bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2015/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 3	² 12	³ 5	⁴ 3	⁵	⁶ 2
⁷ 9	⁸ 1	⁹	¹⁰ 31	¹¹ 3	¹² 2	¹³ 3
¹⁴ 5	¹⁵ 6	¹⁶ 14	¹⁷ 11	¹⁸ 4	¹⁹ 2	²⁰
²¹ 9	²² 11	²³ 5	²⁴ 1	²⁵	²⁶	²⁷ 2
²⁸ 2	²⁹	³⁰ 1	³¹ 3

Messages by day:

December 1 (3 messages)

Huawei Wimax routers vulnerable to multiple threats (Pierre Kim <pierre.kim.sec@...il.com>)
[SECURITY] [DSA 3408-1] gnutls26 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Zenphoto 1.4.10 XSS Vulnerability (apparitionsec@...il.com)

December 2 (12 messages)

Zenphoto 1.4.10 Local File Inclusion (apparitionsec@...il.com)
[SECURITY] [DSA 3410-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3409-1] putty security update (Salvatore Bonaccorso <carnil@...ian.org>)
Reflected Cross-Site Scripting (XSS) in SourceBans (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Reflected XSS in Role Scoper WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Reflected XSS in Ultimate Member WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Remote File Inclusion in Gwolle Guestbook WordPress Plugin (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Two Reflected XSS Vulnerabilities in Calls to Action WordPress plugin (High-Tech Bridge Security Research <advisory@...ridge.ch>)
SQLi Vulnerability in ATuter management system (sirus.shahini@...il.com)
Gnome Nautilus [Denial of Service] (pan.vagenas@...il.com)
WordPress Users Ultra Plugin [Blind SQL injection] (pan.vagenas@...il.com)
WordPress Users Ultra Plugin [Persistence XSS] (pan.vagenas@...il.com)

December 3 (5 messages)

Ellucian Banner Student Vulnerability Disclosure (sean.dillon@...ksense.com)
[SECURITY] [DSA 3411-1] cups-filters security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] libpng (SSA:2015-337-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-thunderbird (SSA:2015-337-02) (Slackware Security Team <security@...ckware.com>)
ESA-2015-171 EMC NetWorker Denial-of-service Vulnerability (Security Alert <Security_Alert@....com>)

December 4 (3 messages)

[SECURITY] [DSA 3412-1] redis security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBGN03525 rev.1: HP Performance Center Virtual Table Server, Remote Code Execution (security-alert@....com)
[SECURITY] [DSA 3413-1] openssl security update (Salvatore Bonaccorso <carnil@...ian.org>)

December 6 (2 messages)

KL-001-2015-006 : Linksys EA6100 Wireless Router Authentication Bypass (KoreLogic Disclosures <disclosures@...elogic.com>)
FreeBSD Security Advisory FreeBSD-SA-15:26.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)

December 7 (9 messages)

Edimax BR-6478AC & Others Multiple Vulnerabilites (mwinstead3790@...il.com)
[SYSS-2015-046] sysPass - Insecure Direct Object References (CWE-932) (disclosure@...s.de)
[SYSS-2015-047] sysPass - Cross-Site Scripting (CWE-79) (disclosure@...s.de)
Command Injection in cool-video-gallery v1.9 Wordpress plugin (Larry Cashdollar <larry0@...com>)
Executable installers are vulnerable^WEVIL (case 6): SumatraPDF-*-installer.exe allows remote code execution with escala… ("Stefan Kanthak" <stefan.kanthak@...go.…)
WebBoutiques Cms Cross-Site Scripting Vulnerability (iedb.team@...il.com)
iScripts Multicart Cms Multiple Vulnerability (iedb.team@...il.com)
Executable installers are vulnerable^WEVIL (case 2): NSIS allows remote code execution with escalation of privilege ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Executable installers are vulnerable^WEVIL (case 8): vlc-*.exe allows remote code execution with escalation of privilege ("Stefan Kanthak" <stefan.kanthak@...go.…)

December 8 (1 message)

