bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 12	²	³	⁴
⁵ 20	⁶ 3	⁷ 14	⁸ 2	⁹ 7	¹⁰	¹¹
¹² 8	¹³ 3	¹⁴ 3	¹⁵ 4	¹⁶ 6	¹⁷	¹⁸
¹⁹ 2	²⁰ 1	²¹ 8	²² 12	²³ 4	²⁴ 2	²⁵ 3
²⁶ 7	²⁷ 3	²⁸ 3	²⁹ 7	³⁰ 8	³¹

Messages by day:

October 1 (12 messages)

[SYSS-2015-010] Kaspersky Anti-Virus - Use of One-Way Hash withouth a Salt (matthias.deeg@...s.de)
[SYSS-2015-007] Kaspersky Internet Security - Authentication Bypass (matthias.deeg@...s.de)
[SYSS-2015-009] Kaspersky Anti-Virus - Authentication Bypass (matthias.deeg@...s.de)
[SYSS-2015-008] Kaspersky Internet Security - Use of One-Way Hash withouth a Salt (matthias.deeg@...s.de)
[SYSS-2015-005] Kaspersky Total Security - Authentication Bypass (matthias.deeg@...s.de)
[SYSS-2015-006] Kaspersky Total Security - Use of One-Way Hash withouth a Salt (matthias.deeg@...s.de)
[SYSS-2015-004] Kaspersky Small Office Security - Use of One-Way Hash withouth a Salt (matthias.deeg@...s.de)
[SYSS-2015-002] Kaspersky Endpoint Security - Use of One-Way Hash withouth a Salt (matthias.deeg@...s.de)
[SYSS-2015-003] Kaspersky Small Office Security - Authentication Bypass (matthias.deeg@...s.de)
[SYSS-2015-001] Kaspersky Endpoint Security - Authentication Bypass (matthias.deeg@...s.de)
[security bulletin] HPSBGN03424 rev.1 - HP Cloud Service Automation, Remote Authentication Bypass (security-alert@...com)
[security bulletin] HPSBPV03516 rev.1 - HP VAN SDN Controller, Multiple Vulnerabilities (security-alert@...com)

October 5 (20 messages)

LanSpy 2.0.0.155 Buffer Overflow (apparitionsec@...il.com)
Multiple Path/Directory Traversal and/or Local File Inclusion in Easy2Map version 1.2.9 WordPress plugin (ibemed@...il.com)
A Reflected XSS in Easy2Map version 1.2.9 WordPress plugin (ibemed@...il.com)
Multiple Reflected XSS in ResAds version 1.0.1 WordPress plugin (ibemed@...il.com)
Multiple Reflected XSS in Payment Form for PayPal Pro version 1.0.1 WordPress plugin (ibemed@...il.com)
Reflected Cross-Site Scripting (XSS) in SourceBans (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Correction: BMC-2015-0006: File inclusion vulnerability caused by misconfiguration of "BIRT Engine" servlet as used in BMC Remedy AR Re… (appsec <appsec@....com>)
Correction: BMC-2015-0005: File inclusion vulnerability caused by misconfiguration of "BIRT Viewer" servlet as used in BMC Remedy AR Re… (appsec <appsec@....com>)
ZTE GPON F427 and possibly F460/F600 - authorization bypass and cleartext password storage (jerzy.patraszewski@...il.com)
FreeBSD Security Advisory FreeBSD-SA-15:24.rpcbind [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Qualys Security Advisory - OpenSMTPD Audit Report (Qualys Security Advisory <qsa@...lys.com>)
[ZDI-15-396] ManageEngine ServiceDesk Plus remote code execution (Pedro Ribeiro <pedrib@...il.com>)
[SYSS-2015-039] CSRF in OpenText Secure MFT (adrian.vollmer@...s.de)
CVE-2015-6237 - Tripwire IP360 VnE Remote Administrative API Authentication Bypass/Privilege Acquisition Vulnerability (Specto <specto@...todela.com>)
FTGate 2009 Build 6.4.00 CSRF Vulnerabilities (apparitionsec@...il.com)
[security bulletin] HPSBST03418 rev.2 - HP P6000 Command View Software, Remote Disclosure of Information (security-alert@...com)
[slackware-security] php (SSA:2015-274-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-thunderbird (SSA:2015-274-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2015-274-03) (Slackware Security Team <security@...ckware.com>)
[security bulletin] HPSBUX03359 SSRT102094 rev.2 - HP-UX pppoec, local elevation of privilege (security-alert@...com)

