bugtraq mailing list - 2016/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2016/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 3	²	³
⁴ 19	⁵ 6	⁶ 15	⁷ 8	⁸ 3	⁹	¹⁰
¹¹ 14	¹² 5	¹³ 5	¹⁴ 4	¹⁵ 11	¹⁶	¹⁷
¹⁸ 9	¹⁹ 6	²⁰ 9	²¹ 4	²² 6	²³	²⁴ 10
²⁵ 8	²⁶ 4	²⁷ 5	²⁸ 6	²⁹ 5	³⁰

Messages by day:

April 1 (3 messages)

Python v2.7 v1.5.4 iOS - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
WebKitGTK+ Security Advisory WSA-2016-0003 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
APPLE-SA-2016-03-31-1 iBooks Author 2.4.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)

April 4 (19 messages)

[security bulletin] HPSBGN3547 rev.1 - HP Device Manager, Remote Read Access to Arbitrary Files (HP Security Alert <hp-security-alert@...com>)
[security bulletin] HPSBGN03567 rev.1 - HP Asset Manager using Java Deserialization, Remote Arbitrary Code Execution (security-alert@....com)
[security bulletin] HPSBUX03561 rev.1 - HPE HP-UX using Apache Tomcat, Remote Access Restriction Bypass, Arbitrary Code Execution, Execut… (security-alert@....com)
[security bulletin] HPSBHF03431 rev.3 - HPE Network Switches, local Bypass of Security Restrictions, Indirect Vulnerabilities (security-alert@....com)
[slackware-security] php (SSA:2016-092-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mercurial (SSA:2016-092-01) (Slackware Security Team <security@...ckware.com>)
[security bulletin] HPSBGN03565 rev.1 - HPE Virtualization Performance Viewer, Local Denial of Service (DoS) (security-alert@....com)
Open-Xchange Security Advisory 2016-04-02 (Martin Heiland <martin.heiland.lists@...n-xchange.com>)
[SECURITY] [DSA 3539-1] srtp security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3540-1] lhasa security update (Moritz Muehlenhoff <jmm@...ian.org>)
Bugcrowd CSV injection vulnerability (Hack Ex <hackexfan@...il.com>)
Wordpress Scoreme Theme - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Techsoft Web Solutions CMS 2016 Q2 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FortiManager & FortiAnalyzer 5.x (Appliance Application) - (filename) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ManageEngine Password Manager Pro Multiple Vulnerabilities (Sebastian Perez <s3bap3@...il.com>)
CVE-2016-2191: optipng: invalid write (Hans Jerry Illikainen <hji@...topia.com>)
[SE-2012-01] Broken security fix in IBM Java 7/8 (Security Explorations <contact@...urity-explorations.com>)
ESA-2016-034: EMC Documentum D2 Configuration Object Vulnerability (Security Alert <Security_Alert@....com>)
Bitcoin/Altcoin Stratum Pool Mass Duplicate Shares Exploit ("lists@...loits4coins.com" <lists@...loits4coins.com>)

April 5 (6 messages)

[slackware-security] mozilla-thunderbird (SSA:2016-095-01) (Slackware Security Team <security@...ckware.com>)
[security bulletin] HPSBGN03569 rev.1 - HPE OneView for VMware vCenter (OV4VC), Remote Disclosure of Information (security-alert@....com)
[SECURITY] [DSA 3541-1] roundcube security update (Sebastien Delafond <seb@...ian.org>)
Apple iOS 9.3.1 (iPhone 6S & iPhone Plus) - (3D Touch) Passcode Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3542-1] mercurial security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3543-1] oar security update (Moritz Muehlenhoff <jmm@...ian.org>)

April 6 (15 messages)

