bugtraq mailing list - 2017/03

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2017/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 23	² 2	³	⁴	⁵
⁶ 8	⁷ 3	⁸ 9	⁹	¹⁰ 6	¹¹	¹²
¹³ 3	¹⁴ 9	¹⁵ 3	¹⁶ 7	¹⁷	¹⁸	¹⁹
²⁰ 8	²¹ 2	²² 5	²³ 2	²⁴	²⁵	²⁶
²⁷ 2	²⁸ 3	²⁹ 6	³⁰ 2	³¹ 1

Messages by day:

March 1 (23 messages)

Multiple persistent Cross-Site Scripting vulnerabilities in osTicket ("Securify B.V." <lists@...urify.nl>)
Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)
Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field (Summer of Pwnage <lists@...urify.nl>)
Admin Custom Login WordPress plugin custom login page affected by persistent Cross-Site Scripting (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery in File Manager WordPress plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery in Global Content Blocks WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting vulnerability in Gwolle Guestbook WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Persistent Cross-Site Scripting in the WordPress NewStatPress plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery in WordPress Download Manager Plugin (Summer of Pwnage <lists@...urify.nl>)
Gwolle Guestbook mass action vulnerable for Cross-Site Request Forgery (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery in Atahualpa WordPress Theme (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Scripting in Magic Fields 1 WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Stored Cross-Site Scripting vulnerability in User Login Log WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Cross-Site Request Forgery & Cross-Site Scripting in Contact Form Manager WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[SECURITY] [DSA 3798-1] tnef security update (Sebastien Delafond <seb@...ian.org>)
Joomla com_webgrouper Component - 'Itemid' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_jdownloads Component - 'cid' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_phocadownload Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_frontpage Component - 'Itemid' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_filecabinet Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_news Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_publication Component - 'sid' Parameter Sql Injection Vulnerability (iedb.team@...il.com)

March 2 (2 messages)

[SECURITY] [DSA 3794-2] munin regression update (Salvatore Bonaccorso <carnil@...ian.org>)
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0 ("Larry W. Cashdollar" <larry0@...com>)

March 6 (8 messages)

[SECURITY] [DSA 3801-1] ruby-zip security update (Salvatore Bonaccorso <carnil@...ian.org>)
EasyCom SQL iPlug Denial Of Service (apparitionsec@...il.com (hyp3rlinx))
CVE-2017-6429: Buffer overflow vulnerability in Tcpreplay tcpcapinfo utility (ddos2me@...il.com)
OpenElec: Remote Code Execution Vulnerability through Man-In-The-Middle(CVE-2017-6445) (Wolfgang <lister@...dyourhead.at>)
CVE-2017-6430: Out-of-Bounds Read (DOS) Vulnerability in Ettercap Etterfilter utility (ddos2me@...il.com)
CVE-2016-7955 - Alienvault OSSIM/USM Authentication Bypass (Peter Lapp <lappsec@...il.com>)
Sawmill Enterprise v8.7.9 Pass The Hash Authentication Bypass (apparitionsec@...il.securityfocus.com (hyp3rlinx))
EasyCom PHP API Stack Buffer Overflow (apparitionsec@...il.securityfocus.com (hyp3rlinx))

March 7 (3 messages)

WordPress audio playlist functionality is affected by Cross-Site Scripting (Summer of Pwnage <lists@...urify.nl>)
SEC Consult SA-20170307-0 :: Unauthenticated OS command injection & arbitrary file upload in Western Digital WD My Clou… (SEC Consult Vulnerability Lab <research…)
Stack-based buffer overflow in Western Digital My Cloud allows for remote code execution ("Securify B.V." <lists@...urify.nl>)

March 8 (9 messages)

[security bulletin] HPESBHF03710 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Multiple Remote Vulnerabilities (security-alert@....com)
Multiple vulnerabilities found in Wireless IP Camera (P2P) WIFICAM cameras and vulnerabilities in GoAhead (Pierre Kim <pierre.kim.sec@...il.com>)
[slackware-security] mozilla-firefox (SSA:2017-066-01) (Slackware Security Team <security@...ckware.com>)
SEC Consult SA-20170308-0 :: Multiple vulnerabilities in Navetti PricePoint (SEC Consult Vulnerability Lab <research@...-consult.com>)
[security bulletin] HPESBGN03712 rev.1 - HPE LoadRunner and Performance Center, Remote Code Execution (security-alert@....com)
[security bulletin] HPESBHF03713 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Deserialization of Untrusted Data, Remote Code Ex… (security-alert@....com)
[SECURITY] [DSA 3804-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPESBHF03714 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Local Arbitrary File Download (security-alert@....com)
RE: CVE-2017-3241 - [ERPSCAN-17-006] Oracle OpenJDK - Java Serialization DoS ("Melissa Mayer" <melissa.mayer@...tesprospective.com>)

March 10 (6 messages)

[SECURITY] [DSA 3805-1] firefox-esr security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2016-10143: Vulnerability to read arbitrary files in "Tiki Wiki" (Leon.Zhao.7@...il.com)
[security bulletin] HPESBHF03716 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Remote Authentication Bypass (security-alert@....com)
[security bulletin] HPESBGN03707 rev.1 - HPE ConvergedSystem 700 2.0 VMware Kit, Remote Increase of Privilege (security-alert@....com)
[security bulletin] HPESBHF03711 rev.1 - HPE 2620 Series Network Switches, Remote Cross Site Request Forgery (CSRF) (security-alert@....com)
[security bulletin] HPESBUX03706 rev.1 - HP-UX NTP service running ntpd, Multiple Vulnerabilities (security-alert@....com)

March 13 (3 messages)

