bugtraq mailing list - 2015/11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 12	³ 3	⁴ 7	⁵ 17	⁶ 7	⁷ 4	⁸
⁹ 2	¹⁰ 2	¹¹ 4	¹²	¹³ 2	¹⁴	¹⁵ 23
¹⁶ 2	¹⁷ 9	¹⁸ 3	¹⁹ 7	²⁰ 1	²¹ 2	²²
²³ 13	²⁴ 1	²⁵ 7	²⁶ 3	²⁷ 1	²⁸	²⁹
³⁰ 15

Messages by day:

November 2 (12 messages)

[SECURITY] [DSA 3385-1] mariadb-10.0 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3386-1] unzip security update ("Laszlo Boszormenyi \(GCS\)" <gcs@...ian.org>)
TCPing 2.1.0 Buffer Overflow (apparitionsec@...il.com)
[SECURITY] [DSA 3387-1] openafs security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3388-1] ntp security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3381-2] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3389-1] elasticsearch end-of-life (Moritz Muehlenhoff <jmm@...ian.org>)
Cross-Site Scripting | Zeuscart V4 ("ITAS Team" <itas.team@...s.vn>)
Accentis Content Resource Management System - SQL (GalaxyCVEcollector@...il.com)
Accentis Content Resource Management System - XSS (GalaxyCVEcollector@...il.com)
CVE-2015-7326 (XXE vulnerability in Milton Webdav) (0ang3el@...il.com)
[SECURITY] [DSA 3390-1] xen security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 3 (3 messages)

[security bulletin] HPSBMU03518 rev.1 - HP Vertica, Remote Code Execution (security-alert@....com)
[SECURITY] [DSA 3355-2] libvdpau regression update (Alessandro Ghedini <ghedo@...ian.org>)
[security bulletin] HPSBGN03426 rev.1 - HP Mobility Software, Remote Execution of Arbitrary Code (security-alert@....com)

November 4 (7 messages)

[security bulletin] HPSBGN03386 rev.2 - HP Central View Fraud Risk Management, Revenue Leakage Control, Dealer Performance Audit, Credit … (security-alert@....com)
[SECURITY] [DSA 3391-1] php-horde security update (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBGN03430 rev.1 - HP ArcSight products, Local Elevation of Privilege (security-alert@....com)
[security bulletin] HPSBGN03425 rev.1 - HP ArcSight SmartConnectors, Remote Disclosure of Information, Local Escalation of Privilege (security-alert@....com)
[security bulletin] HPSBGN03429 rev.2 - HP Arcsight Logger, Remote Disclosure of Information (security-alert@....com)
FreeBSD Security Advisory FreeBSD-SA-15:25.ntp [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 3392-1] freeimage security update (Sebastien Delafond <seb@...ian.org>)

November 5 (17 messages)

[KIS-2015-05] ATutor <= 2.2 (Custom Course Icon) Unrestricted File Upload Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2015-06] ATutor <= 2.2 (confirm.php) Session Variable Overloading Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2015-08] ATutor <= 2.2 (edit_marks.php) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2015-07] ATutor <= 2.2 (popuphelp.php) Reflected Cross-Site Scripting Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2015-09] Piwik <= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2015-10] Piwik <= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
Cisco Security Advisory: Cisco AsyncOS TCP Flood Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Web Security Appliance Cache Reply Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@…)
Cisco Security Advisory: Cisco Web Security Appliance Range Request Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psir…)
Cisco Security Advisory: Cisco Email Security Appliance Email Scanner Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <ps…)
Cisco Security Advisory: Cisco Email Security Appliance Anti-Spam Scanner Bypass Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@cis…)
Cisco Security Advisory: Cisco Mobility Services Engine Static Credential Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Mobility Services Engine Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
Cisco Security Advisory: Cisco Web Security Appliance Certificate Generation Command Injection Vulnerability (Cisco Systems Product Security Incident Response T…)
[SECURITY] [DSA 3393-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBGN03519 rev.1 - HP Project and Portfolio Management Center, Remote Disclosure of Information (security-alert@....com)
SEC Consult SA-20151105-0 :: Insecure default configuration in Ubiquiti Networks products (SEC Consult Vulnerability Lab <research@...-consult.com>)