October 6 (3 messages)

LanWhoIs.exe 1.0.1.120 Stack Buffer Overflow (apparitionsec@...il.com)
Advisory: web-based VM detection and coarse-grained fingerprinting (Amit Klein <aksecurity@...il.com>)
Authentication Bypass in Netgear Router Firmware N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img (Alexandre Herzog <Alexandre.Herzog@...c.ch>)

October 7 (14 messages)

Local RedHat Enterprise Linux DoS – RHEL 7.3 Kernel crashes on invalid USB device descriptors (usbvision driver) (Ralf Spenneberg <info@...t.de>)
TestLink Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-7391 (Onur Yilmaz <onur@...sparker.com>)
TestLink Security Advisory - SQL Injection Vulnerability - CVE-2015-7390 (Onur Yilmaz <onur@...sparker.com>)
Zope Management Interface CSRF vulnerabilities (apparitionsec@...il.com)
Advanced Information Security Corporation, Security Advisory (MYSQL v5.6.24 Buffer Overflows) ("Nicholas Lemonias." <lem.nikolas@...glemail.com>)
[CVE-2015-7670] Multiple SQL Injection in Support Ticket System 1.2 WordPress plugin (ibeptaz@...il.com)
[SECURITY] [DSA 3370-1] freetype security update (Alessandro Ghedini <ghedo@...ian.org>)
[SECURITY] [DSA 3369-1] zendframework security update (Alessandro Ghedini <ghedo@...ian.org>)
Re: Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid USB device descriptors (usbvision driver) (Ralf Spenneberg <ralf@...t.de>)
Advanced Information Security Corporation, Security Advisory (MYSQL v5.6.24 Buffer Overflows) (lem.nikolas@...il.com)
RE: Authentication Bypass in Netgear Router Firmware N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img (Alexandre Herzog <Alexandre.Herzog@...c.ch>)
A comprehensive study of Huawei 3G routers - XSS, CSRF, DoS, unauthenticated firmware update, RCE (Pierre Kim <pierre.kim.sec@...il.com>)
[REVIVE-SA-2015-001] Revive Adserver - Multiple vulnerabilities (Matteo Beccati <matteo@...cati.com>)
Advanced Information Security Corporation, Security Advisory (Oracle's MYSQL v5.6.24 Latest - Buffer Overflows) Repost ("Nicholas Lemonias." <lem.nikolas@...gl…)

October 8 (2 messages)

Potential vulnerabilites in PayPal Beacons (securityresearch@...ftek.biz)
[RT-SA-2015-006] Buffalo LinkStation Authentication Bypass (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

October 9 (7 messages)

Veeam Backup & Replication Local Privilege Escalation Vulnerability (ascii <ascii@....it>)
WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
PayPal Inc Bug Bounty #119 - URL Redirect Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
W150D Wireless N 150 ADSL2 Modem Router - Cross Site Request Forgery Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FreeYouTubeToMP3 Converter 4.0.1 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Advanced Information Security Corporation, Security Advisory (MYSQL v5.6.24 Buffer Overflows) ("Nicholas Lemonias." <lem.nikolas@...glemail.com>)
[SECURITY] [DSA 3371-1] spice security update (Salvatore Bonaccorso <carnil@...ian.org>)

October 12 (8 messages)

