Mail Index

• Thread Index

• [SECURITY] [DSA 3275-1] fusionforge security update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 3269-2] postgresql-9.1 regression update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 3276-1] symfony security update
  • From: Moritz Muehlenhoff
• Ektron CMS 9.10 SP1 - CSRF Vulnerability
  • From: jerold
• Ektron CMS 9.10 SP1 - XSS Vulnerability
  • From: jerold
• WebDrive Buffer OverFlow PoC
  • From: banana88
• CVE-2015-4038 - WordPress WP Membership plugin [Privilege escalation]
  • From: pan . vagenas
• CVE-2015-4039 - WordPress WP Membership plugin [Stored XSS]
  • From: pan . vagenas
• t2'15: Call for Papers 2015 (Helsinki / Finland)
  • From: Tomi Tuominen
• Freebox OS Web interface 3.0.2 XSS, CSRF
  • From: huyngocbk
• Enhanced SQL Portal 5.0.7961 XSS Vulnerability
  • From: apparitionsec
• vfront-0.99.2 CSRF & Persistent XSS
  • From: apparitionsec
• WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability
  • From: Vulnerability Lab
• [SECURITY] [DSA 3277-1] wireshark security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 3249-2] jqueryui security update
  • From: Sebastien Delafond
• Safari Address Spoofing - Impact, Code, How It Works, History
  • From: David Leo
• Jildi FTP Client 1.5.2 b1138 - Buffer Overflow Vulnerability
  • From: banana88
• Local PHP File Inclusion in ResourceSpace
  • From: High-Tech Bridge Security Research
• ESA-2015-091: RSA® Web Threat Detection Cross-Site Request Forgery Vulnerability
  • From: Security Alert
• [SECURITY] [DSA 3278-1] libapache-mod-jk security update
  • From: Markus Koschany
• [Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc)
  • From: Pedro Ribeiro
• IBM Watson (Cognea) - XSS and Redirect Vulnerabilities
  • From: jerold
• CVE-2015-4153 - WordPress zM Ajax Login & Register Plugin [Local File Inclusion]
  • From: pan . vagenas
• [security bulletin] HPSBGN03343 rev.1 - HP WebInspect, Remote Unauthorized Access
  • From: security-alert
• CA20150604-01: Security Notice for CA Common Services
  • From: Kotas, Kevin J
• [CVE-2015-4107] Wing FTP Server Remote Code Execution vulnerability
  • From: alex_haynes
• [CVE-2015-4108] Wing FTP Server Cross-site Request Forgery vulnerabilities
  • From: alex_haynes
• Wing FTP Server Remote Code Execution vulnerability
  • From: alex_haynes
• 1 Click Audio Converter v2.3.6 - Activex Buffer Overflow
  • From: Vulnerability Lab
• 1 Click Audio Converter v2.3.6 - Activex Buffer Overflow
  • From: Vulnerability Lab
• 1 Click Extract Audio v2.3.6 - Activex Buffer Overflow
  • From: Vulnerability Lab
• CVE-2015-4109 - WordPress Users Ultra Plugin [SQL injection]
  • From: pan . vagenas
• Expedia Product Security Advisory: Cruise Ship Centers Information Disclosure
  • From: Mike Sheward
• Xloner v3.1.2 wordpress plugin authenticated command execution and XSS
  • From: Larry W. Cashdollar
• CVE-2015-4010 - Cross-site Request Forgery & Cross-site Scripting in Encrypted Contact Form Wordpress Plugin v1.0.4
  • From: venkatesh . nitin
• Symphony CMS 2.6.2
  • From: apparitionsec
• [SECURITY] [DSA 3279-1] redis security update
  • From: Alessandro Ghedini
• Hardcoded AES 256 bit key used in Kankun IoT/Smart socket and its mobile App
  • From: Payatu Research
• [SECURITY] [DSA 3280-1] php5 security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 3281-1] Debian Security Team PGP/GPG key change notice
  • From: Thijs Kinkhorst
• AnimaGallery 2.6 (theme and lang cookie parameter) Local File Include Vulnerability
  • From: d4rkr0id
• Symphony CMS XSS Vulnerability
  • From: apparitionsec
• [SECURITY] [DSA 3282-1] strongswan security update
  • From: Yves-Alexis Perez
• Symphony CMS XSS Vulnerability [Corrected Post]
  • From: apparitionsec