Joomla com_eventlist Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_kide Component - 'view' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_carocci Component - 'isbn' Parameter Sql Injection Vulnerability (iedb.team@...il.com)

March 14 (9 messages)

[SECURITY] [DSA 3808-1] imagemagick security update (Moritz Muehlenhoff <jmm@...ian.org>)
Atlassian - March 2017 - Bamboo, Crowd and HipChat Server - Critical Security Advisory (David Black <dblack@...assian.com>)
Joomla com_easyblog Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_registrationpro Component - 'did' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_fidecalendar Component - 'aid' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_sngevents Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_kunena Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Joomla com_virtuemart Component - 'id' Parameter Sql Injection Vulnerability (iedb.team@...il.com)
Microsoft Edge Fetch API allows setting of arbitrary request headers ("Securify B.V." <lists@...urify.nl>)

March 15 (3 messages)

March 16 (7 messages)

CVE-2017-0045 Windows DVD Maker XML External Entity File Disclosure (apparitionsec@...il.com (hyp3rlinx))
Path Traversal Remote File Disclosure (apparitionsec@...il.com (hyp3rlinx))
[slackware-security] pidgin (SSA:2017-074-01) (Slackware Security Team <security@...ckware.com>)
CVE-2017-6911: USB Pratirodh Insecure Password Storage Information Disclosure Vulnerability (wsachin092@...il.com)
SEC Consult SA-20170316-0 :: Authenticated command injection in multiple Ubiquiti Networks products (SEC Consult Vulnerability Lab <research@...-consult.com>)
CVE-2017-6805 MobaXterm Personal Edition v9.4 Path Traversal Remote File Disclosure (apparitionsec@...il.com (hyp3rlinx))
MS Internet Information Services XSS / HTML Injection vulnerability (David FM <david.fdmv@...il.com>)

March 20 (8 messages)

Cisco Security Advisory: Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability (psirt@...co.com)
[SECURITY] [DSA 3811-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3812-1] ioquake3 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 3813-1] r-base security update (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2017-7183 ExtraPuTTY v029_RC2 TFTP Denial Of Service (apparitionsec@...il.com (hyp3rlinx))
[security bulletin] HPSBUX03596 rev.2 - HPE HP-UX running CIFS Server (Samba), Remote Access Restriction Bypass, Unauthorized Access (security-alert@....com)
[SECURITY] [DSA 3796-2] sitesummary regression update (Sebastien Delafond <seb@...ian.org>)
ESA-2017-010: EMC RecoverPoint SSL Stripping Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)

March 21 (2 messages)

[ERPSCAN-16-041] SAP NETWEAVER DIRECTORY CREATION OUTSIDE OF THE JVM (ERPScan inc <erpscan.online@...il.com>)
Defense in depth -- the Microsoft way (part 47): "AppLocker bypasses are not serviced via monthly security roll-ups" ("Stefan Kanthak" <stefan.kanthak@...go.de>)

March 22 (5 messages)

SEC Consult SA-20170322-0 :: Multiple vulnerabilities in Solare Datensysteme Solar-Log devices (SEC Consult Vulnerability Lab <research@...-consult.com>)
Cisco Security Advisory: Cisco IOS and IOS XE Software DHCP Client Denial of Service Vulnerability (psirt@...co.com)
Cisco Security Advisory: Cisco IOS and IOS XE Software Layer 2 Tunneling Protocol Denial of Service Vulnerability (psirt@...co.com)
Cisco Security Advisory: Cisco IOS XE Software for Cisco ASR 920 Series Routers Zero Touch Provisioning Denial of Service Vulnerability (psirt@...co.com)
Cisco Security Advisory: Cisco IOx Data in Motion Stack Overflow Vulnerability (psirt@...co.com)

March 23 (2 messages)

APPLE-SA-2017-03-22-1 iTunes for Windows 12.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 3816-1] samba security update (Salvatore Bonaccorso <carnil@...ian.org>)

March 27 (2 messages)

[SECURITY] [DSA 3817-1] jbig2dec security update (Moritz Muehlenhoff <jmm@...ian.org>)
APPLE-SA-2017-03-27-1 Pages 6.1, Numbers 4.1, and Keynote 7.1 for Mac; Pages 3.1, Numbers 3.1, and Keynote 3.1 for iOS (Apple Product Security <product-securit…)

March 28 (3 messages)

[SECURITY] [DSA 3821-1] gst-plugins-ugly1.0 security update (Moritz Muehlenhoff <jmm@...ian.org>)
APPLE-SA-2017-03-27-7 macOS Server 5.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 3823-1] eject security update (Salvatore Bonaccorso <carnil@...ian.org>)

March 29 (6 messages)

APPLE-SA-2017-03-28-1 iCloud for Windows 6.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[slackware-security] mariadb (SSA:2017-087-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 3798-2] tnef regression update (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 3824-1] firebird2.5 security update (Sebastien Delafond <seb@...ian.org>)
ESA-2017-028: EMC Isilon OneFS Path Traversal Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
ESA-2017-013: RSA Archer® GRC Security Operations Management Sensitive Information Disclosure Vulnerability (EMC Product Security Response Center <Security_Ale…)

March 30 (2 messages)

[security bulletin] HPESBUX03725 rev.1 - HPE HP-UX Web Server Suite running Apache, Multiple Vulnerabilities (security-alert@....com)
[security bulletin] HPESBHF03723 rev.1 - HPE Aruba ClearPass Policy Manager, using Apache Struts, Remote Code Execution (security-alert@....com)

March 31 (1 message)

[security bulletin] HPESBGN03722 rev.1 - HPE Operations Agent, Local Escalation of Privilege (security-alert@....com)

104 messages

Powered by blists - more mailing lists