Re: [SE-2012-01] Broken security fix in IBM Java 7/8 (Security Explorations <contact@...urity-explorations.com>)
CA20160405-01: Security Notice for CA API Gateway ("Kotas, Kevin J" <Kevin.Kotas@...com>)
op5 v7.1.9 Remote Command Execution (apparitionsec@...il.com)
[slackware-security] subversion (SSA:2016-097-01) (Slackware Security Team <security@...ckware.com>)
RE: FortiManager & FortiAnalyzer 5.x (Appliance Application) - (filename) Persistent Web Vulnerability (Jacques GRILLOT <jacques.grillot@...ooma.com>)
SQL Injection in SocialEngine (High-Tech Bridge Security Research <advisory@...ridge.ch>)
CVE-2016-3672 - Unlimiting the stack not longer disables ASLR (Hector Marco-Gisbert <hecmargi@....es>)
Cisco Security Advisory: Cisco TelePresence Server Crafted IPv6 Packet Handling Denial of Service Vulnerability (Cisco Systems Product Security Incident Respons…)
Cisco Security Advisory: Cisco TelePresence Server Crafted URL Handling Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <…)
Cisco Security Advisory: Cisco UCS Invicta Default SSH Key Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco TelePresence Server Malformed STUN Packet Processing Denial of Service Vulnerability (Cisco Systems Product Security Incident Res…)
Cisco Security Advisory: Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vu… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulne… (Cisco Systems Product Security Incident…)
[security bulletin] HPSBGN03569 rev.2 - HPE OneView for VMware vCenter (OV4VC), Remote Disclosure of Information (security-alert@....com)
[security bulletin] HPSBST03568 rev.1 - HP XP7 Command View Advanced Edition Suite including Device Manager and Hitachi Automation Direct… (security-alert@....com)

April 7 (8 messages)

Techsoft WS CMS (2016 Q2) - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Virtual Freer v1.58 - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Quicksilver HQ VoHo Concept4E CMS v1.0 - Multiple SQL Injection Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Eight Webcom CMS (2016 Q2) - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Perli v2.6 iOS - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBGN03570 rev.1 - HPE Universal CMDB, Remote Information Disclosure, URL Redirection (security-alert@....com)
[SECURITY] [DSA 3544-1] python-django security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3545-1] cgit security update (Salvatore Bonaccorso <carnil@...ian.org>)

April 8 (3 messages)

[SECURITY] [DSA 3546-1] optipng security update (Moritz Muehlenhoff <jmm@...ian.org>)
AccelSite Content Manager v1.0 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
JAWS Weak Service Permissions leads to Privilege Escalation (Heimbuecher003@...nect.wcsu.edu)

April 11 (14 messages)

CVE-2015-3268: Apache OFBiz information disclosure vulnerability ("jleroux@...che.org" <jleroux@...che.org>)
CVE-2016-2170: Apache OFBiz information disclosure vulnerability ("jleroux@...che.org" <jleroux@...che.org>)
WPN-XM Serverstack v0.8.6 XSS (hyp3rlinx@...os.com)
CSRF - MySQL / PHP.INI Hijacking (hyp3rlinx@...os.com)
WPN-XM Serverstack v0.8.6 CSRF - MySQL / PHP.INI Hijacking (hyp3rlinx@...os.com)
WPN-XM Serverstack v0.8.6 CSRF - MySQL / PHP.INI Hijacking (hyp3rlinx@...os.com)
Directadmin ControlPanel 1.50.0 Version Xss Vulnerability (iedb.team@...il.com)
OpenCart json_decode function Remote PHP Code Execution (r3s34rch3r@...oo.com)
Directadmin ControlPanel 1.50.0 Version Xss Vulnerability (iedb.team@...il.com)
Directadmin cp ( Delete User ) 1.50.0 Version Xss Vulnerability (iedb.team@...il.com)
[Multiple CVE]: RCE, info disclosure, HQL injection and stored XSS in Novell Service Desk 7.1.0 (Pedro Ribeiro <pedrib@...il.com>)
Blind SQL injections in CivicRM ("Simon Waters \(Surevine\)" <simon.waters@...evine.com>)
ESA-2016-013: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Lenstra’s Attack Vuln… (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3547-1] imagemagick security update (Luciano Bello <luciano@...ian.org>)

April 12 (5 messages)

[SECURITY] [DSA 3485-2] didiwiki security update (Sebastien Delafond <seb@...ian.org>)
Wordpress Robo Gallery v2.0.14 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Open redirect on Google.com (research@...htwatchcybersecurity.com)
.NET Framework 4.6 allows side loading of Windows API Set DLL ("Securify B.V." <lists@...urify.nl>)
CAM UnZip v5.1 Archive Directory Traversal (hyp3rlinx@...os.com)

April 13 (5 messages)

[SE-2012-01] Yet another broken security fix in IBM Java 7/8 (Security Explorations <contact@...urity-explorations.com>)
Vbulletin Cms (Sendmessage.php Page) 0Day Exploit (iedb.team@...il.com)
Webline CMS (2016Q2) - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Mybb Cms (create forum and edit) Cross-Site Script Vulnerability (iedb.team@...il.com)
Cisco Security Advisory:Cisco Unified Computing System Central Software Arbitrary Command Execution Vulnerability (Cisco Systems Product Security Incident Resp…)