• SilverStripe CMS Unvalidated Redirect & XSS vulnerabilities
  • From: apparitionsec
• SilverStripe CMS Unvalidated Redirect & XSS vulnerabilities
  • From: apparitionsec
• CFP The 2nd International Conference on Information Systems Security and Privacy ICISSP 2016
  • From: icissp . secretariat
• NEW VMSA-2015-0004 - VMware Workstation, Fusion and Horizon View Client updates address critical security issues
  • From: VMware Security Response Center
• [security bulletin] HPSBST03346 rev.1 - HP P6000 Command View Software running Jetty, Remote Denial of Service (DoS)
  • From: security-alert
• [security bulletin] HPSBMU03349 rev.1- HP Helion CloudSystem, Local Denial of Service (DoS), Arbitrary Code Execution
  • From: security-alert
• [SECURITY] [DSA 3283-1] cups security update
  • From: Salvatore Bonaccorso
• Logstash vulnerability CVE-2015-4152
  • From: Kevin Kluge
• Kibana vulnerability CVE-2015-4093
  • From: Kevin Kluge
• Elasticsearch vulnerability CVE-2015-4165
  • From: Kevin Kluge
• [security bulletin] HPSBUX03341 SSRT102068 rev.1 - HP-UX Apache Tomcat v7.x, Remote Denial of Service (DoS) and Other Vulnerabilities
  • From: security-alert
• [RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session ID
  • From: RedTeam Pentesting GmbH
• [RT-SA-2015-004] Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery
  • From: RedTeam Pentesting GmbH
• Arbitrary File Disclosure and Open Redirect in Bonita BPM
  • From: High-Tech Bridge Security Research
• Multiple Vulnerabilities in ISPConfig
  • From: High-Tech Bridge Security Research
• Use-After-Free in PHP
  • From: High-Tech Bridge Security Research
• Heroku Bug Bounty #2 - (API) Re Auth Session Bypass Vulnerability
  • From: Vulnerability Lab
• XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 )
  • From: stasvolfus
• Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0
  • From: Larry W. Cashdollar
• [security bulletin] HPSBUX03337 SSRT102066 rev.1 - HP-UX Apache Web Server Suite running Apache Web Server, Tomcat v6.x, or PHP v5.4.x, Remote Denial of Service (DoS) and Other Vulnerabilities
  • From: security-alert
• D-Link DSP-W110 - multiple vulnerabilities
  • From: Peter Adkins
• Cisco Security Advisory: Cisco IOS XR Software Crafted IPv6 Packet Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin
  • From: Larry W. Cashdollar
• [KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability
  • From: Egidio Romano
• [KIS-2015-02] Concrete5 <= 5.7.3.1 Multiple Reflected Cross-Site Scripting Vulnerabilities
  • From: Egidio Romano
• [KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability
  • From: Egidio Romano
• Nakid-CMS CSRF, Persistent XSS & LFI
  • From: apparitionsec
• [slackware-security] php (SSA:2015-162-02)
  • From: Slackware Security Team
• ZCMS SQL Injection & Persistent XSS
  • From: apparitionsec
• [SYSS-2015-020] ZENWorks Mobile Management - Cross-Site Scripting
  • From: ludwig . stage
• FreeBSD Security Advisory FreeBSD-SA-15:10.openssl
  • From: FreeBSD Security Advisories
• [slackware-security] openssl (SSA:2015-162-01)
  • From: Slackware Security Team
• [SECURITY] [DSA 3285-1] qemu-kvm security update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 3286-1] xen security update
  • From: Moritz Muehlenhoff
• Buffer Overflow in My Wifi Router Software
  • From: sudson08
• [SECURITY] [DSA 3287-1] openssl security update
  • From: Alessandro Ghedini
• [SECURITY] [DSA 3288-1] libav security update
  • From: Moritz Muehlenhoff
• [SECURITY] [DSA 3252-2] sqlite3 security update
  • From: Alessandro Ghedini
• Productsurf Cms Sql Injection Vulnerability
  • From: iedb . team
• WebdesignJiNi Cms Sql Injection Vulnerability
  • From: iedb . team
• [RT-SA-2015-002] SQL Injection in TYPO3 Extension Akronymmanager