November 6 (7 messages)

Elasticsearch vulnerability CVE-2015-5377 (Kevin Kluge <kevin@...stic.co>)
[SECURITY] [DSA 3394-1] libreoffice security update (Moritz Muehlenhoff <jmm@...ian.org>)
Elasticsearch vulnerability CVE-2015-4165 (Kevin Kluge <kevin@...stic.co>)
NXFilter v3.0.3 CSRF (apparitionsec@...il.com)
NXFilter v3.0.3 Persistent / Reflected XSS (apparitionsec@...il.com)
CVE-2015-5619 (Suyog Rao <suyog@...stic.co>)
CVE-2015-5378 (Suyog Rao <suyog@...stic.co>)

November 7 (4 messages)

[slackware-security] mozilla-nss (SSA:2015-310-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2015-310-01) (Slackware Security Team <security@...ckware.com>)
[ANNOUNCE] CVE-2014-3576 - Apache ActiveMQ vulnerabilities (Timothy Bish <tabish121@...il.com>)
[SECURITY] [DSA 3395-1] krb5 security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 9 (2 messages)

TestLink 1.9.14 Persistent XSS (Aravind <altoarun@...il.com>)
TestLink 1.9.14 CSRF Vulnerability (Aravind <altoarun@...il.com>)

November 10 (2 messages)

[SECURITY] [DSA 3386-2] unzip regression update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3396-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 11 (4 messages)

Microsoft .NET Framework XSS / Elevation of Privilege CVE-2015-6099 (apparitionsec@...il.com)
[SECURITY] [DSA 3397-1] wpa security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBGN03507 rev.2 - HP Arcsight Management Center, Arcsight Logger, Remote Cross-Site Scripting (XSS) (security-alert@....com)
Secunia Research: Google Picasa CAMF Section Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)

November 13 (2 messages)

[SECURITY] [DSA 3395-2] krb5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
OpenBSD package 'net-snmp' information disclosure (Pierre Kim <pierre.kim.sec@...il.com>)

November 15 (23 messages)

[slackware-security] seamonkey (SSA:2015-318-01) (Slackware Security Team <security@...ckware.com>)
D-link wireless router DIR-816L Cross-Site Request Forgery (CSRF) vulnerability (bhadresh.patel@...pag.com)
/tmp race condition in IBM Installation Manager V1.8.1 install script (larry0@...com)
[SECURITY] [DSA 3208-2] freexl regression update (Salvatore Bonaccorso <carnil@...ian.org>)
PHP Address Book SQL Injection Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
CF Image Host PHP Command Injection (apparitionsec@...il.com)
CF Image Host CSRF (apparitionsec@...il.com)
CF Image Host XSS (apparitionsec@...il.com)
Dlink DIR-866L Buffer overflows in HNAP and send email functionalities (samhuntley84@...il.com)
Dlink SSDP command injection using UDP for a lot of Dlink routers including DIR-815, DIR-850L (samhuntley84@...il.com)
Dlink DIR-880L Buffer overflows in authenticatio and HNAP functionalities. (samhuntley84@...il.com)
Dlink DIR-825 (vC) Buffer overflows in authentication,HNAP and ping functionalities and also directory traversal issue exists (samhuntley84@...il.com)
Dlink DIR-890L/R Buffer overflows in authentication and HNAP functionalities. (samhuntley84@...il.com)
Dlink DIR-615 Authenticated Buffer overflow in Ping and Send email functionality (samhuntley84@...il.com)
Dlink DIR-818W Buffer overflows and Command injection in authentication and HNAP functionalities (samhuntley84@...il.com)
Dlink DIR-817LW Buffer overflows and Command injection in authentication and HNAP functionalities (samhuntley84@...il.com)
Dlink DIR-815 Buffer overflows and Command injection in authentication and HNAP functionalities (samhuntley84@...il.com)
Dlink DIR-645 UPNP Buffer Overflow (samhuntley84@...il.com)
Dlink DIR-601 Command injection in ping functionality (samhuntley84@...il.com)
Dlink DIR-880L Buffer overflows in authenticatio and HNAP functionalities. (samhuntley84@...il.com)
Dlink DGL5500 Un-Authenticated Buffer overflow in HNAP functionality (samhuntley84@...il.com)
[security bulletin] HPSBGN03428 rev.3 - HP Asset Manager Web UI Client, Local Disclosure of Sensitive Information (security-alert@....com)
SYSS-2015-061 Wirecard Checkout Page - Improper Validation of Integrity Check Value (martin.sturm@...s.de)

