bugtraq mailing list - 2016/08

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2016/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 17	² 9	³ 10	⁴ 15	⁵ 11	⁶	⁷
⁸ 10	⁹ 12	¹⁰ 1	¹¹ 6	¹² 4	¹³	¹⁴
¹⁵ 14	¹⁶ 18	¹⁷ 4	¹⁸ 17	¹⁹ 2	²⁰	²¹
²² 2	²³	²⁴ 2	²⁵ 3	²⁶ 4	²⁷	²⁸
²⁹	³⁰ 2	³¹ 5

Messages by day:

August 1 (17 messages)

Elevation of Privilege Vulnerability in MediaTek Driver ( CVE-2016-6492) (unlimitsec@...il.com)
[SECURITY] [DSA 3636-1] collectd security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3634-1] redis security update (Sebastien Delafond <seb@...ian.org>)
Huawei eSpace IAD Remote Information Disclosure Vulnerability (ak47464659484@...il.com)
Insert PHP WordPress Plugin allows authenticated user to execute arbitrary PHP (Summer of Pwnage <lists@...urify.nl>)
Stored Cross-Site Scripting vulnerability in Easy Testimonials WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Multiple vulnerabilities in All In One WP Security & Firewall plugin login CAPTCHA (Summer of Pwnage <lists@...urify.nl>)
[SECURITY] [DSA 3637-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
Cross-Site Scripting vulnerability in Booking Calendar WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
SQL injection vulnerability in Booking Calendar WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in Contact Bank WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Kaspersky Safe Browser iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6231) (David Coomber <davidcoomber.infosec@...il.com>)
Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[CVE-2016-6480] Double-Fetch Vulnerability in Linux-4.5/drivers/scsi/aacraid/commctrl.c (wpengfeinudt@...il.com)
[security bulletin] HPSBUX03632 SSRT110194 rev.1 - HP-UX Mail Server running Sendmail, Local Unauthorized Disclosure of Information (security-alert@....com)

August 2 (9 messages)

[security bulletin] HPSBGN03564 rev.2 - HPE Release Control using Java Deserialization, Remote Code Execution (security-alert@....com)
FortiManager (Series) - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Guppy CMS v5.01.03 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Zoll ePCR v2.6.4 iOS - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Docebo LMS 6.9 - (Moxie) API Calls RST Remote Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
WinSaber - Unquoted Service Path Privilege Escalation (Vulnerability Lab <research@...nerability-lab.com>)
Cross-Site Scripting in Uji Countdown WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in WangGuard WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

August 3 (10 messages)

Arbitrary File Content Disclosure in Atutor (High-Tech Bridge Security Research <advisory@...ridge.ch>)
WorldCIST'17 - Call for Workshops Proposals; Deadline: September 5 ("Maria Lemos" <marialemos72@...il.com>)
[SECURITY] [DSA 3638-1] curl security update (Alessandro Ghedini <ghedo@...ian.org>)
[SECURITY] [DSA 3639-1] wordpress security update (Salvatore Bonaccorso <carnil@...ian.org>)
Cisco Security Advisory: Cisco Unified Communications Manager IM and Presence Service SIP Packet Processing Denial of Se… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@…)
Cisco Security Advisory: Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Unauthorized Access Vulnerabili… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Remote Code Execution Vulnerabi… (Cisco Systems Product Security Incident…)
[security bulletin] HPSBGN03633 rev.1 - HPE Release Control, Remote Denial of Service (DoS), Disclosure of Information, Unauthorized Acce… (security-alert@....com)
Secunia Research: LibGD "_gdContributionsAlloc()" Integer Overflow Denial of Service Vulnerability (Secunia Research <remove-vuln@...unia.com>)

August 4 (15 messages)

[SECURITY] [DSA 3640-1] firefox-esr security update (Moritz Muehlenhoff <jmm@...ian.org>)
Cross-Site Scripting vulnerability in search function Activity Log WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in Activity Log WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in WordPress Landing Pages Plugin (Summer of Pwnage <lists@...urify.nl>)
FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FortiManager (Series) - (Bookmark) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SYSS-2016-065] NASdeluxe NDL-2400r: OS Command Injection (klaus.eisentraut@...s.de)
[SECURITY] [DSA 3641-1] openjdk-7 security update (Moritz Muehlenhoff <jmm@...ian.org>)
Cisco Security Advisory: Cisco IOS Software Crafted Network Time Protocol Packets Denial of Service Vulnerability (Cisco Systems Product Security Incident Resp…)
Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance (Pedro Ribeiro <pedrib@...il.com>)
Re: Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance (Pedro Ribeiro <pedrib@...il.com>)
Cross-Site Scripting vulnerability in Events Made Easy WordPress plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in FormBuilder WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in Count per Day WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Stored Cross-Site Scripting vulnerability in Count per Day WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

