bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2017/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 2	⁴ 22	⁵	⁶ 3	⁷ 1	⁸	⁹
¹⁰ 10	¹¹ 2	¹² 4	¹³ 8	¹⁴ 3	¹⁵	¹⁶
¹⁷ 1	¹⁸ 3	¹⁹ 4	²⁰ 3	²¹ 1	²²	²³
²⁴	²⁵ 14	²⁶ 3	²⁷ 1	²⁸ 5	²⁹	³⁰

Messages by day:

April 3 (2 messages)

Splunk Enterprise Information Theft CVE-2017-5607 (apparitionsec@...il.com (hyp3rlinx))
SEC Consult SA-20170403-0 :: Misbehavior of PHP fsockopen function (SEC Consult Vulnerability Lab <research@...-consult.com>)

April 4 (22 messages)

[security bulletin] HPESBGN03721 rev.1 - HPE Operations Bridge Analytics, Remote Cross-Site Scripting (XSS) (security-alert@....com)
Kaseya VSA 6.5 Parameter Reflected XSS, Enumeration and Bruteforce Weakness (Patrick Webster <patrick@...security.com.au>)
Lotus Protector for Mail Security remote code execution (Patrick Webster <patrick@...security.com.au>)
Avaya Radvision SCOPIA Desktop dlg_loginownerid.jsp ownerid SQL Injection (Patrick Webster <patrick@...security.com.au>)
AirWatch Self Service Portal Username Parameter LDAP Injection (Patrick Webster <patrick@...security.com.au>)
Manhattan Software IWMS (Integrated Workplace Management System) XML External Entity (XXE) Injection File Disclosure (Patrick Webster <patrick@...security.com.…)
Lantern CMS Path Disclosure, SQL Injection, Reflected XSS (Patrick Webster <patrick@...security.com.au>)
CVE-2017-7185 - Mongoose OS - Use-after-free / Denial of Service (Advisories <advisories@...pass-security.com>)
Computer Associates API Gateway CRLF Response Splitting, Directory Traversal vulnerabilities (Patrick Webster <patrick@...security.com.au>)
Tweek!DM Document Management Authentication bypass, SQL injection (Patrick Webster <patrick@...security.com.au>)
SilverStripe CMS - Path Disclosure (Patrick Webster <patrick@...security.com.au>)
SmartJobBoard - Cross-site scripting, personal information disclosure and PHPMailer package (Patrick Webster <patrick@...security.com.au>)
AcoraCMS browser redirect and Cross-site scripting vulnerabilities (Patrick Webster <patrick@...security.com.au>)
Kaseya information disclosure vulnerability (Patrick Webster <patrick@...security.com.au>)
iPlatinum iOneView Multiple Parameter Reflected XSS (Patrick Webster <patrick@...security.com.au>)
Moodle URL Manipulation Remote Account Information Disclosure (Patrick Webster <patrick@...security.com.au>)
OS-S-2017-01: The password for the application protection of the Schneider Modicon TM221CE16R can be retrieved without authentic… (Ralf Spenneberg <info@...t.de>)
The password for the project protection of the Schneider Modicon TM221CE16R is hard-coded and cannot be changed. (Ralf Spenneberg <info@...t.de>)
AST-2017-001: Buffer overflow in CDR's set user ("Asterisk Security Team" <security@...erisk.org>)
[SECURITY] [DSA 3826-1] tryton-server security update (Salvatore Bonaccorso <carnil@...ian.org>)
DefenseCode ThunderScan SAST Advisory: Apache Tomcat Directory/Path Traversal (DefenseCode <defensecode@...ensecode.com>)
[security bulletin] HPESBGN03727 rev.1 - HPE Business Process Monitor, Remote Unauthorized Access to Data (security-alert@....com)

April 6 (3 messages)

Spiceworks 7.5 TFTP Improper Access Control File Overwrite / Upload (apparitionsec@...il.com (hyp3rlinx))
Trend Micro Enterprise Mobile Security Android Application - MITM SSL Certificate Vulnerability (CVE-2016-9319) (David Coomber <davidcoomber.infosec@...il.com>)
Apple Music Android Application - MITM SSL Certificate Vulnerability (CVE-2017-2387) (David Coomber <davidcoomber.infosec@...il.com>)

