bugtraq mailing list - 2016/02

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2016/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 13	² 4	³ 11	⁴ 15	⁵ 3	⁶	⁷
⁸ 20	⁹ 7	¹⁰ 12	¹¹ 6	¹² 6	¹³	¹⁴ 8
¹⁵ 1	¹⁶ 12	¹⁷	¹⁸ 10	¹⁹	²⁰ 19	²¹
²² 13	²³ 5	²⁴ 18	²⁵ 7	²⁶ 3	²⁷	²⁸
²⁹ 21

Messages by day:

February 1 (13 messages)

CVE-2015-5344 - Apache Camel medium disclosure vulnerability (Claus Ibsen <claus.ibsen@...il.com>)
[SECURITY] [DSA 3460-1] privoxy security update (Sebastien Delafond <seb@...ian.org>)
VMWare Zimbra Mailer | DKIM longterm Mail Replay vulnerability (t.schughart@...sec-networks.com)
OpenXchange | Information Disclosure (t.schughart@...sec-networks.com)
WP-Comment-Rating XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Executable installers are vulnerable^WEVIL (case 23): WinImage's installer and self-extractors allow arbitrary (remote) … ("Stefan Kanthak" <stefan.kanthak@...go.…)
eClinicalWorks (CCMR) - Multiple Vulnerabilities (jerold@...d00sec.com)
[SECURITY] [DSA 3464-1] rails security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3463-1] prosody security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3462-1] radicale security update (Yves-Alexis Perez <corsac@...ian.org>)
[SECURITY] [DSA 3461-1] freetype security update (Sebastien Delafond <seb@...ian.org>)
Netlife Photosuite Pro - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
File Hub v3.3 iOS (Wifi) - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

February 2 (4 messages)

WebKitGTK+ Security Advisory WSA-2016-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
A tale of openssl_seal(), PHP and Apache2handle (s3810@...stk.edu.pl)
Re: VMWare Zimbra Mailer | DKIM longterm Mail Replay vulnerability (Phil Pearl <ppearl@...bra.com>)
MailPoet Newsletter 2.6.19 - Security Advisory - Reflected XSS (Onur Yilmaz <onur@...sparker.com>)

February 3 (11 messages)

[SECURITY] [DSA 3465-1] openjdk-6 security update (Moritz Muehlenhoff <jmm@...ian.org>)
TimeClock - Multiple SQL Injections (marcelabx@...il.com)
ASUS RT-N56U Persistent XSS (graphx@...aint.org)
Mezzanine CMS 4.1.0 Arbitrary File Upload (hyp3rlinx@...os.com)
Mezzanine CMS 4.1.0 XSS (hyp3rlinx@...os.com)
Compal ConnectBox Wireless - Passphrase Settings Filter Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Getdpd Bug Bounty #1 - (asm0option0) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
SimpleView CRM - Client Side Open Redirect Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
File Manager PRO v1.3 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Soso Transfer v1.1 iOS - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Security Advisories (Portcullis Advisories <advisories@...tcullis-security.com>)

February 4 (15 messages)

Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability (Cisco Systems Product Security Incident Response Team …)
Cisco Security Advisory: Cisco ASA-CX and Cisco Prime Security Manager Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team…)
Cisco Security Advisory: Cisco Nexus 9000 Series ACI Mode Switch ICMP Record Route Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@c…)
Dell SecureWorks iOS Application - MITM SSL Certificate Vulnerability (David Coomber <davidcoomber.infosec@...il.com>)
[CERT 777024 / CVE-2016-1524/5]: RCE and file download in Netgear NMS300 (Pedro Ribeiro <pedrib@...il.com>)
AST-2016-001: BEAST vulnerability in HTTP server ("Asterisk Security Team" <security@...erisk.org>)
AST-2016-003: Remote crash vulnerability when receiving UDPTL FAX data. ("Asterisk Security Team" <security@...erisk.org>)
AST-2016-002: File descriptor exhaustion in chan_sip ("Asterisk Security Team" <security@...erisk.org>)
[slackware-security] MPlayer (SSA:2016-034-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] php (SSA:2016-034-04) (Slackware Security Team <security@...ckware.com>)
[slackware-security] openssl (SSA:2016-034-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2016-034-01) (Slackware Security Team <security@...ckware.com>)
Apple iOS v9.1, 9.2 & 9.2.1 - Application Update Loop Pass Code Bypass (Vulnerability Lab <research@...nerability-lab.com>)
WordPress User Meta Manager Plugin [Privilege Escalation] (pan.vagenas@...il.com)
WordPress User Meta Manager Plugin [Blind SQLI] (pan.vagenas@...il.com)