Executable installers are vulnerable^WEVIL (case 5): JRSoft InnoSetup ("Stefan Kanthak" <stefan.kanthak@...go.de>)

December 10 (31 messages)

[SECURITY] [DSA 3415-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
MacOS/iPhone/Apple Watch/Apple TV libc File System Buffer Overflow (submit@...ec.org)
WordPress Users Ultra Plugin [Blind SQL injection] - Update (Panagiotis Vagenas <pan.vagenas@...il.com>)
PHP File Inclusion in bitrix.mpbuilder Bitrix Module (High-Tech Bridge Security Research <advisory@...ridge.ch>)
XSS vulnerability in Intellect Core banking software - Polaris (msahu@...trolcase.com)
[CVE-2015-7706] SECURE DATA SPACE API Multiple Non-Persistent Cross-Site Scripting Vulnerabilities ("Vogt, Thomas" <Thomas.Vogt@...unet.com>)
APPLE-SA-2015-12-08-4 watchOS 2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Path Traversal via CSRF in bitrix.xscan Bitrix Module (High-Tech Bridge Security Research <advisory@...ridge.ch>)
[security bulletin] HPSBMU03520 rev.1 - HP Insight Control server provisioning, Remote Disclosure of Information (security-alert@....com)
Executable installers are vulnerable^WEVIL (case 9): Chrome's setup.exe allows arbitrary code execution and escalation o… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Advisory: Arro and Other Android Taxi Hailing Apps Did Not Use SSL (Mobile Knowledge) (securityresearch@...ftek.biz)
APPLE-SA-2015-12-08-1 iOS 9.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-12-08-4 watchOS 2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-12-08-4 watchOS 2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-12-08-4 watchOS 2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-12-08-5 Safari 9.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-12-08-4 watchOS 2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBHF03433 SSRT102964 rev.1 - HP-UX Running Mozilla Firefox and Thunderbird, Remote Disclosure of Information (security-alert@....com)
[CORE-2015-0014] - Microsoft Windows Media Center link file incorrectly resolved reference (CORE Advisories Team <advisories@...esecurity.com>)
Cisco Security Advisory: Cisco Prime Collaboration Assurance Default Account Credential Vulnerability (Cisco Systems Product Security Incident Response Team <ps…)
APPLE-SA-2015-12-08-4 watchOS 2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2015-12-08-2 tvOS 9.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBHF03432 rev.1 - HPE Networking Comware 5, Comware 5 Low Encryption SW, Comware 7, VCX Using NTP, Remote Access Re… (security-alert@....com)
APPLE-SA-2015-12-08-1 iOS 9.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 3414-1] xen security update (Moritz Muehlenhoff <jmm@...ian.org>)
APPLE-SA-2015-12-08-3 OS X El Capitan 10.11.2 and Security Update 2015-008 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Secunia Research: Microsoft Windows usp10.dll "GetFontDesc()" Integer Underflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
APPLE-SA-2015-12-08-6 Xcode 7.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Cisco Security Advisory: Vulnerability in Java Deserialization Affecting Cisco Products (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
SEC Consult SA-20151210-0 :: Skybox Platform Multiple Vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)
BFS-SA-2015-003: Internet Explorer CObjectElement Use-After-Free Vulnerability (Blue Frost Security Research Lab <research@...efrostsecurity.de>)

December 11 (3 messages)

WordPress <=v4.4 Username Exists Information Disclosure ("John SECURELI.com" <john@...ureli.com>)
Executable installers are vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege ("Stefan Kanthak" <stefan.kanthak@...go.d…)
ORGIN STUDIOS Cms Multiple Vulnerability (iedb.team@...il.com)

December 12 (2 messages)

APPLE-SA-2015-12-11-1 iTunes 12.3.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBHF03431 rev.1 - HPE Network Switches, local Bypass of Security Restrictions, Indirect Vulnerabilities (security-alert@....com)

December 13 (3 messages)

XSS Vulnerability in Synnefo Client for Synnefo IMS 2015 - CVE-2015-8247 (Aravind <altoarun@...il.com>)
Windows Authentication UI DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
COM+ Services DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)

December 14 (5 messages)