August 5 (11 messages)

[0day] net2ftp multiple XSS on unauthenticated users (Jacobo Avariento <jacobo@...istic.com>)
Typesettercms v5.0.1 - (Delete Files) CSRF Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Subrion v4.0.5 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FortiCloud - (Reports Summary) Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Sophos Mobile Control EAS Proxy Open Reverse Proxy vulnerability (CVE-2016-6597) (Tim Kretschmann <tim.kretschmann@...las.com>)
Sophos Mobile Control EAS Proxy Open Reverse Proxy vulnerability (CVE-2016-6597) (Tim Kretschmann <tim.kretschmann@...las.com>)
[SYSS-2016-063] VMware ESXi 6 - Improper Input Validation (CWE-20) (matthias.deeg@...s.de)
[SYSS-2016-063] VMware ESXi 6 - Improper Input Validation (CWE-20) (matthias.deeg@...s.de)
[SYSS-2016-063] VMware ESXi 6 - Improper Input Validation (CWE-20) (matthias.deeg@...s.de)
DLL side loading vulnerability in VMware Host Guest Client Redirector ("Securify B.V." <lists@...urify.nl>)
Ecwid Ecommerce Shopping Cart WordPress Plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)

August 8 (10 messages)

[SECURITY] [DSA 3642-1] lighttpd security update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3643-1] kde4libs security update (Salvatore Bonaccorso <carnil@...ian.org>)
[slackware-security] mozilla-firefox (SSA:2016-219-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] stunnel (SSA:2016-219-04) (Slackware Security Team <security@...ckware.com>)
[slackware-security] curl (SSA:2016-219-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] openssh (SSA:2016-219-03) (Slackware Security Team <security@...ckware.com>)
vBulletin <= 5.2.2 Preauth Server Side Request Forgery (SSRF) (Dawid Golunski <dawid@...alhackers.com>)
phpCollab v2.5 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3644-1] fontconfig security update (Salvatore Bonaccorso <carnil@...ian.org>)
ESA-2016-070: RSA® Authentication Manager Prime SelfService Insecure Direct Object Reference Vulnerability (Security Alert <Security_Alert@....com>)

August 9 (12 messages)

[CVE-2016-6600/1/2/3]: Multiple vulnerabilities (RCE, file download, etc) in WebNMS Framework 5.2 / 5.2 SP1 (Pedro Ribeiro <pedrib@...il.com>)
[SECURITY] [DSA 3645-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
Nagios Network Analyzer v2.2.1 Multiple CSRF (hyp3rlinx@...os.com)
Any Video Converter DLL Hijack (hyp3rlinx@...os.com)
AirSnort v0.2.7 Stack Corruption DOS (hyp3rlinx@...os.com)
Facebook Bug Bounty #33 - Bypass ID user to linked Phone Number Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
FortiVoice v5.0 - Filter Bypass & Persistent Validation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Nuke Evolution 2.0.9d - Multiple Client Side Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Notepad++6.9.2 DLL Hijacking Vulnerability (mehta.himanshu21@...il.com)
Nagios NA v2.2.1 XSS (hyp3rlinx@...os.com)
Internet Explorer iframe sandbox local file name disclosure vulnerability ("Securify B.V." <lists@...urify.nl>)

August 10 (1 message)

Cisco Security Advisory: Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers Fragmented Packet Denial … (Cisco Systems Product Security Incident…)

August 11 (6 messages)

[CORE-2016-0006] - SAP CAR Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
Microsoft Education - Stored Cross Site Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Directory Traversal Vulnerability in ColoradoFTP v1.3 Prime Edition (Build 8) ("Rv3Lab.org" <research@...lab.org>)
[SECURITY] [DSA 3646-1] postgresql-9.4 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Defense in depth -- the Microsoft way (part 42): Sysinternals utilities load and execute rogue DLLs from %TEMP% ("Stefan Kanthak" <stefan.kanthak@...go.de>)

