bugtraq mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2018/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹	²	³ 3	⁴ 4	⁵ 4	⁶	⁷
⁸ 13	⁹ 6	¹⁰ 6	¹¹ 1	¹² 10	¹³	¹⁴
¹⁵ 13	¹⁶ 4	¹⁷ 2	¹⁸ 5	¹⁹ 1	²⁰	²¹
²² 9	²³ 3	²⁴ 9	²⁵ 4	²⁶	²⁷	²⁸
²⁹ 1	³⁰ 16	³¹ 3

Messages by day:

January 3 (3 messages)

Advisory - Bamboo - CVE-2017-14589 CVE-2017-14590 (Atlassian <security@...assian.com>)
b2evolution CMS 6.6.0 - 6.8.10 PHP code execution (Anti Räis <antirais@...il.com>)
CVE-2017-6094 - Genexis GAPS Access Control Vulnerability (Antoine Neuenschwander <antoine@...oggi.org>)

January 4 (4 messages)

[security bulletin] MFSBGN03793 rev.2 - Project and Portfolio Management Center, Multiple vulnerabilities (cyber-psrt@...rofocus.com)
[security bulletin] HPESBHF03803 rev.1 - Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance, Remote Denial of Service an… (security-alert@....com)
Re "Intel responds to security research findings" (Ed Maste <emaste@...ebsd.org>)
Intel CPU bug forcing page table switch during syscalls? (Pavel Machek <pavel@....cz>)

January 5 (4 messages)

[SECURITY] [DSA 4078-1] linux security update (Yves-Alexis Perez <corsac@...ian.org>)
SonicWall SonicOS NSA UTM Firewall - Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Icyphoenix 2.2.0.105 - Multiple SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
iJoomla com_adagency 6.0.9 - SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 8 (13 messages)

Abyss Web Server < v2.11.6 Memory Heap Corruption (hyp3rlinx / apparitionsec) (apparitionsec@...il.com)
CMS Tree Page View [CSRF, Privilege Escalation] (Panagiotis Vagenas <pan.vagenas@...il.com>)
Admin Menu Tree Page View [CSRF, Privilege Escalation] (Panagiotis Vagenas <pan.vagenas@...il.com>)
CVE-2017-17055 Artica Web Proxy v3.06 Remote Code Execution (hyp3rlinx / ApparitionSec) (apparitionsec@...il.com)
Wickr Inc - App Clock & Message Deletion Glitch - Bug Bounty (Vulnerability Lab <research@...nerability-lab.com>)
WpJobBoard v4.4.4 - Multiple SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
CVE-2017-16884 Mist Server v2.12 Unauthenticated Persistent XSS (hyp3rlinx / ApparitionSec) (apparitionsec@...il.com)
SonicWall SonicOS NSA Web Firewall - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Social Media Widget by Acurax [CSRF] (Panagiotis Vagenas <pan.vagenas@...il.com>)
[SECURITY] [DSA 4079-1] poppler security update (Moritz Muehlenhoff <jmm@...ian.org>)
APPLE-SA-2018-1-8-1 iOS 11.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2018-1-8-2 macOS High Sierra 10.13.2 Supplemental Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2018-1-8-3 Safari 11.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)

January 9 (6 messages)

Response to Meltdown and Spectre (Gordon Tetlow <gordon@...lows.org>)
[SECURITY] [DSA 4080-1] php7.0 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 4081-1] php5 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] irssi (SSA:2018-008-01) (Slackware Security Team <security@...ckware.com>)
CVE-2017-17485: one more way of rce in jackson-databind when defaultTyping+objects are used (Imre Rad <radimre83@...il.com>)
[SECURITY] [DSA 4082-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)

January 10 (6 messages)

[security bulletin] HPESBHF03805 rev.4 - Certain HPE products using Microprocessors from Intel, AMD, and ARM, with Speculative Execution… (security-alert@....com)
Multiple vulnerabilities in TP-Link products(CVE-2017-15613 to CVE-2017-15637) (chunibalon@...il.com)
DefenseCode ThunderScan SAST Advisory: WordPress Testimonial Slider Plugin SQL injection Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)
DefenseCode ThunderScan SAST Advisory: WordPress Smooth Slider Plugin SQL injection Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)
DefenseCode ThunderScan SAST Advisory: WordPress Dbox 3D Slider Lite Multiple SQL injection Security Vulnerabilities (DefenseCode <defensecode@...ensecode.com>)
WebKitGTK+ Security Advisory WSA-2018-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