  • From: RedTeam Pentesting GmbH
• [SECURITY] [DSA 3289-1] p7zip security update
  • From: Ben Hutchings
• BlackCat CMS v1.1.1 Arbitrary File Download Vulnerability
  • From: d4rkr0id
• ESA-2015-106: EMC Unified Infrastructure Manager/Provisioning (UIM/P) Authentication Bypass Vulnerability
  • From: Security Alert
• ESA-2015-043: RSA® Validation Manager Security Update for Multiple Vulnerabilities
  • From: Security Alert
• OS Command Injection in Vesta Control Panel
  • From: High-Tech Bridge Security Research
• Reflected Cross-Site Scripting (XSS) in SearchBlox
  • From: High-Tech Bridge Security Research
• VCE3570: VCE Vision(TM) Intelligent Operations Cryptographic and Cleartext Vulnerabilities
  • From: VCE - PSIRT
• [security bulletin] HPSBGN03350 rev.1 - HP SiteScope Using RC4, Remote Disclosure of Information
  • From: security-alert
• [security bulletin] HPSBGN03338 rev.1 - HP Service Manager running RC4, Remote Disclosure of Information
  • From: security-alert
• [SECURITY] [DSA 3290-1] linux security update
  • From: Ben Hutchings
• [SECURITY] [DSA 3291-1] drupal7 security update
  • From: Sebastien Delafond
• DUO Security push Timing Attack
  • From: jpierini
• [SECURITY] [DSA 3292-1] cinder security update
  • From: Sebastien Delafond
• ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities
  • From: Vulnerability Lab
• ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability
  • From: Vulnerability Lab
• Ebay Magento Bug Bounty #10 - Persistent Filename Vulnerability
  • From: Vulnerability Lab
• Ebay Magento Bug Bounty #17 - Client Side Cross Site Scripting Web Vulnerability
  • From: Vulnerability Lab
• Ebay Magento Bug Bounty #12 - Cross Site Request Forgery Web Vulnerability
  • From: Vulnerability Lab
• [CVE-2015-3188] Apache Storm remote code execution vulnerability
  • From: P. Taylor Goetz
• [SECURITY] [DSA 3293-1] pyjwt security update
  • From: Alessandro Ghedini
• mysql-lite-administrator XSS vulnerabilities
  • From: apparitionsec
• mysql-lite-administrator XSS vulnerabilities
  • From: apparitionsec
• GeniXCMS XSS Vulnerabilities
  • From: apparitionsec
• [oCERT-2015-008] FreeRADIUS insufficent CRL application
  • From: Andrea Barisani
• ManageEngine Asset Explorer v6.1 - Persistent Vulnerability
  • From: Vulnerability Lab
• The "localhosed" attack - stealing IE local machine cookies and exposing its internal IP address
  • From: Amit Klein
• [security bulletin] HPSBMU03356 rev.1 - HP Business Service Automation Essentials (BSAE) running TLS, Remote Disclosure of Information
  • From: security-alert
• KMPlayer 3.9.1.136 Capture Unicode Buffer Overflow (ASLR Bypass)
  • From: n4ser . farhadi
• ESA-2015-109: EMC Documentum D2 Cross-Site Scripting
  • From: Security Alert
• ESA-2015-110: EMC Documentum Thumbnail Server Directory Traversal Vulnerability
  • From: Security Alert
• [SECURITY] [DSA 3294-1] wireshark security update
  • From: Moritz Muehlenhoff
• CVE-2015-3443 XSS in Thycotic Secret Server version 8.6.000000 to 8.8.000004
  • From: Marco Delai
• CVE-2015-4464 Insufficient Authorization Checks Request Handling Remote Authentication Bypass for Kguard Digital Video Recorders
  • From: Federick Joe P Fajardo
• [SECURITY] [DSA 3295-1] cacti security update
  • From: Salvatore Bonaccorso
• [ERPSCAN-15-003] SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS
  • From: Darya Maenkova
• [ERPSCAN-15-004] SAP NetWeaver Portal XMLValidationComponent - XXE
  • From: Darya Maenkova
• [ERPSCAN-15-006] SAP NetWeaver Portal ReportXmlViewer - XXE
  • From: Darya Maenkova
• [ERPSCAN-15-005] SAP Mobile Platform - XXE
  • From: Darya Maenkova
• [ERPSCAN-15-007] SAP Management Console ReadProfile Parameters - Information disclosure
  • From: Darya Maenkova