February 5 (3 messages)

[SECURITY] [DSA 3466-1] krb5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2015-3251: Apache CloudStack VM Credential Exposure (John Kinsella <jlk@...ashyour.com>)
CVE-2015-3252: Apache CloudStack VNC authentication issue (John Kinsella <jlk@...ashyour.com>)

February 8 (20 messages)

[security bulletin] HPSBHF03431 rev.2 - HPE Network Switches, local Bypass of Security Restrictions, Indirect Vulnerabilities (security-alert@....com)
[security bulletin] HPSBGN03434 rev.1 - HP Continuous Delivery Automation using Java Deserialization, Remote Arbitrary Code Execution (security-alert@....com)
[CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox ("Stefan Kanthak" <stefan.kanthak@...go.…)
[security bulletin] HPSBGN03430 rev.3 - HP ArcSight products, Local Elevation of Privilege (security-alert@....com)
Multiple vulnerabilities in Open Real Estate v 1.15.1 ("Simon Waters \(Surevine\)" <simon.waters@...evine.com>)
[SECURITY] [DSA 3467-1] tiff security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3468-1] polarssl security update (Sebastien Delafond <seb@...ian.org>)
CFP: SIN 2016 - 9th International Conference on Security of Information and Networks (Hossain Shahriar <hshahria@...nesaw.edu>)
Executable installers are vulnerable^WEVIL (case 25): WinRAR's installer and self-extractors allow arbitrary (remote) co… ("Stefan Kanthak" <stefan.kanthak@...go.…)
WordPress User Meta Manager Plugin [Information Disclosure] (Panagiotis Vagenas <pan.vagenas@...il.com>)
Symphony CMS multiple vulnerabilities (Filippo Cavallarin <filippo.cavallarin@...resegment.com>)
Local Microsoft Windows 7 / 8 / 10 Buffer Overflow via Third-Party USB-Driver (ser2co64.sys) (Ralf Spenneberg <info@...t.de>)
JavaScript Anywhere v3.0.4 iOS - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Getdpd BB #5 - Persistent Filename Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Getdpd BB #4 - (name) Persistent Validation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Alsovalue CMS 2016Q1 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Ebay Inc (Pages) - Client Side Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
PressePortal NewsAktuell (DPA) - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
WordPress WooCommerce - Store Toolkit Plugin [Privilege Escalation] (Panagiotis Vagenas <pan.vagenas@...il.com>)
WordPress WP User Frontend Plugin [Unrestricted File Upload] (Panagiotis Vagenas <pan.vagenas@...il.com>)

February 9 (7 messages)

[SECURITY] [DSA 3471-1] qemu security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3469-1] qemu security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3470-1] qemu-kvm security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3472-1] wordpress security update (Salvatore Bonaccorso <carnil@...ian.org>)
[slackware-security] libsndfile (SSA:2016-039-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] curl (SSA:2016-039-01) (Slackware Security Team <security@...ckware.com>)
Privilege escalation Vulnerability in ManageEngine Network Configuration Management (kingkaustubh@...com)

February 10 (12 messages)

ESA-2016-010 EMC Documentum xCP Security Update for Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
Safebreach adsivory: Node.js HTTP Response Splitting (CVE-2016-2216) (Amit Klein <aksecurity@...il.com>)
dotDefender Firewall CSRF (hyp3rlinx@...os.com)
ManageEngine Eventlog Analyzer Privilege Escalation v10.8 (graphx@...aint.org)
SEC Consult SA-20160210-0 :: Yeager CMS Multiple Vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)
VP2016-001: Remote Command Execution in File Replication Pro (Vantage Point Security <lists@...tagepoint.sg>)
Getdpd Bug Bounty #6 - (Import - FTP) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
File Sharing Manager v1.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
MyScript Memo v3.0 iOS - (Mail) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Apache Sling Framework v2.3.6 - Information Disclosure Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Remote Code Execution in Exponent (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Cisco Security Advisory: Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)