[SECURITY] [DSA 3416-1] libphp-phpmailer security update (Luciano Bello <luciano@...ian.org>)
ECommerceMajor SQL Injection Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
[ERPSCAN-15-021] SAP NetWeaver 7.4 - SQL Injection vulnerability (ERPScan inc <erpscan.online@...il.com>)
[SECURITY] [DSA 3417-1] bouncycastle security update (Luciano Bello <luciano@...ian.org>)
ERPSCAN Research Advisory [ERPSCAN-15-022] SAP NetWeaver 7.4 - XSS (ERPScan inc <erpscan.online@...il.com>)

December 15 (6 messages)

phpback v1.1 XSS vulnerability (apparitionsec@...il.com)
Back to 28: Grub2 Authentication Bypass 0-Day [CVE-2015-8370] (Hector Marco-Gisbert <hecmargi@....es>)
[security bulletin] HPSBST03517 rev.1 - HP StoreOnce Backup systems, Remote Execution of Arbitrary Code with Privilege Elevation, Cross-S… (security-alert@....com)
[SECURITY] [DSA 3418-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
Executable installers are vulnerable^WEVIL (case 10): McAfee Security Scan Plus, WebAdvisor and CloudAV (Beta) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[SECURITY] [DSA 3419-1] cups-filters security update (Salvatore Bonaccorso <carnil@...ian.org>)

December 16 (14 messages)

[SECURITY] [DSA 3420-1] bind9 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[slackware-security] libpng (SSA:2015-349-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] bind (SSA:2015-349-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] openssl (SSA:2015-349-04) (Slackware Security Team <security@...ckware.com>)
libnsgif: stack overflow (CVE-2015-7505) and out-of-bounds read (CVE-2015-7506) (Hans Jerry Illikainen <hji@...topia.com>)
RCE in Zen Cart via Arbitrary File Inclusion (High-Tech Bridge Security Research <advisory@...ridge.ch>)
SQL Injection in orion.extfeedbackform Bitrix Module (High-Tech Bridge Security Research <advisory@...ridge.ch>)
FreeBSD Security Advisory FreeBSD-SA-15:27.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
libnsbmp: heap overflow (CVE-2015-7508) and out-of-bounds read (CVE-2015-7507) (Hans Jerry Illikainen <hji@...topia.com>)
Event Viewer Snapin multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)
[security bulletin] HPSBUX03529 SSRT102967 rev.1 - HP-UX BIND service running named, Remote Denial of Service (DoS) (security-alert@....com)
Shutdown UX DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
Shockwave Flash Object DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
[SECURITY] [DSA 3422-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)

December 17 (11 messages)

[SECURITY] [DSA 3421-1] grub2 security update (Luciano Bello <luciano@...ian.org>)
[SECURITY] [DSA 3423-1] cacti security update (Luciano Bello <luciano@...ian.org>)
[security bulletin] HPSBHF03528 rev.1 - HP Network Products running VCX, Remote Unauthorized Modification (security-alert@....com)
[SECURITY] [DSA 3424-1] subversion security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] mozilla-firefox (SSA:2015-349-03) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 3337-2] gdk-pixbuf security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2015-5348 - Apache Camel medium disclosure vulnerability (Claus Ibsen <claus.ibsen@...il.com>)
[SECURITY] [DSA 3425-1] tryton-server security update (Luciano Bello <luciano@...ian.org>)
[SECURITY] [DSA 3425-1] tryton-server security update (Luciano Bello <luciano@...ian.org>)
[oCERT 2015-011] PyAMF input sanitization errors (XXE) (Daniele Bianco <danbia@...rt.org>)
ESA-2015-148: EMC Isilon OneFS Security Privilege Escalation Vulnerability (Security Alert <Security_Alert@....com>)

December 18 (4 messages)

[SECURITY] [DSA 3426-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
Executable uninstallers are vulnerable^WEVIL (case 12): Avira Registry Cleaner allows arbitrary code execution with esca… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[slackware-security] libpng (SSA:2015-351-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] grub (SSA:2015-351-01) (Slackware Security Team <security@...ckware.com>)