August 12 (4 messages)

[SECURITY] [DSA 3647-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
[CVE-2016-3089] Apache OpenMeetings XSS in SWF panel (Maxim Solodovnik <solomax666@...il.com>)
[security bulletin] HPSBHF03440 rev.1 - HPE iLO 3 using JQuery, Remote Cross-Site Scripting (XSS) (security-alert@....com)
[security bulletin] HPSBGN03630 rev.2 - HP Operations Manager for Unix, Solaris, and Linux using Apache Commons Collections (ACC), Remote… (security-alert@....com)

August 15 (14 messages)

[SECURITY] [DSA 3648-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
WSO2 IDENTITY-SERVER v5.1.0 XML External-Entity (hyp3rlinx@...os.com)
WSO2-CARBON v4.4.5 LOCAL FILE INCLUSION (apparitionsec@...il.com)
WSO2 CARBON v4.4.5 PERSISTENT XSS COOKIE THEFT (hyp3rlinx@...os.com)
WSO2-CARBON v4.4.5 CSRF / DOS (hyp3rlinx@...os.com)
OpenCart 2.0.3.1 Cross Site Scripting Vulnerability (product_id - GET) (hamedizadi@...il.com)
OpenCart 2.0.3.1 Cross Site Scripting Vulnerability (product_id - GET) (hamedizadi@...il.com)
OpenCart 2.0.3.1 Cross Site Scripting Vulnerability (product_id - GET) (hamedizadi@...il.com)
Linksys E1200 and E2500 (Missing authorization on parental control) (samhuntley84@...il.com)
Linksys E2500 and E1200 (Unauth Command Injection) (samhuntley84@...il.com)
Reflected Cross Site Scripting (XSS) Vulnerability in nopcommerce 3.70 (tal argoni <talargoni@...il.com>)
Stash v1.0.3 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
PayPal Inc BB #127 - 2FA Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Taser Axon Dock (Body-Worn Camera Docking Station) v3.1 - Authentication Bypass (reggie.dodd30@...il.com)

August 16 (18 messages)

Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of galleries (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows adding of images (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of images (Summer of Pwnage <lists@...urify.nl>)
Stored Cross-Site Scripting vulnerability in Photo Gallery WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting vulnerability in Google Maps WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery vulnerability in Email Users WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Ajax Load More Local File Inclusion vulnerability (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in Link Library WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Persistent Cross-Site Scripting in Magic Fields 2 WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Persistent Cross-Site Scripting in Magic Fields 1 WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[security bulletin] HPSBST03629 rev.1 - HP StoreFabric B-series Switches, Remote Disclosure of Privileged Information (security-alert@....com)
[security bulletin] HPSBGN03634 rev.1 - HPE Enterprise Solution Sizers and Storage Sizer running Smart Update, Remote Arbitrary Code Exec… (security-alert@....com)
[security bulletin] HPSBHF03441 rev.1 - HPE ilO 3 and iLO 4 and iLO 4 mRCA, Remote Multiple Vulnerabilities (security-alert@....com)
Lepton CMS Archive Directory Traversal (hyp3rlinx@...os.com)
Lepton CMS PHP Code Injection (hyp3rlinx@...os.com)
[ERPSCAN-16-022] SAP Hybris E-commerce Suite VirtualJDBC – Default Credentials (ERPScan inc <erpscan.online@...il.com>)
[ERPSCAN-16-023] Potential backdoor via hardcoded system ID (ERPScan inc <erpscan.online@...il.com>)

August 17 (4 messages)

[SYSS-2016-067] NetIQ Access Manager (iManager) - Temporary Second Order Cross-Site Scripting (CWE-79) (Micha Borrmann <micha.borrmann@...s.de>)
Cisco Security Advisory: Cisco Firepower Management Center Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@cis…)
Cisco Security Advisory:Cisco Application Policy Infrastructure Controller Enterprise Module Remote Code Execution Vulne… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco Firepower Management Center Remote Command Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt…)

August 18 (17 messages)