• [ERPSCAN-15-009] SAP Afaria 7 XcListener - Missing authorization check
  • From: Darya Maenkova
• [ERPSCAN-15-010] SYBASE SQL Anywhere 12 and 16 - DoS
  • From: Darya Maenkova
• [ERPSCAN-15-008] SAP Afaria 7 XcListener - DoS in the module XeClient.Dll
  • From: Darya Maenkova
• [ERPSCAN-15-011] SAP Mobile Platform 3.0 - XXE
  • From: Darya Maenkova
• Netgear Prosafe VPN Firewalls - Multiple vulnerabilities
  • From: post
• ESA-2015-102: EMC Unisphere for VMAX Remote Code Execution Vulnerability
  • From: Security Alert
• Cisco Security Advisory: Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
  • From: Cisco Systems Product Security Incident Response Team
• CVE-2015-3931 Microsec e-Szigno, CVE-2015-3932 Netlock Mokka XSW vulnerability
  • From: Imre RAD
• ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities
  • From: Security Alert
• SEC Consult SA-20150626-0 :: Critical vulnerabilities in Polycom RealPresence Resource Manager (RPRM) allow surveillance on conferences
  • From: SEC Consult Vulnerability Lab
• [security bulletin] HPSBGN03351 rev.1 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information
  • From: security-alert
• [security bulletin] HPSBUX03359 rev.1 - HP-UX pppoec, local elevation of privilege
  • From: security-alert
• [security bulletin] HPSBMU03267 rev.3 - HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL, Remote Disclosure of Information
  • From: security-alert
• [security bulletin] HPSBGN03362 rev.1 - HP Discovery and Dependency Mapping Inventory (DDMI) with TLS, Remote Disclosure of Information
  • From: security-alert
• [security bulletin] HPSBPI03107 rev.1 - HP LaserJet Printers and MFPs, HP OfficeJet Printers and MFPs, and HP JetDirect Networking cards using OpenSSL, Remote Disclosure of Information
  • From: security-alert
• [security bulletin] HPSBPI03360 rev.2 - HP LaserJet Printers and MFPs, HP OfficeJet Printers and MFPs, and HP JetDirect Networking cards using OpenSSL, Remote Disclosure of Information
  • From: security-alert
• Session Fixation, Reflected XSS, Code Execution in PivotX 2.3.10
  • From: Tim
• CSRF Vulnerability in C2Box application CVE-2015-4460
  • From: wissam . bashour
• CollabNet Subversion Edge Hook Script Privilege Escalation
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge Password Hash Leak
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge downloadHook local file inclusion
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge tail local file inclusion
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge insecure password change
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge show local file inclusion
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge missing brute force protection
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge missing clickjacking protection
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge autocomplete on
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge weak password policy
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge missing XSRF protection
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge weak password storage mechanism
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge missing single login restriction
  • From: Oliver-Tobias Ripka
• CollabNet Subversion Edge indes local file inclusion
  • From: Oliver-Tobias Ripka
• novius-os.5.0.1 Persistent XSS, LFI & Open Redirect Vulnerabilities
  • From: apparitionsec
• [SECURITY] [DSA 3296-1] libcrypto++ security update
  • From: Alessandro Ghedini
• [SECURITY] [DSA 3297-1] unattended-upgrades security update
  • From: Alessandro Ghedini
• CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP
  • From: Fernando Muñoz
• Google Chrome Address Spoofing (Request For Comment)
  • From: David Leo