November 16 (2 messages)

CVE-2015-6357: Cisco FireSIGHT Management Center SSL Validation Vulnerability (Matthew Flanagan <mattimustang@...il.com>)
[SECURITY] [DSA 3398-1] strongswan security update (Yves-Alexis Perez <corsac@...ian.org>)

November 17 (9 messages)

LAN Scan HD v1.20 iOS - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Port Scan v2.0 iOS - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Magento Bug Bounty #24 - Multiple CSRF Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Magento Bug Bounty #22 - (Profile) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Murgent CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Free WMA MP3 Converter - Buffer Overflow Exploit (SEH) (Vulnerability Lab <research@...nerability-lab.com>)
Open-Xchange Security Advisory 2015-11-17 (Martin Heiland <martin.heiland.lists@...n-xchange.com>)
ESA-2015-163: EMC VPLEX Sensitive Information Exposure Vulnerability (Security Alert <Security_Alert@....com>)
WordPress Users Ultra Plugin [Unrestricted File Upload] (pan.vagenas@...il.com)

November 18 (3 messages)

[security bulletin] HPSBGN03521 rev.1 - HP Operations Orchestration Central, Cross-Site Request Forgery (CSRF) (security-alert@....com)
Adobe Premiere Clip v1.1.1 iOS - (cid:x) Filter Bypass & Persistent Software Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
RCE and SQL injection via CSRF in Horde Groupware (High-Tech Bridge Security Research <advisory@...ridge.ch>)

November 19 (7 messages)

[SECURITY] [DSA 3399-1] libpng security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBGN03521 rev.2 - HP Operations Orchestration Central, Cross-Site Request Forgery (CSRF) (security-alert@....com)
IBM i Access Buffer Overflow Code Exec CVE-2015-2023 (apparitionsec@...il.com)
IBM i Access Buffer Overflow Code DOS CVE-2015-7422 (apparitionsec@...il.com)
CVE-2015-8131: Kibana CSRF vulnerability (Kevin Kluge <kevin@...stic.co>)
NEW VMSA-2015-0008 - VMware product updates address information disclosure issue (VMware Security Response Center <security@...are.com>)
[security bulletin] HPSBUX03522 SSRT102942 rev.1 - HP-UX BIND running named, Remote Denial of Service (DoS) (security-alert@....com)

November 20 (1 message)

[SECURITY] [DSA 3400-1] lxc security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 21 (2 messages)

Fwd: CVE-2015-5256: Apache Cordova vulnerable to improper application of whitelist restrictions (Shazron <shazron@...che.org>)
Fwd: CVE-2015-5257 - Weak Randomization of BridgeSecret for Apache Cordova Android (Shazron <shazron@...che.org>)

November 23 (13 messages)