Cisco Security Advisory: Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psir…)
[SECURITY] [DSA 3649-1] gnupg security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 3650-1] libgcrypt20 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Telus Actiontec T2200H Modem Input Validation Flaw Allows Elevated Shell Access (Andrew Klaus <andrewklaus@...il.com>)
[SYSS-2016-052] QNAP QTS - OS Command Injection (bugtraq@...z.syss.de)
[SYSS-2016-053] QNAP QTS - Arbitrary File Overwrite (bugtraq@...z.syss.de)
[SYSS-2016-048] QNAP QTS - OS Command Injection (bugtraq@...z.syss.de)
[SYSS-2016-050] QNAP QTS - Persistent Cross-Site Scripting (bugtraq@...z.syss.de)
[SYSS-2016-048] QNAP QTS - OS Command Injection (bugtraq@...z.syss.de)
[SYSS-2016-054] QNAP QTS - OS Command Injection (bugtraq@...z.syss.de)
[SYSS-2016-051] QNAP QTS - Reflected Cross-Site Scripting (bugtraq@...z.syss.de)
[SYSS-2016-048] QNAP QTS - OS Command Injection (bugtraq@...z.syss.de)
[SYSS-2016-055] QNAP QTS - OS Command Injection (bugtraq@...z.syss.de)
[SYSS-2016-050] QNAP QTS - Persistent Cross-Site Scripting (bugtraq@...z.syss.de)
[SYSS-2016-049] QNAP QTS - Persistent Cross-Site Scripting (bugtraq@...z.syss.de)
[SYSS-2016-054] QNAP QTS - OS Command Injection (bugtraq@...z.syss.de)
[SYSS-2016-049] QNAP QTS - Persistent Cross-Site Scripting (bugtraq@...z.syss.de)

August 19 (2 messages)

[CVE-2016-6582] Doorkeeper gem does not revoke tokens & uses wrong auth/auth method (Justin Bull <me@...tinbull.ca>)
Horizontal Privilege Escalation/Code Injection in ownCloud’s Windows Client (Florian Bogner <florian@...ner.sh>)

August 22 (2 messages)

Path traversal vulnerability in WordPress Core Ajax handlers (Summer of Pwnage <lists@...urify.nl>)
[security bulletin] HPSBNS03635 rev.1 - HPE NonStop Servers OSS Script Languages running Perl and PHP, Multiple Local and Remote Vulnerab… (security-alert@....com)

August 24 (2 messages)

[slackware-security] gnupg (SSA:2016-236-01) (Slackware Security Team <security@...ckware.com>)
nullcon 8-bit Call for Papers is open (nullcon <nullcon@...lcon.net>)

August 25 (3 messages)

WebKitGTK+ Security Advisory WSA-2016-0005 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
SEC Consult SA-20160825-0 :: Multiple vulnerabilities in Micro Focus (Novell) GroupWise (SEC Consult Vulnerability Lab <research@...-consult.com>)
APPLE-SA-2016-08-25-1 iOS 9.3.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)

August 26 (4 messages)

[SECURITY] [DSA 3652-1] imagemagick security update (Moritz Muehlenhoff <jmm@...ian.org>)
Necroscan <= v0.9.1 Buffer Overflow (hyp3rlinx@...os.com)
[SECURITY] [DSA 3654-1] quagga security update (Sebastien Delafond <seb@...ian.org>)
Apple libc incomplete fix of Security Update for OS X El Capitan 10.11.2 (submit@...ec.org)

August 30 (2 messages)

[security bulletin] HPSBGN03638 rev.1 - HPE Remote Device Access: Virtual Customer Access System (vCAS) using lighttpd and OpenSSH, Unaut… (security-alert@....com)
[slackware-security] kernel (SSA:2016-242-01) (Slackware Security Team <security@...ckware.com>)

August 31 (5 messages)

[security bulletin] HPSBHF03641 rev.1 - HPE Integrated Lights-Out 3 (iLO 3), Remote Disclosure of Information (security-alert@....com)
[security bulletin] HPSBGN03637 rev.1 - HP Operations Manager for Unix, Solaris, and Linux, Remote Cross-Site Scripting (XSS) (security-alert@....com)
Cisco Security Advisory: Cisco WebEx Meetings Player Arbitrary Code Execution (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Small Business 220 Series Smart Plus Switches SNMP Unauthorized Access Vulnerability (Cisco Systems Product Security Incident Res…)
Cisco Security Advisory: Cisco Small Business SPA3x/5x Series Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@cis…)

168 messages

Powered by blists - more mailing lists