bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2016/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 8	² 4	³ 5	⁴	⁵
⁶ 8	⁷ 13	⁸ 4	⁹ 6	¹⁰ 4	¹¹	¹²
¹³ 4	¹⁴ 4	¹⁵ 10	¹⁶ 3	¹⁷ 8	¹⁸	¹⁹
²⁰ 3	²¹ 5	²² 5	²³	²⁴ 6	²⁵	²⁶
²⁷ 5	²⁸ 10	²⁹ 7	³⁰ 3

Messages by day:

June 1 (8 messages)

[SECURITY] [DSA 3590-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
AjaxExplorer v1.10.3.2 Remote CMD Execution / CSRF / Persistent XSS (hyp3rlinx@...os.com)
[SECURITY] [DSA 3591-1] imagemagick security update (Luciano Bello <luciano@...ian.org>)
[security bulletin] HPSBGN03609 rev.1 - HPE LoadRunner and Performance Center, Remote Code Execution, Denial of Service (DoS) (security-alert@....com)
Cisco Security Advisory: Cisco Prime Network Analysis Module Unauthenticated Remote Code Execution Vulnerability (Cisco Systems Product Security Incident Respo…)
Cisco Security Advisory: Cisco Prime Network Analysis Module IPv6 Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@…)
[SECURITY] [DSA 3592-1] nginx security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBOV03615 rev.1 - HPE OpenVMS CSWS running the Apache Tomcat 7 Servlet Engine, Multiple Remote Vulnerabilities (security-alert@....com)

June 2 (4 messages)

[security bulletin] HPSBMU03612 rev.1 - HPE Insight Control on Windows and Linux, Multiple Remote Vulnerabilities (security-alert@....com)
XML External Entity XXE vulnerability in OpenID component of Liferay (Sandro Gauci <sandro@...blesecurity.com>)
SEC Consult SA-20160602-0 :: Multiple critical vulnerabilities in Ubee EVW3226 Advanced wireless voice gateway (SEC Consult Vulnerability Lab <research@...-con…)
[security bulletin] HPSBMU03607 rev.1 - HPE BladeSystem c-Class Virtual Connect (VC) Firmware, Remote Denial of Service (DoS), Disclosure… (security-alert@....com)

June 3 (5 messages)

Zoho OpManager < v12 (d_fens@...brick.dcu.ie)
ESA-2016-060: EMC Isilon OneFS Privilege Escalation Vulnerability (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 3593-1] libxml2 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Notilus v2012 R3 - SQL injection (alex_haynes@...look.com)
[Announce] CVE-2016-4437: Apache Shiro information disclosure vulnerability (Brian Demers <bdemers@...che.org>)

June 6 (8 messages)

[security bulletin] HPSBUX03616 SSRT110128 rev.2 - HPE HP-UX running CIFS Server (Samba), Remote Denial of Service (DoS), Disclosure of I… (security-alert@....com)
[security bulletin] - Linux Kernel Flaw, ASN.1 DER decoder for x509 certificate DER (HP Security Alert <hp-security-alert@...com>)
[slackware-security] ntp (SSA:2016-155-01) (Slackware Security Team <security@...ckware.com>)
FreeBSD Security Advisory FreeBSD-SA-16:24.ntp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 3594-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 3548-3] samba regression update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3595-1] mariadb-10.0 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3596-1] spice security update (Salvatore Bonaccorso <carnil@...ian.org>)

June 7 (13 messages)

Re: rConfig, the open source network device configuration management tool, Vulnerable to Local File Inclusion (Gregory Pickett <gpickett71@...oo.com>)
[security bulletin] HPSBGN03442 rev.2 - HP Helion OpenStack using glibc, Remote Denial of Service (DoS), Arbitrary Code Execution (security-alert@....com)
[security bulletin] HPSBGN03619 rev.1 - HPE Discovery and Dependency Mapping Inventory (DDMi) using Java Deserialization, remote Code Exe… (security-alert@....com)
[security bulletin] HPSBGN03620 rev.1 - HPE Helion OpenStack using OpenSSL and QEMU, Remote Unauthorized Data Access (security-alert@....com)
Mapbox (API) - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Wordpress Levo-Slideshow 2.3 - Arbitrary File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Microsoft Education - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3597-1] expat security update (Luciano Bello <luciano@...ian.org>)
[CVE-2016-0392] IBM GPFS / Spectrum Scale Command Injection (john.fitzpatrick@...infosecurity.com)
[security bulletin] HPSBGN03621 rev.1 - HPE Universal CMDB using OpenSSL, Remote Disclosure of Sensitive Information (security-alert@....com)
[security bulletin] HPSBGN03622 rev.1 - HPE UCMDB, Universal Discovery, and UCMDB Configuration Manager using Apache Commons Collection, … (security-alert@....com)
[security bulletin] HPSBGN03623 rev.1 - HPE Universal CMDB, Remote Disclosure of Sensitive Information (security-alert@....com)