February 11 (6 messages)

NPS Datastore server DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
BDA MPEG2 Transport Information Filter DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
MapsUpdateTask Task DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
Re: OLE DB Provider for Oracle multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)
Re: [FD] [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and V… (Jason Hellenthal <jhellenthal@...aix.ne…)
Duplicator Wordpress Plugin - Source Code And Database Dump Via CSRF Vulnerability (Ratio Sec <ratiosec@...il.com>)

February 12 (6 messages)

Re: OLE DB Provider for Oracle multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)
Re: [oss-security] HTTPS Only (Open Source, Python) (P J P <ppandit@...hat.com>)
[SECURITY] [DSA 3473-1] nginx security update (Salvatore Bonaccorso <carnil@...ian.org>)
[slackware-security] mozilla-firefox (SSA:2016-042-01) (Slackware Security Team <security@...ckware.com>)
CVE-2015-0061 and CVE-2015-0063 (MS16-009/MS16-011) (Berend-Jan Wever <berendjanwever@...il.com>)
HD Video Player v2.5 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

February 14 (8 messages)

[SECURITY] [DSA 3474-1] libgcrypt20 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ERPSCAN-15-031] SAP MII – Encryption Downgrade vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-15-032] SAP PCo agent – DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
KL-001-2016-001 : Arris DG1670A Cable Modem Remote Command Execution (KoreLogic Disclosures <disclosures@...elogic.com>)
[SECURITY] [DSA 3475-1] postgresql-9.1 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3476-1] postgresql-9.4 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3477-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
Xymon: Critical security issues in all versions prior to 4.3.25 (Xymon Software <henrik@...on.com>)

February 15 (1 message)

BFS-SA-2016-001: FireEye Detection Evasion and Whitelisting of Arbitrary Malware (Blue Frost Security Research Lab <research@...efrostsecurity.de>)

February 16 (12 messages)

phpMyBackupPro v.2.5 XSS (hyp3rlinx@...os.com)
phpMyBackupPro v.2.5 Arbitrary File Upload (hyp3rlinx@...os.com)
phpMyBackupPro v.2.5 Remote Command Execution / CSRF (hyp3rlinx@...os.com)
CyberCop Scanner Smbgrind v5.5 Buffer Overflow (hyp3rlinx@...os.com)
[SECURITY] [DSA 3479-1] graphite2 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3478-1] libgcrypt11 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Missing Function Level Access control Vulnerability in OPutils (kingkaustubh@...com)
Privilege escalation Vulnerability in ManageEngine oputils (kingkaustubh@...com)
CSRF and XsS In Manage Engine oputils (kingkaustubh@...com)
[SECURITY] [DSA 3480-1] eglibc security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3481-1] glibc security update (Salvatore Bonaccorso <carnil@...ian.org>)
Redaxo CMS contains multiple vulnerabilities (LSE-Advisories <advisories@...xperts.de>)

February 18 (10 messages)

RCE via CSRF in osCmax (High-Tech Bridge Security Research <advisory@...ridge.ch>)
SQL Injection in Osclass (High-Tech Bridge Security Research <advisory@...ridge.ch>)
SQL Injection in WeBid (High-Tech Bridge Security Research <advisory@...ridge.ch>)
SQL Injection in TestLink (High-Tech Bridge Security Research <advisory@...ridge.ch>)
SQL Injection in webSPELL (High-Tech Bridge Security Research <advisory@...ridge.ch>)
SSO Authentication Bypass and Website Takeover in DOKEOS (High-Tech Bridge Security Research <advisory@...ridge.ch>)
RCE via CSRF in osCommerce (High-Tech Bridge Security Research <advisory@...ridge.ch>)
[SECURITY] [DSA 3482-1] libreoffice security update (Sebastien Delafond <seb@...ian.org>)
[security bulletin] HPSBUX03437 SSRT110025 rev.1 - HP-UX IPFilter, Remote Denial of Service (DoS) (security-alert@....com)
CVE-2015-7521: Apache Hive authorization bug disclosure (update) (khorgath@...che.org (Sushanth Sowmyan))