Proftpd v1.3.5a ZERODAY - Heap Overflows due to zero length mallocs. Advanced Information Security Corporation ("Nicholas Lemonias." <lem.nikolas@...glemail.co…)
Proftpd v1.3.5a ZERODAY - Heap Overflows due to zero length mallocs. Advanced Information Security Corporation ("Nicholas Lemonias." <lem.nikolas@...glemail.co…)
Proftpd ZERODAY - Malloc issues Advanced Information Security Corporation ("Nicholas Lemonias." <lem.nikolas@...glemail.com>)
Proftpd v1.3.5a ZERODAY - Heap Overflows due to zero length mallocs. Advanced Information Security Corporation ("Nicholas Lemonias." <lem.nikolas@...glemail.co…)
Proftpd v1.3.5a ZERODAY - Heap Overflows due to zero length mallocs. Advanced Information Security Corporation ("Nicholas Lemonias." <lem.nikolas@...glemail.co…)
Proftpd v1.3.5a ZERODAY - Malloc issues Advanced Information Security Corporation ("Nicholas Lemonias." <lem.nikolas@...glemail.com>)
Proftpd v1.3.5a ZERODAY - Heap Overflows due to zero length mallocs. Advanced Information Security Corporation ("Nicholas Lemonias." <lem.nikolas@...glemail.co…)
[ERPSCAN-15-020] SAP Mobile Platform 2.3 - XXE in application import (ERPScan inc <erpscan.online@...il.com>)
[FD] Celoxis <= 9.5 - Cross Site Scripting (XSS) (Manuel Mancera <mmancera@...ecure.com>)
[ERPSCAN-15-019] SAP Afaria - Stored XSS (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-018] SAP NetWeaver 7.4 - XXE (ERPScan inc <erpscan.online@...il.com>)
CVE-2015-5255: SSRF vulnerability in Apache Flex BlazeDS 4.7.1 ("Christofer Dutz" <cdutz@...che.org>)
Steam Weak File Permissions Privilege Escalation (ajs@...rdshield.com)

November 24 (1 message)

[SECURITY] [DSA 3402-1] symfony security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 25 (7 messages)

ESA-2015-164: EMC Isilon OneFS Privilege Escalation Vulnerability (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3403-1] libcommons-collections3-java security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] pcre (SSA:2015-328-01) (Slackware Security Team <security@...ckware.com>)
[security bulletin] HPSBGN03523 rev.1 - HP Loadrunner Virtual Table Server, Remote Code Execution (security-alert@....com)
[security bulletin] HPSBGN03523 rev.1 - HP Loadrunner Virtual Table Server, Remote Code Execution (security-alert@....com)
CIS Manager Content Management System 2015Q4 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3404-1] python-django security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 26 (3 messages)

[SECURITY] [DSA 3406-1] nspr security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3405-1] smokeping security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3407-1] dpkg security update (Salvatore Bonaccorso <carnil@...ian.org>)

November 27 (1 message)

[FD] Visual Paradigm Server v10.0 - Cross Site Scripting (XSS) (Manuel Mancera <mmancera@...ecure.com>)

November 30 (15 messages)

Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Corporation (aiscorp@...es.greetz.com)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Corporation (lem.nikolas@...il.com)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST 0day (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Corporation Audit Re… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Belkin N150 Wireless Home Router Multiple Vulnerabilities (Rahul Pratap Singh <techno.rps@...il.com>)
Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security Cor… ("Nicholas Lemonias." <lem.nikolas@...gl…)
Proftpd 1.3.5a LATEST (0-day) Follow-up report (Part 2), Patch released!! 29/11/2015 --- Advanced Information Security … ("Nicholas Lemonias." <lem.nikolas@...gl…)
LSE Leading Security Experts GmbH - LSE-2015-10-14 - HumHub SQL-Injection (advisories <advisories@...xperts.de>)
[SE-2014-02] Errata document for Issue 42 (CVE-2015-4871 affecting Java SE 7) (Security Explorations <contact@...urity-explorations.com>)

147 messages

Powered by blists - more mailing lists