June 8 (4 messages)

[SECURITY] [DSA 3598-1] vlc security update (Moritz Muehlenhoff <jmm@...ian.org>)
Cisco EPC 3928 Multiple Vulnerabilities (patryk.bogdan@...orda.com)
[security bulletin] HPSBGN03624 rev.1 - HPE Project and Portfolio Management Center, Remote Disclosure of Sensitive Information, Executio… (security-alert@....com)
[security bulletin] HPSBGN03618 rev.1 - HPE Service Manager remote Denial of Service (DoS), Disclosure of Information, Unauthorized Read … (security-alert@....com)

June 9 (6 messages)

[security bulletin] HPSBMU03584 rev.2 - HPE Network Node Manager I (NNMi), Multiple Remote Vulnerabilities (security-alert@....com)
[security bulletin] HPSBMU03614 rev.1 - HPE Systems Insight Manager using Samba, Multiple Remote Vulnerabilities (security-alert@....com)
ESA-2016-072: EMC NetWorker Remote Code Execution Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2016-064: EMC Data Domain Information Disclosure Vulnerability (Security Alert <Security_Alert@....com>)
CVE-2016-3085: Apache CloudStack Authentication Bypass Vulnerability (John Kinsella <jlk@...che.org>)
[SECURITY] [DSA 3599-1] p7zip security update (Salvatore Bonaccorso <carnil@...ian.org>)

June 10 (4 messages)

SimpleSAMLphp Link Injection (hyp3rlinx@...os.com)
[SECURITY] [DSA 3600-1] iceweasel/firefox-esr security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBGN03617 rev.2 - HPE IceWall Federation Agent and IceWall File Manager using libXML2 library, Remote Denial of Ser… (security-alert@....com)
ESA-2016-062: EMC Data Domain Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)

June 13 (4 messages)

OpenWRT: swconfig infrastructure fails to check permissions (Elliott Mitchell <ehem+bugtraq@....com>)
FlashFXP v5.3.0 (Windows) - Memory Corruption Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
CM Ad Changer 1.7.7 Wordpress Plugin - Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
ESA-2016-047: RSA Archer® GRC Platform Sensitive Information Disclosure Vulnerability (Security Alert <Security_Alert@....com>)

June 14 (4 messages)

Oracle Orakill.exe Buffer Overflow (hyp3rlinx@...os.com)
[SECURITY] [DSA 3601-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3602-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

June 15 (10 messages)

[SECURITY] [DSA 3603-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[CVE-2014-1520] NOT FIXED: privilege escalation via Mozilla's executable installers ("Stefan Kanthak" <stefan.kanthak@...go.de>)
NEW VMSA-2016-0009 VMware vCenter Server updates address an important reflective cross-site scripting issue (VMware Security Response Center <security@...are.c…)
Joomla com_enmasse - SQL Injection (hamedizadi@...il.com)
FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
BookingWizz < 5.5 Multiple Vulnerability (mehmet@...metince.net)
Cisco Security Advisory: Cisco RV110W, RV130W, and RV215W Routers Arbitrary Code Execution Vulnerability (Cisco Systems Product Security Incident Response Team …)
Microsoft Visio multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)
[MWR-2016-0001] DDN Insecure Update Mechanism (john.fitzpatrick@...infosecurity.com)
[MWR-2016-0002] DDN Default SSH Keys (john.fitzpatrick@...infosecurity.com)

June 16 (3 messages)

Authentication bypass in Ceragon FibeAir IP-10 web interface (<7.2.0) (iancling@...il.com)
[security bulletin] HPSBGN03553 rev.1 - HP OneView Products using glibc and OpenSSL, Multiple Remote Vulnerabilties (security-alert@....com)
[security bulletin] HPSBNS03625 rev.1 - HPE NonStop Application Server for Java (NSASJ) running SSL/TLS, Remote Disclosure of Information (security-alert@....com)

June 17 (8 messages)

[SECURITY] [DSA 3604-1] drupal7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
User enumeration in Skype for Business 2013 (nyxgeek <nyxgeek@...abs.co>)
[FD] Multiple vulnerabilities in squid 0.4.16_2 running on pfSense (Remco Sprooten <remco@...ooten.org>)
[CVE-2016-1014] Escalation of privilege via executable (un)installers of Flash Player ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[ERPSCAN-16-014] SAP NetWeaver AS Java NavigationURLTester - XSS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-16-013] SAP NetWeaver AS Java ctcprotocol servlet - XXE vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-16-012] SAP NetWeaver AS JAVA - directory traversal vulnerability (ERPScan inc <erpscan.online@...il.com>)
CVE-2016-0199 / MS16-063: MSIE 11 garbage collector attribute type confusion (Berend-Jan Wever <berendjanwever@...il.com>)