February 20 (19 messages)

[SECURITY] [DSA 3484-1] xdelta3 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SYSS-2015-058] Thru Managed File Transfer Portal 9.0.2 - Insecure Direct Object Reference (CWE-932) (erlijn.vangenuchten@...s.de)
[SYSS-2015-055] Novell Filr - Cross-Site Scripting (CWE-79) (erlijn.vangenuchten@...s.de)
[SYSS-2015-062] ownCloud - Information Exposure Through Directory Listing (CWE-548) (erlijn.vangenuchten@...s.de)
[SYSS-2015-064] Thru Managed File Transfer Portal 9.0.2 - Insecure Direct Object Reference (CWE-932) (erlijn.vangenuchten@...s.de)
[SYSS-2015-060] Thru Managed File Transfer Portal 9.0.2 - Improperly Implemented Security Check for Standard (CWE-358) (erlijn.vangenuchten@...s.de)
[SYSS-2015-059] Thru Managed File Transfer Portal 9.0.2 - Insecure Direct Object Reference (CWE-932) (erlijn.vangenuchten@...s.de)
[SYSS-2015-057] Thru Managed File Transfer Portal 9.0.2 - Cross-Site Scripting (erlijn.vangenuchten@...s.de)
[SYSS-2015-056] Thru Managed File Transfer Portal 9.0.2 - SQL Injection (erlijn.vangenuchten@...s.de)
ifixit Bug Bounty #5 - Guide Search Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Adobe - Multiple Client Side Cross Site Scripting Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Chamilo LMS - Persistent Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Chamilo LMS IDOR - (messageId) Delete POST Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Investors Application - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Prezi Bug Bounty #5 - Client Side Cross Site Scripting & Open Redirect Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ifixit Bug Bounty #6 -(Profile) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3483-1] cpio security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBGN03547 rev.1 - HPE Helion Eucalyptus Node Controller and other Helion Eucalyptus Components using glibc, Remote … (security-alert@....com)
Cisco Security Advisory: Vulnerability in GNU glibc Affecting Cisco Products: February 2016 (Cisco Systems Product Security Incident Response Team <psirt@...co…)

February 22 (13 messages)

[SECURITY] [DSA 3485-1] didiwiki security update (Sebastien Delafond <seb@...ian.org>)
[security bulletin] HPSBHF03544 rev.1 - HPE iMC PLAT and other HP and H3C products using Comware 7 and cURL, Remote Unauthorized Access (security-alert@....com)
[SECURITY] [DSA 3486-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] CVE-2015-5346 Apache Tomcat Session fixation (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2016-0714 Apache Tomcat Security Manager Bypass (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2015-5345 Apache Tomcat Directory disclosure (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2016-0763 Apache Tomcat Security Manager Bypass (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2015-5351 Apache Tomcat CSRF token leak (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2015-5174 Apache Tomcat Limited Directory Traversal (Mark Thomas <markt@...che.org>)
InstantCoder v1.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Ubiquiti Networks Bug Bounty #9 - Invoice Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[SYSS-2015-063] OpenCms - Cross Site Scripting (rainer.boie@...s.de)

February 23 (5 messages)

Oxwall Forum v1.8.1 - Persistent Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
InstantCoder v1.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
CSNC-2016-002 - Open Redirect in OpenAM (Alexandre Herzog <Alexandre.Herzog@...c.ch>)
CVE-2015-0955 - Stored XSS in Adobe Experience Manager (AEM) (Alexandre Herzog <Alexandre.Herzog@...c.ch>)
CSNC-2016-001 - XSS in OpenAM (Alexandre Herzog <Alexandre.Herzog@...c.ch>)

February 24 (18 messages)