April 14 (4 messages)

[SECURITY] [DSA 3548-1] samba security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3548-2] samba regression update (Salvatore Bonaccorso <carnil@...ian.org>)
Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Mybb Cms (private.php Page) Denial Of Service Vulnerability (iedb.team@...il.com)

April 15 (11 messages)

Securing Android Applications from Screen Capture (research@...htwatchcybersecurity.com)
ESA-2016-036: EMC Unisphere for VMAX Virtual Appliance Arbitrary File Upload Vulnerability (Security Alert <Security_Alert@....com>)
NEW VMSA-2016-0004 VMware product updates address a critical security issue in the VMware Client Integration Plugin (VMware Security Response Center <security@…)
AST-2016-004: Long Contact URIs in REGISTER requests can crash Asterisk ("Asterisk Security Team" <security@...erisk.org>)
AST-2016-005: TCP denial of service in PJProject ("Asterisk Security Team" <security@...erisk.org>)
[SECURITY] [DSA 3549-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[ERPSCAN-16-001] SAP NetWeaver 7.4 - XSS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-16-002] SAP HANA - log injection and no size restriction (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-16-003] SAP NetWeaver 7.4 - cryptographic issues (ERPScan inc <erpscan.online@...il.com>)
Microsoft Internet Explorer 11 MSHTML.DLL Remote Binary Planting Vulnerability (Sandro Poppi <spoppi.sec@...il.com>)
[SECURITY] [DSA 3550-1] openssh security update (Moritz Muehlenhoff <jmm@...ian.org>)

April 18 (9 messages)

[slackware-security] mozilla-thunderbird (SSA:2016-106-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] samba (SSA:2016-106-02) (Slackware Security Team <security@...ckware.com>)
[CVE-2016-3996]KNOX clipboard data disclosure KNOX 1.0 - KNOX 2.3 / Android (urikanonov@...il.com)
Ahrare Andeysheh Cms Multiple Vulnerabilities (iesb.team@...il.com)
[SECURITY] [DSA 3551-1] fuseiso security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 3552-1] tomcat7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2016-4021: pgpdump 0.29 - Endless loop parsing specially crafted input (SYSS-2016-030) (klaus.eisentraut@...s.de)
[security bulletin] HPSBGN03555 rev.1 - HPE Vertica Analytics, Management Console, Remote Disclosure of Sensitive information, Execution … (security-alert@....com)
[security bulletin] HPSBST03576 rev.2 - HP P9000, XP7 Command View Advanced Edition (CVAE) Suite including Device Manager and Tiered Stor… (security-alert@....com)

April 19 (6 messages)

Executable installers are vulnerable^WEVIL (case 33): GData's installers allow escalation of privilege ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[ERPSCAN-16-005] SAP HANA hdbxsengine JSON – DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-16-004] SAP NetWeaver 7.4 (Pmitest servlet) – XSS vulnerability (ERPScan inc <erpscan.online@...il.com>)
Multiple Reflected XSS vulnerabilities in Oliver (formerly Webshare) v1.3.1 ("research@...lab.org" <research@...lab.org>)
ESA-2016-039: EMC ViPR SRM Multiple Cross-Site Request Forgery Vulnerabilities (Security Alert <Security_Alert@....com>)
[security bulletin] HPSBMU03575 rev.1 - HP Smart Update Manager (SUM), Remote Denial of Service (DoS), Disclosure of Information (security-alert@....com)

April 20 (9 messages)

PHPBack v1.3.0 SQL Injection (apparitionsec@...il.com)
*.Shell.com Port 443 DROWN decryption attack (shell@...ll.com)
shell.com vulnerable TLS (shell@...ll.com)
RCE via CSRF in phpMyFAQ (High-Tech Bridge Security Research <advisory@...ridge.ch>)
Cisco Security Advisory: Cisco Wireless LAN Controller Management Interface Denial of Service Vulnerability (Cisco Systems Product Security Incident Response T…)
Cisco Security Advisory: Cisco Wireless LAN Controller Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Wireless LAN Controller HTTP Parsing Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psi…)
Cisco Security Advisory: Cisco Adaptive Security Appliance Software DHCPv6 Relay Denial of Service Vulnerability (Cisco Systems Product Security Incident Respon…)
Cisco Security Advisory: Multiple Cisco Products libSRTP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)