ESA-2015-153 EMC SourceOne Email Supervisor Security Update for Multiple Security Vulnerabilities (Security Alert <Security_Alert@....com>)
Multiple Vulnerabilities found in ZHONE (lyon.yang.s@...il.com)
[SYSS-2015-037] MATESO Password Safe and Repository Enterprise - Insufficiently Protected Credentials (matthias.deeg@...s.de)
[SYSS-2015-034] MATESO Password Safe and Repository Enterprise - SQL Injection (matthias.deeg@...s.de)
Multiple Remote Code Execution found in ZHONE (lyon.yang.s@...il.com)
CVE-2015-7377: Unauthenticated Reflected XSS in Pie Register WordPress Plugin (grajalerts@...il.com)
CVE-2015-7682: Multiple Blind SQL Injections in Pie Register WordPress Plugin (grajalerts@...il.com)
CVE-2015-7683: Absolute Path Traversal in the Font WordPress Plugin (grajalerts@...il.com)

October 13 (3 messages)

AdobeWorkgroupHelper Stack Based Buffer Overflow (apparitionsec@...il.com)
[SECURITY] [DSA 3372-1] linux security update (Ben Hutchings <benh@...ian.org>)
Boolean-based SQL injection Vulnerability in K2 Platforms (wissam.bashour@...pag.com)

October 14 (3 messages)

[security bulletin] HPSBGN03515 rev.1 - HP Smart Profile Server Data Analytics Layer (SPS DAL), Remote Cross-Site-Scripting (XSS), Disclos… (security-alert@...com)
[CVE-2015-2552] Windows 8+ - Trusted Boot Security Feature Bypass Vulnerability (Myria <myriachan@...il.com>)
US DoD's Dc3dd v7.2.6 suffers from a Buffer Overflow vulnerability - Advanced Information Security Corporation - Zero D… ("Nicholas Lemonias." <lem.nikolas@...gl…)

October 15 (4 messages)

Blat.exe v2.7.6 SMTP / NNTP Mailer Buffer Overflow (apparitionsec@...il.com)
PayPal Inc Bug Bounty #117 - Session Fixation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Freemake Video Downloader 3.7.1 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBUX03512 SSRT102254 rev.1 - HP-UX Web Server Suite running Apache, Remote Denial of Service (DoS) and Other Vulnera… (security-alert@...com)

October 16 (6 messages)

[security bulletin] HPSBOV03503 rev.1 - HP OpenVMS CSWS_JAVA running Tomcat, Multiple Remote Vulnerabilities (security-alert@...com)
APPLE-SA-2015-10-15-1 Keynote 6.6, Pages 5.6, Numbers 3.6, and iWork for iOS 2.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[ISecAuditors Security Advisories] URL Open Redirect in Google generic TLD and ccTLD (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Qualys Security Advisory - LibreSSL (CVE-2015-5333 and CVE-2015-5334) (Qualys Security Advisory <qsa@...lys.com>)
Events Made Easy WordPress plugin CSRF + Persistent XSS (David Sopas <davidsopas@...il.com>)
ERPSCAN Research Advisory [ERPSCAN-15-017] SAP NetWeaver J2EE DAS service - Unauthorized Access (ERPScan inc <erpscan.online@...il.com>)

October 19 (2 messages)

[SECURITY] [DSA 3373-1] owncloud security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3374-1] postgresql-9.4 security update (Salvatore Bonaccorso <carnil@...ian.org>)

October 20 (1 message)

[SECURITY] [DSA 3375-1] wordpress security update (Yves-Alexis Perez <corsac@...ian.org>)

October 21 (8 messages)

[SECURITY] [DSA 3376-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SE-2014-02] Google App Engine Java security sandbox bypasses (Issue 42) (Security Explorations <contact@...urity-explorations.com>)
SiteWIX - (edit_photo2.php id) SQL Injection Exploit (ZoRLu Bugrahan <zorlu@...w00rm.com>)
Cisco Security Advisory: Cisco ASA Software DHCPv6 Relay Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Cisco Security Advisory: Cisco ASA Software DHCPv6 Relay Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Cisco Security Advisory: Cisco ASA Software DNS Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco ASA Software DNS Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco ASA Software VPN ISAKMP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)

October 22 (12 messages)