January 11 (1 message)

[SECURITY] [DSA 4083-1] poco security update (Sebastien Delafond <seb@...ian.org>)

January 12 (10 messages)

CVE-2017-8802 Zimbra Collaboration Suite - Stored Cross-Site Scripting (Advisories <advisories@...pass-security.com>)
Flash Operator Panel v2.31.03 - Command Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Kentico CMS v11.0 - Stack Buffer Overflow Vulnerability (Vulnerability Lab <submit@...nerability-lab.com>)
MagicSpam 2.0.13 - Insecure File Permission Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Piwigo v2.8.2 & 2.9.2 CMS - Multiple Cross Site Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
SonicWall GMS v8.1 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Magento Commerce - SSRF & XSPA Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Microsoft Sharepoint 2013 - Limited Access Permission Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Magento Connect T1 - (Claim) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 4084-1] gifsicle security update (Sebastien Delafond <seb@...ian.org>)

January 15 (13 messages)

[security bulletin] HPESBNS03804 rev.1 - HPE NonStop Server, Local Authentication Restriction Bypass (security-alert@....com)
[SECURITY] [DSA 4085-1] xmltooling security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPESBHF03800 rev.1 - HPE Comware 7 MSR Routers, Remote Denial of Service and Local Elevation or Privilege (security-alert@....com)
Code execution in Kaseya VSA ("Securify B.V." <lists@...urify.nl>)
[SECURITY] [DSA 4087-1] transmission security update (Moritz Muehlenhoff <jmm@...ian.org>)
Broken TLS certificate pinning in VTech DigiGo Kid Connect app (Summer of Pwnage <lists@...urify.nl>)
Arbitrary file read in Kaseya VSA ("Securify B.V." <lists@...urify.nl>)
Multiple vulnerabilities in VTech DigiGo allow browser overlay attack (Summer of Pwnage <lists@...urify.nl>)
Authentication bypass in Kaseya VSA ("Securify B.V." <lists@...urify.nl>)
Broken TLS certificate validation in VTech DigiGo browser (Summer of Pwnage <lists@...urify.nl>)
[SECURITY] [DSA 4086-1] libxml2 security update (Salvatore Bonaccorso <carnil@...ian.org>)
Adminer <= v4.3.1 Server Side Request Forgery (apparitionsec@...il.com)
Seagate Media Server allows deleting of arbitrary files and folders (Summer of Pwnage <lists@...urify.nl>)

January 16 (4 messages)

[RT-SA-2017-013] Truncation of SAML Attributes in Shibboleth 2 (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
Zenario v7.6 CMS - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 4088-1] gdk-pixbuf security update (Moritz Muehlenhoff <jmm@...ian.org>)
MagicSpam 2.0.13 - Insecure File Permission Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 17 (2 messages)

ADVISORY - LiveZilla - Cross-site scripting (XSS) vulnerability in knowledgebase.php - CVE-2017-15869 (tim.kretschmann@...las.com)
[SECURITY] [DSA 4089-1] bind9 security update (Salvatore Bonaccorso <carnil@...ian.org>)

January 18 (5 messages)

[SECURITY] [DSA 4090-1] wordpress security update (Sebastien Delafond <seb@...ian.org>)
[security bulletin] HPSBGN02925 rev.3 - HP IceWall SSO, IceWall File Manager and IceWall Federation Agent, Multiple Remote Unauthorized … (security-alert@....com)
[security bulletin] HPESBMU03806 rev.1 - HPE IceWall Products, Multiple Remote Unauthorized Disclosure of Information, Unauthorized Mod… (security-alert@....com)
[security bulletin] HPESBHF03805 rev.5 - Certain HPE products using Microprocessors from Intel, AMD, and ARM, with Speculative Execution… (security-alert@....com)
[slackware-security] bind (SSA:2018-017-01) (Slackware Security Team <security@...ckware.com>)

January 19 (1 message)

[SECURITY] [DSA 4092-1] awstats security update (Sebastien Delafond <seb@...ian.org>)

January 22 (9 messages)