April 21 (4 messages)

Webutler CMS 3.2 - Cross-Site Request Forgery (displaymyname@...il.com)
OpenTSDB RCE (gsoc@...c.se)
exploit CVE-2016-2203 (karim reda Fakhir <karim.fakhir@...il.com>)
CVE-2016-3074: libgd: signedness vulnerability (Hans Jerry Illikainen <hji@...topia.com>)

April 22 (6 messages)

[SECURITY] [DSA 3554-1] xen security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3553-1] varnish security update (Sebastien Delafond <seb@...ian.org>)
SEC Consult SA-20160422-0 :: Insecure credential storage in my devolo Android app (SEC Consult Vulnerability Lab <research@...-consult.com>)
SEC Consult SA-20160422-1 :: Multiple vulnerabilities in Digitalstrom Konfigurator (SEC Consult Vulnerability Lab <research@...-consult.com>)
[security bulletin] HPSBGN03580 rev.1 - HP Data Protector, Remote Code Execution, Remote Unauthorized Disclosure of Information (security-alert@....com)
[security bulletin] HPSBMU03573 rev.1 - HPE System Management Homepage (SMH), Remote Disclosure of Information (security-alert@....com)

April 24 (10 messages)

Remote Code Execution in Shopware <5.1.5 (CVE-2016-3109) (david.vieira-kurz@...obilienscout24.de)
Persian-woocommerce-sms XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Tweet-wheel XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Echosign Plugin for WordPress XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Google SEO Pressor Snippet Plugin XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Easy Social Share Buttons for WordPress XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
CM-AD-Changer XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Unlimited Pop-Ups WordPress Plugin XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
[SECURITY] [DSA 3555-1] imlib2 security update (Alessandro Ghedini <ghedo@...ian.org>)
[SECURITY] [DSA 3556-1] libgd2 security update (Salvatore Bonaccorso <carnil@...ian.org>)

April 25 (8 messages)

Telisca IPS Lock 2 Vulnerability (karim reda Fakhir <karim.fakhir@...il.com>)
C & C++ for OS - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Totemomail v4.x & v5.x - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
UBNT Bug Bounty #2 - XML External Entity Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Cyberoam Central Console v02.03.1 - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Negin Group CMS - (v) Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[security bulletin] HPSBGN03582 rev.1 - HPE Helion CloudSystem using glibc, Remote Code Execution, Denial of Service (DoS) (security-alert@....com)

April 26 (4 messages)

Trend Micro (Account) - Email Spoofing Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
VoipNow v4.0.1 - (xajax_handler) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Sophos XG Firewall (SF01V) - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3557-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)

April 27 (5 messages)

[SECURITY] [DSA 3558-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] mozilla-firefox (SSA:2016-117-01) (Slackware Security Team <security@...ckware.com>)
Oracle Discoverer Viewer BI - Open Redirect Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
EMC M&R (Watch4net) lacks Cross-Site Request Forgery protection ("Securify B.V." <lists@...urify.nl>)
[SECURITY] [DSA 3559-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)

April 28 (6 messages)

CVE-2015-5208 - Arbitrary plugin execution issue in Apache Cordova iOS (Tony Homer <tony--@...che.org>)
CVE-2015-5207 - Bypass of Access Restrictions in Apache Cordova iOS (Tony Homer <ajh158@...il.com>)
Re: [ERPSCAN-16-005] SAP HANA hdbxsengine JSON – DoS vulnerability (Mahmut Firuz Dumlupinar - Vendor <firuz.dumlupinar@...u.com>)
CVE-2015-5207 - Bypass of Access Restrictions in Apache Cordova iOS (Tony Homer <tony--@...che.org>)
[SECURITY] [DSA 3560-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2016-3078: php: integer overflow in ZipArchive::getFrom* (Hans Jerry Illikainen <hji@...topia.com>)

April 29 (5 messages)

[security bulletin] HPSBUX03583 SSRT110084 rev.1 - HP-UX BIND Service running Named, Remote Denial of Service (DoS) (security-alert@....com)
Mozilla doesn't care for upstream security fixes, and doesn't bother to send own security fixes upstream ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Wordpress Truemag Theme - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
SQL Injection in GLPI (High-Tech Bridge Security Research <advisory@...ridge.ch>)
[SECURITY] [DSA 3561-1] subversion security update (Salvatore Bonaccorso <carnil@...ian.org>)

165 messages

Powered by blists - more mailing lists