - Remote Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
NodeBB v0.8.2 - Client Side Cross Site Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Photos in Wifi v1.0.1 iOS - Arbitrary File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
IconLover v5.4.5 - Stack Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Vtiger CRM Authenticated Remote Code Execution (CVE-2015-6000) (Benjamin Daniel Mussler <sec@...fl7.de>)

September 29 (7 messages)

Remote privesc and RCE in Kaseya Virtual System Administrator (Pedro Ribeiro <pedrib@...il.com>)
CVE-2015-3938 Remote Permanent LoV (Loss of View) in Mitsubishi Melsec FX3G-24M PLC ("Ralf Spenneberg \(OpenSource Security\)" <funktionskonto@...nneberg.net>)
ESA-2015-152: RSA Web Threat Detection Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
ESA-2015-151: RSAĀ® OneStep Path Traversal Vulnerability (Security Alert <Security_Alert@....com>)
Re: CVE-2015-3938 Remote Permanent LoV (Loss of View) in Mitsubishi Melsec FX3G-24M PLC (Ralf Spenneberg <ralf@...t.de>)
CVE-2015-7392 Heap overflow in Freeswitch json parser < 1.6.2 & < 1.4.23 (Marcello Duarte <marcello@...ersightgroup.com>)
FreeBSD Security Advisory FreeBSD-SA-15:24.rpcbind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)

September 30 (9 messages)

Re: WinRAR SFX v5.21 - Remote Code Execution Vulnerability (dev@...lab.com)
RE: WinRAR SFX v5.21 - Remote Code Execution Vulnerability ("Popovici, Alejo \(LATCO - Buenos Aires\)" <apopovici@...OITTE.com>)
Re: WinRAR SFX v5.21 - Remote Code Execution Vulnerability (Eugene Roshal <roshal@...lab.com>)
Apache James Server 2.3.2 security vulnerability fixed (Eric Charles <eric@...che.org>)
Re: Cisco AnyConnect elevation of privileges via DMG install script ("Securify B.V." <lists@...urify.nl>)
APPLE-SA-2015-09-30-01 iOS 9.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBST03502 rev.1 - HP 3PAR Service Processor (SP) SPOCC, Remote Disclosure of Information (security-alert@...com)
APPLE-SA-2015-09-30-2 Safari 9 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-09-30-3 OS X El Capitan 10.11 (Apple Product Security <product-security-noreply@...ts.apple.com>)

148 messages