June 20 (3 messages)

sNews CMS v1.7.1 Remote Command Execution / CSRF / XSS (hyp3rlinx@...os.com)
[SECURITY] [DSA 3605-1] libxslt security update (Salvatore Bonaccorso <carnil@...ian.org>)
Symphony CMS v2.6.7 Session Fixation (hyp3rlinx@...os.com)

June 21 (5 messages)

APPLE-SA-2016-06-20-1 AirPort Base Station Firmware Update 7.6.7 and 7.7.7 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[slackware-security] libarchive (SSA:2016-172-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] pcre (SSA:2016-172-02) (Slackware Security Team <security@...ckware.com>)
[ERPSCAN-16-016] SAP NetWeaver Java AS WD_CHAT - Information disclosure vulnerability (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-16-015] SAP NetWeaver Java AS - multiple XSS vulnerabilities (ERPScan inc <erpscan.online@...il.com>)

June 22 (5 messages)

[ERPSCAN-16-017] SAP JAVA AS icman - DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
Magic values in 32-bit processes on 64-bit OS-es and how to exploit them (Berend-Jan Wever <berendjanwever@...il.com>)
[ERPSCAN-16-018] SAP Application server for Javat - DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
Open-Xchange Security Advisory 2016-06-22 (Martin Heiland <martin.heiland@...n-xchange.com>)
ESA-2016-069: EMC Documentum WebTop and WebTop Clients Improper Authorization Vulnerability (Security Alert <Security_Alert@....com>)

June 24 (6 messages)

[KIS-2016-07] SugarCRM <= 6.5.23 (SugarRestSerialize.php) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[KIS-2016-04] SugarCRM <= 6.5.18 Missing Authorization Check Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[KIS-2016-05] SugarCRM <= 6.5.18 Two PHP Code Injection Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[KIS-2016-06] SugarCRM <= 6.5.18 (MySugar::addDashlet) Insecure fopen() Usage Vulnerability (Egidio Romano <research@...mainsecurity.com>)
SEC Consult SA-20160624-0 :: ASUS DSL-N55U router XSS and information disclosure (SEC Consult Vulnerability Lab <research@...-consult.com>)
#146416 Ruby:HTTP Header injection in 'net/http' (redrain root <rootredrain@...il.com>)

June 27 (5 messages)

[SECURITY] [DSA 3606-1] libpdfbox security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] php (SSA:2016-176-01) (Slackware Security Team <security@...ckware.com>)
MyLittleForum v2.3.5 PHP Command Injection (hyp3rlinx@...os.com)
[fd] CVE ID request: Untangle NGFW <= v12.1.0 post-auth command injection (Matt Bush <matt@...cyte.net>)
BigTree CMS <= 4.2.11 Authenticated SQL Injection Vulnerability (mehmet@...metince.net)

June 28 (10 messages)

Craft CMS affected by server side template injection ("Securify B.V." <lists@...urify.nl>)
[SECURITY] [DSA 3607-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
Ladesk Agent #1 (Bug Bounty) - Session Reset Password Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Mutualaid CMS v4.3.1 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Alfine CMS v2.6 - (Login) Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Iranian Weblog Services v3.3 CMS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[KIS-2016-08] Concrete5 <= 5.7.3.1 Multiple Cross-Site Request Forgeries Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[KIS-2016-09] Concrete5 <= 5.7.3.1 Multiple Stored Cross-Site Scripting Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[KIS-2016-10] Concrete5 <= 5.7.3.1 (Application::dispatch) Local File Inclusion Vulnerability (Egidio Romano <research@...mainsecurity.com>)
KL-001-2016-002 : Ubiquiti Administration Portal CSRF to Remote Command Execution (KoreLogic Disclosures <disclosures@...elogic.com>)

June 29 (7 messages)

Symantec SEPM v12.1 Multiple Vulnerabilities (hyp3rlinx@...os.com)
CVE-2016-4463: Apache Xerces-C XML Parser Crashes on Malformed DTD ("Cantor, Scott" <cantor.2@....edu>)
Cisco Security Advisory: Cisco Firepower System Software Static Credential Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Cisco Security Advisory: Cisco Prime Collaboration Provisioning Lightweight Directory Access Protocol Authentication Byp… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco Prime Infrastructure and Evolved Programmable Network Manager Authentication Bypass API V… (Cisco Systems Product Security Incident…)
[SECURITY] [DSA 3609-1] tomcat8 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3608-1] libreoffice security update (Moritz Muehlenhoff <jmm@...ian.org>)

June 30 (3 messages)

BFS-SA-2016-003: Huawei HiSuite Insecure Service Directory ACLs (Blue Frost Security Research Lab <research@...efrostsecurity.de>)
[SECURITY] [DSA 3610-1] xerces-c security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3611-1] libcommons-fileupload-java security update (Salvatore Bonaccorso <carnil@...ian.org>)

125 messages