December 19 (2 messages)

KL-001-2015-008 : Dell Pre-Boot Authentication Driver Uncontrolled Write to Arbitrary Address (KoreLogic Disclosures <disclosures@...elogic.com>)
[SECURITY] [DSA 3428-1] tomcat8 security update (Moritz Muehlenhoff <jmm@...ian.org>)

December 21 (9 messages)

[SECURITY] [DSA 3427-1] blueman security update (Moritz Muehlenhoff <jmm@...ian.org>)
KL-001-2015-007 : Seagate GoFlex Satellite Remote Telnet Default Password (KoreLogic Disclosures <disclosures@...elogic.com>)
Almost no resp. only some mitigation(s) for "DLL hijacking" via load-time dependencies ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Executable installers are vulnerable^WEVIL (case 13): ESET NOD32 antivirus installer allows remote code execution with e… ("Stefan Kanthak" <stefan.kanthak@...go.…)
giflib: heap overflow in giffix (CVE-2015-7555) (Hans Jerry Illikainen <hji@...topia.com>)
ESA-2015-177: RSA SecurID(r) Web Agent Authentication Bypass Vulnerability (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3429-1] foomatic-filters security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBGN03527 rev.1 - HPE Helion Eucalyptus, Remote Access Restriction Bypass (security-alert@....com)
[security bulletin] HPSBGN03526 rev.1 - HPE Helion Eucalyptus, Remote Access Restriction Bypass, Unauthorized Modification (security-alert@....com)

December 22 (11 messages)

[security bulletin] HPSBHF03419 rev.1 - HP Network Products including H3C routers and switches, Remote Denial of Service (DoS), Unauthori… (security-alert@....com)
Executable installers are vulnerable^WEVIL (case 14): Rapid7's ScanNowUPnP.exe allows arbitrary (remote) code execution ("Stefan Kanthak" <stefan.kanthak@...go.…)
[RT-SA-2015-013] Symfony PHP Framework: Session Fixation In "Remember Me" Login Functionality (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
DELL Scrutinizer v12.0.3 - Persistent Software Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Western Union CN Bug Bounty #6 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Wordpress Content Text Slider on Post 6.8 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Lithium Forum - (previewImages) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Switch v4.68 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
POP Peeper 4.0.1 - Persistent Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Aeris Calandar v2.1 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ESA-2015-174: EMC VPLEX Undocumented Account Vulnerability (Security Alert <Security_Alert@....com>)

December 23 (5 messages)

ESA-2015-179: EMC Secure Remote Services Virtual Edition Path Traversal Vulnerability (Security Alert <Security_Alert@....com>)
Security advisory for Bugzilla 5.0.2, 4.4.11 and 4.2.16 (LpSolit@...il.com)
[slackware-security] blueman (SSA:2015-356-01) (Slackware Security Team <security@...ckware.com>)
Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[SECURITY] [DSA 3430-1] libxml2 security update (Salvatore Bonaccorso <carnil@...ian.org>)

December 24 (1 message)

[slackware-security] mozilla-thunderbird (SSA:2015-357-01) (Slackware Security Team <security@...ckware.com>)

December 27 (2 messages)

AccessDiver V4.301 Buffer Overflow (apparitionsec@...il.com)
libtiff: invalid write (CVE-2015-7554) (Hans Jerry Illikainen <hji@...topia.com>)

December 28 (2 messages)

libtiff bmp file Heap Overflow (CVE-2015-8668) (riusksk@...com)
WebKitGTK+ Security Advisory WSA-2015-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

December 30 (1 message)

[oCERT 2015-012] Ganeti multiple issues (Daniele Bianco <danbia@...rt.org>)

December 31 (3 messages)

FTPShell Client v5.24 Buffer Overflow (apparitionsec@...il.com)
Executable installers are vulnerable^WEVIL (case 16): Trend Micro's installers allows arbitrary (remote) code execution ("Stefan Kanthak" <stefan.kanthak@...go.…)
Joomla 1.5.x to 3.4.5 Object Injection Exploit (golang) (irancrash@...il.com)

150 messages