CVE-2017-15713: Apache Hadoop MapReduce job history server vulnerability (Jason Lowe <jlowe@...che.org>)
[SECURITY] [DSA 4093-1] openocd security update (<luciano@...ian.org>)
CentOS Web Panel v0.9.8.12 - Non-Persistent Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Oracle JDeveloper IDE Directory Traversal CVE-2017-10273 (hyp3rlinx / apparition security) (apparitionsec@...il.com)
Shopware 5.2.5 & v5.3 - Multiple Cross Site Scripting Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Photo Vault v1.2 iOS - Insecure Authentication Vulnerability (Vulnerability Lab <admin@...nerability-lab.com>)
Acadmic Microsoft - API Query Filter Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
CentOS Web Panel v0.9.8.12 - Multiple Persistent Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
CentOS Web Panel v0.9.8.12 - Remote SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 23 (3 messages)

[SECURITY] [DSA 4094-1] smarty3 security update (Luciano Bello <luciano@...ian.org>)
[security bulletin] HPESBHF03805 rev.7 - Certain HPE products using Microprocessors from Intel, AMD, and ARM, with Speculative Execution… (security-alert@....com)
SEC Consult SA-20180123-0 :: XXE & Reflected XSS in Oracle Financial Services Analytical Applications (SEC Consult Vulnerability Lab <research@...-consult.com>)

January 24 (9 messages)

DefenseCode ThunderScan SAST Advisory: SugarCRM Community Edition Multiple SQL Injection Vulnerabilities (DefenseCode <defensecode@...ensecode.com>)
APPLE-SA-2018-1-23-6 iTunes 12.7.3 for Windows (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2018-1-23-7 iCloud for Windows 7.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2018-1-23-2 macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capita… (Apple Product Security <product-securit…)
APPLE-SA-2018-1-23-5 Safari 11.0.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2018-1-23-1 iOS 11.2.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2018-1-23-3 watchOS 4.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2018-1-23-4 tvOS 11.2.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
CVE-2017-15718: Apache Hadoop YARN NodeManager vulnerability (Akira Ajisaka <aajisaka@...che.org>)

January 25 (4 messages)

WebKitGTK+ Security Advisory WSA-2018-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
[SECURITY] [DSA 4095-1] gcab security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 4096-1] firefox-esr security update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] curl (SSA:2018-024-01) (Slackware Security Team <security@...ckware.com>)

January 29 (1 message)

[SECURITY] [DSA 4097-1] poppler security update (Moritz Muehlenhoff <jmm@...ian.org>)

January 30 (16 messages)

[security bulletin] HPESBHF03809 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Authentication Restriction Bypass (security-alert@....com)
[security bulletin] HPESBHF03810 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Disclosure of Information (security-alert@....com)
[security bulletin] HPESBHF03815 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Code Execution (security-alert@....com)
[security bulletin] HPESBHF03813 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Code Execution (security-alert@....com)
[security bulletin] HPESBHF03808 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Code Execution (security-alert@....com)
KL-001-2018-001 : Sophos Web Gateway Persistent Cross Site Scripting Vulnerability (KoreLogic Disclosures <disclosures@...elogic.com>)
[slackware-security] mozilla-thunderbird (SSA:2018-025-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 4099-1] ffmpeg security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 4100-1] tiff security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPESBHF03811 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Multiple Vulnerabilities (security-alert@....com)
Secunia Research: LibRaw Multiple Denial of Service Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[security bulletin] HPESBHF03812 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Multiple Vulnerabilities (security-alert@....com)
[SYSS-2017-026] Microsoft Surface Hub Keyboard - Cryptographic Issues (CWE-310), Insufficient Protection against Replay Attacks (matthias.deeg@...s.de)
[security bulletin] HPESBHF03814 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Unauthorized Modification (security-alert@....com)
[SECURITY] [DSA 4101-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 4098-1] curl security update (Alessandro Ghedini <ghedo@...ian.org>)

January 31 (3 messages)

Defense in depth -- the Microsoft way (part 49): fun with application manifests ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[SECURITY] [DSA 4094-2] smarty3 security update (Luciano Bello <luciano@...ian.org>)
SEC Consult SA-20180131-0 :: Multiple Vulnerabilities in Sprecher Automation SPRECON-E-C, PU-2433 (SEC Consult Vulnerability Lab <research@...-consult.com>)

117 messages