April 7 (1 message)

SEC Consult SA-20170407-0 :: Server-Side Request Forgery in MyBB forum (SEC Consult Vulnerability Lab <research@...-consult.com>)

April 10 (10 messages)

D-Link DWR-116 - CVE-2017-6190 - Arbitrary File Download (patrykgnt@...il.com)
[CVE-2016-6805] Arbitrary File Read due to eXternal Xml Entity attack in Apache Ignite (Denis Magda <dmagda@...che.org>)
[security bulletin] HPESBGN03733 rev.1 - HPE Universal CMDB using Apache Struts, Remote Code Execution (security-alert@....com)
[SECURITY] [DSA 3827-1] jasper security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] libtiff (SSA:2017-098-01) (Slackware Security Team <security@...ckware.com>)
Foscam All networked devices, multiple Design Errors. SSL bypass. (nick.m.mckenna@...il.com)
ChromeOS / ChromeBooks Persist Certain Network Settings in Guest Mode (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
DefenseCode ThunderScan SAST Advisory: WordPress Tribulant Slideshow Gallery Plugin - Cross-Site Scripting Vulnerabilit… (DefenseCode <defensecode@...ensecode.co…)
[SECURITY] CVE-2017-5651 Apache Tomcat Information Disclosure (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2017-5648 Apache Tomcat Information Disclosure (Mark Thomas <markt@...che.org>)

April 11 (2 messages)

Multiple local privilege escalation vulnerabilities in Proxifier for Mac ("Securify B.V." <lists@...urify.nl>)
Microsoft Office OneNote 2007 DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)

April 12 (4 messages)

[SECURITY] [DSA 3829-1] bouncycastle security update (Moritz Muehlenhoff <jmm@...ian.org>)
FreeBSD Security Advisory FreeBSD-SA-17:03.ntp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
CVE-2017-7457 Moxa MX AOPC-Server v1.5 XML External Entity Injection (apparitionsec@...il.com (hyp3rlinx))
CVE-2017-7455 Moxa MXview v2.8 Remote Private Key Disclosure (apparitionsec@...il.com (hyp3rlinx))

April 13 (8 messages)

CVE-2017-7456 Moxa MXview v2.8 Denial Of Service (apparitionsec@...il.com (hyp3rlinx))
DefenseCode Security Advisory: Magento 0day Arbitrary File Upload Vulnerability (Remote Code Execution, CSRF) (DefenseCode <defensecode@...ensecode.com>)
April 2017 - HipChat Server Advisory (Matthew Hart <mhart@...assian.com>)
[SYSS-2017-005] agorum core Pro - Persistent Cross-Site Scripting (erlijn.vangenuchten@...s.de)
[SYSS-2017-006] agorum core Pro - Insecure Direct Object Reference (erlijn.vangenuchten@...s.de)
[SYSS-2017-007] agorum core Pro - Cross-Site Scripting (erlijn.vangenuchten@...s.de)
[SYSS-2017-008] agorum core Pro - Cross-Site Request Forgery (erlijn.vangenuchten@...s.de)
[SYSS-2017-009] agorum core Pro - Improper Restriction of XML External Entity Reference ('XXE') (erlijn.vangenuchten@...s.de)

April 14 (3 messages)

[security bulletin] HPESBGN03728 rev.1 - HPE Operations Agent using OpenSSL, Remote Denial of Service (DoS), Unauthorized Access to Data (security-alert@....com)
[slackware-security] bind (SSA:2017-103-01) (Slackware Security Team <security@...ckware.com>)
concrete5 v8.1.0 Host Header Injection (apparitionsec@...il.com (hyp3rlinx))

April 17 (1 message)

Watchguard Fireware XXE DoS & User Enumeration (David Fernandez <david.fdmv@...il.com>)

April 18 (3 messages)