APPLE-SA-2015-10-21-1 iOS 9.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-1 iOS 9.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-2 watchOS 2.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-2 watchOS 2.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-3 Safari 9.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-4 OS X El Capitan 10.11.1 and Security Update 2015-007 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-5 iTunes 12.3.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-6 Mac EFI Security Update 2015-002 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-7 Xcode 7.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-10-21-8 OS X Server 5.0.15 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Cisco Security Advisory: Multiple Vulnerabilities in ntpd Affecting Cisco Products - October 2015 (Cisco Systems Product Security Incident Response Team <psirt…)
TeamSpeak Client <= 3.0.18.1 RFI, Directory Traversal to RCE (scurippio@...istici.org)

October 23 (4 messages)

Re: TeamSpeak Client <= 3.0.18.1 RFI, Directory Traversal to RCE (scurippio@...istici.org)
SEC Consult SA-20151022-0 :: Lime Survey Multiple Critical Vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)
Re: TeamSpeak Client <= 3.0.18.1 RFI, Directory Traversal to RCE (scurippio@...istici.org)
CVE-2015-6576: Bamboo - Deserialisation resulting in remote code execution (David Black <dblack@...assian.com>)

October 24 (2 messages)

[security bulletin] HPSBGN03428 rev.1 - HP Asset Manager, Local Disclosure of Sensitive Information (security-alert@...com)
[security bulletin] HPSBGN03429 rev.1 - HP Arcsight Logger, Remote Disclosure of Information (security-alert@...com)

October 25 (3 messages)

[SECURITY] [DSA 3377-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Fwd: Timing attack vulnerability in most Zeus server-sides (rotem kerner <nullfield@...il.com>)
[SECURITY] [DSA 3379-1] miniupnpc security update (Salvatore Bonaccorso <carnil@...ian.org>)

October 26 (7 messages)

AlienVault OSSIM 4.3 CSRF vulnerability report (mohammadreza.mohajerani@...il.com)
AlienVault OSSIM 4.3 CSRF (mohammadreza.mohajerani@...il.com)
FreeBSD Security Advisory FreeBSD-SA-15:25.ntp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Secunia Research: Oracle Outside In Two Buffer Overflow Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Google Picasa Phase One Tags Processing Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow (submit@...ec.org)
MacOS X 10.11 hardlink bomb cause resource exhaustion (Avast PoC) (submit@...ec.org)

October 27 (3 messages)

[ERPSCAN-15-025] Oracle E-Business Suite Database user enumeration Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-026] Oracle E-Business Suite - SQL injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-027] Oracle E-Business Suite - Cross Site Scripting Vulnerability (ERPScan inc <erpscan.online@...il.com>)

October 28 (3 messages)

[SECURITY] [DSA 3380-1] php5 security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3381-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
Arbitrary code execution resp. escalation of privilege with Mozilla's SETUP.EXE ("Stefan Kanthak" <stefan.kanthak@...go.de>)

October 29 (7 messages)

[SECURITY] [DSA 3382-1] phpmyadmin security update (Thijs Kinkhorst <thijs@...ian.org>)
CVE-2015-7724 - Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD fglrx-… (Portcullis Advisories <advisories@...tc…)
CVE-2015-7723 - Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD fglrx-… (Portcullis Advisories <advisories@...tc…)
Cross-Site Request Forgery on Oxwall (High-Tech Bridge Security Research <advisory@...ridge.ch>)
[ERPSCAN-15-028] Oracle E-Business Suite - XXE injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-029] Oracle E-Business Suite - XXE injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-030] Oracle E-Business Suite - XXE injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)

October 30 (8 messages)

[SECURITY] [DSA 3332-2] wordpress regression update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3383-1] wordpress security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3384-1] virtualbox security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] ntp (SSA:2015-302-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] curl (SSA:2015-302-01) (Slackware Security Team <security@...ckware.com>)
PHP Server Monitor 3.1.1 CSRF (apparitionsec@...il.com)
PHP Server Monitor 3.1.1 Privilege Escalation (apparitionsec@...il.com)
[slackware-security] jasper (SSA:2015-302-02) (Slackware Security Team <security@...ckware.com>)

142 messages