[SECURITY] [DSA 3488-1] libssh security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3489-1] lighttpd security update (Sebastien Delafond <seb@...ian.org>)
Ubiquiti Networks UniFi v3.2.10 Generic CSRF Protection Bypass (Julien Ahrens <info@...security.com>)
[slackware-security] bind (SSA:2016-054-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] glibc (SSA:2016-054-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] libgcrypt (SSA:2016-054-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] ntp (SSA:2016-054-04) (Slackware Security Team <security@...ckware.com>)
[KIS-2016-02] Magento <= 1.9.2.2 (RSS Feed) Information Disclosure Vulnerability (Egidio Romano <research@...mainsecurity.com>)
Extra User Details [Privilege Escalation] (Panagiotis Vagenas <pan.vagenas@...il.com>)
Re: Executable installers are vulnerable^WEVIL (case 26): the installer of GIMP for Windows allows arbitrary (remote) an… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Executable installers are vulnerable^WEVIL (case 4): InstallShield's wrapper and setup.exe ("Stefan Kanthak" <stefan.kanthak@...go.de>)
eFront 3.6.15.6 CMS – (Message Attachment) Persistent Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
CSV Import XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
WP Advanced Importer XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
WP Ultimate Exporter XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Import Woocommerce XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Belkin N150 Router Multiple XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
[SECURITY] [DSA 3490-1] websvn security update (Sebastien Delafond <seb@...ian.org>)

February 25 (7 messages)

WordPress User Submitted Posts Plugin [Persistent XSS] (Panagiotis Vagenas <pan.vagenas@...il.com>)
JSN PowerAdmin Joomla! Extension - Remote Command Execution Via CSRF and XSS vulnerabilities (Ratio Sec <ratiosec@...il.com>)
[SECURITY] [DSA 3491-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input ("Cantor, Scott" <cantor.2@....edu>)
[SECURITY] [DSA 3493-1] xerces-c security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3492-1] gajim security update (Yves-Alexis Perez <corsac@...ian.org>)
APPLE-SA-2016-02-25-1 Apple TV 7.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)

February 26 (3 messages)

WordPress plugin wp-ultimate-exporter SQL injection vulnerability (Henri Salo <henri@...v.fi>)
Zimbra Cross-Site Scripting vulnerabilities (pxli@...tinet.com)
RE: CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input (Shivaprasad Sadashivappa <Shivaprasad.S@...anz.com>)

February 29 (21 messages)

Executable installers are vulnerable^WEVIL (case 28): Google's Chrome cleanup tool allows arbitrary (remote) code execut… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Executable installers are vulnerable^WEVIL (case 27): Cygwin's installers allow arbitrary (remote) code execution WITH e… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[security bulletin] HPSBGN03549 rev.1 - HP IceWall Products using glibc, Remote Denial of Service (DoS), Arbitrary Code Execution (security-alert@....com)
[slackware-security] libssh (SSA:2016-057-01) (Slackware Security Team <security@...ckware.com>)
Re: Symantec EP DOS (hyp3rlinx@...os.com)
[SECURITY] [DSA 3494-1] cacti security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3497-1] php-horde security update (Salvatore Bonaccorso <carnil@...ian.org>)
Call For Papers - CISTI 2016 Workshops - Deadline March 15 ("Maria Lemos" <marialemos72@...il.com>)
[SECURITY] [DSA 3496-1] php-horde-core security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3499-1] pillow security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3498-1] drupal7 security advisory (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3495-1] xymon security update (Sebastien Delafond <seb@...ian.org>)
WP Good News Themes - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Fing v3.3.0 iOS - Persistent Mail Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SYSS-2015-073] perfact::mpa - URL Redirection to Untrusted Site (matthias.deeg@...s.de)
[SYSS-2015-072] perfact::mpa - Insecure Direct Object References (matthias.deeg@...s.de)
[SYSS-2015-071] perfact::mpa - Cross-Site Request Forgery (matthias.deeg@...s.de)
[SYSS-2015-070] perfact::mpa - Cross-Site Scripting (matthias.deeg@...s.de)
[SYSS-2015-066] perfact::mpa - Cross-Site Scripting (matthias.deeg@...s.de)
[SYSS-2015-067] perfact::mpa - Insecure Direct Object References (matthias.deeg@...s.de)
[SYSS-2015-069] perfact::mpa - Insecure Direct Object References (matthias.deeg@...s.de)

214 messages

Powered by blists - more mailing lists