[ANNOUNCE] HPACK Bomb Attack vulnerability in ATS - CVE-2016-5396 (Bryan Call <bcall@...che.org>)
[CVE-2017-5661] Apache XML Graphics FOP information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
CVE-2017-7615 Mantis Bug Tracker v1.3.0 / 2.3.0 Pre-Auth Remote Password Reset (apparitionsec@...il.com (hyp3rlinx))

April 19 (4 messages)

[slackware-security] minicom (SSA:2017-108-01) (Slackware Security Team <security@...ckware.com>)
CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Filippo Cavallarin <filippo.cavallarin@...resegment.com>)
CVE-2017-7220. OpenText Documentum Content Server: privilege evaluation using crafted RPC save-commands. ("Andrey B. Panfilov" <andrew@...filov.tel>)
DefenseCode ThunderScan SAST Advisory: Ultimate Form Builder Cross-Site Scripting (XSS) Vulnerability (DefenseCode <defensecode@...ensecode.com>)

April 20 (3 messages)

October CMS v1.0.412 several vulnerabilities (Anti Räis <antirais@...il.com>)
[HITB-Announce] HITB GSEC 2017 CFP Closes April 30th (Hafez Kamal <aphesz@...kinthebox.org>)
[SECURITY] [DSA 3831-1] firefox-esr security update (Moritz Muehlenhoff <jmm@...ian.org>)

April 21 (1 message)

CVE-2017-7192: Starscream library before 2.0.4 allows SSL pinning bypass (Security Advisories <security.advisories@...tralway.com>)

April 25 (14 messages)

CVE-2017-5887: Starscream library before 2.0.4 SSL pinning not applied for websocket handshake (Security Advisories <security.advisories@...tralway.com>)
Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges ("Securify B.V." <lists@...urify.nl>)
[slackware-security] proftpd (SSA:2017-112-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2017-112-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] ntp (SSA:2017-112-02) (Slackware Security Team <security@...ckware.com>)
Re: CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Dawid Golunski <dawid@...alhackers.com>)
CVE-2017-7221. OpenText Documentum Content Server: arbitrary code execution in dm_bp_transition.ebs docbase method ("Andrey B. Panfilov" <andrew@...filov.tel>)
KL-001-2017-005 : Solarwinds LEM Privilege Escalation via Controlled Sudo Path (KoreLogic Disclosures <disclosures@...elogic.com>)
KL-001-2017-006 : Solarwinds LEM Privilege Escalation via Sudo Script Abuse (KoreLogic Disclosures <disclosures@...elogic.com>)
KL-001-2017-007 : Solarwinds LEM Management Shell Escape via Command Injection (KoreLogic Disclosures <disclosures@...elogic.com>)
KL-001-2017-008 : Solarwinds LEM Management Shell Arbitrary File Read (KoreLogic Disclosures <disclosures@...elogic.com>)
KL-001-2017-009 : Solarwinds LEM Database Listener with Hardcoded Credentials (KoreLogic Disclosures <disclosures@...elogic.com>)
[SECURITY] [DSA 3833-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] mozilla-firefox (SSA:2017-114-01) (Slackware Security Team <security@...ckware.com>)

April 26 (3 messages)

[SECURITY] [DSA 3834-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)
April 2017 - Confluence - Security Advisory (David Black <dblack@...assian.com>)
CVE-2017-3162: Apache Hadoop DataNode web UI vulnerability (Chris Douglas <cdouglas@...che.org>)

April 27 (1 message)

FreeBSD Security Advisory FreeBSD-SA-17:04.ipfilter (FreeBSD Security Advisories <security-advisories@...ebsd.org>)

April 28 (5 messages)

[SECURITY] [DSA 3836-1] weechat security update (Salvatore Bonaccorso <carnil@...ian.org>)
Live Helper Chat - Cross-Site Scripting (Advisories <advisories@...pass-security.com>)
Apple iOS 10.2 & 10.3 - Control Panel Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 3838-1] ghostscript security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPESBHF03738 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Code Execution (security-alert@....com)

90 messages