Mail Index

• Thread Index

• Elevation of Privilege Vulnerability in MediaTek Driver ( CVE-2016-6492)
  • From: unlimitsec
• [SECURITY] [DSA 3636-1] collectd security update
  • From: Sebastien Delafond
• [SECURITY] [DSA 3634-1] redis security update
  • From: Sebastien Delafond
• Huawei eSpace IAD Remote Information Disclosure Vulnerability
  • From: ak47464659484
• Insert PHP WordPress Plugin allows authenticated user to execute arbitrary PHP
  • From: Summer of Pwnage
• Stored Cross-Site Scripting vulnerability in Easy Testimonials WordPress Plugin
  • From: Summer of Pwnage
• Multiple vulnerabilities in All In One WP Security & Firewall plugin login CAPTCHA
  • From: Summer of Pwnage
• [SECURITY] [DSA 3637-1] chromium-browser security update
  • From: Michael Gilbert
• Cross-Site Scripting vulnerability in Booking Calendar WordPress Plugin
  • From: Summer of Pwnage
• SQL injection vulnerability in Booking Calendar WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Scripting in Contact Bank WordPress Plugin
  • From: Summer of Pwnage
• Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability
  • From: Vulnerability Lab
• Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability
  • From: Vulnerability Lab
• Kaspersky Safe Browser iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6231)
  • From: David Coomber
• Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin
  • From: Summer of Pwnage
• [CVE-2016-6480] Double-Fetch Vulnerability in Linux-4.5/drivers/scsi/aacraid/commctrl.c
  • From: wpengfeinudt
• [security bulletin] HPSBUX03632 SSRT110194 rev.1 - HP-UX Mail Server running Sendmail, Local Unauthorized Disclosure of Information
  • From: security-alert
• [security bulletin] HPSBGN03564 rev.2 - HPE Release Control using Java Deserialization, Remote Code Execution
  • From: security-alert
• FortiManager (Series) - Multiple Web Vulnerabilities
  • From: Vulnerability Lab
• Guppy CMS v5.01.03 - Client Side Cross Site Scripting Web Vulnerability
  • From: Vulnerability Lab
• Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability
  • From: Vulnerability Lab
• Zoll ePCR v2.6.4 iOS - Multiple Persistent Vulnerabilities
  • From: Vulnerability Lab
• Docebo LMS 6.9 - (Moxie) API Calls RST Remote Code Execution Vulnerability
  • From: Vulnerability Lab
• WinSaber - Unquoted Service Path Privilege Escalation
  • From: Vulnerability Lab
• Cross-Site Scripting in Uji Countdown WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Scripting in WangGuard WordPress Plugin
  • From: Summer of Pwnage
• Arbitrary File Content Disclosure in Atutor
  • From: High-Tech Bridge Security Research
• WorldCIST'17 - Call for Workshops Proposals; Deadline: September 5
  • From: Maria Lemos
• [SECURITY] [DSA 3638-1] curl security update
  • From: Alessandro Ghedini
• [SECURITY] [DSA 3639-1] wordpress security update
  • From: Salvatore Bonaccorso
• Cisco Security Advisory: Cisco Unified Communications Manager IM and Presence Service SIP Packet Processing Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Unauthorized Access Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Remote Code Execution Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• [security bulletin] HPSBGN03633 rev.1 - HPE Release Control, Remote Denial of Service (DoS), Disclosure of Information, Unauthorized Access to Files or Server-Side Request Forgery(SSRF)
  • From: security-alert
• Secunia Research: LibGD "_gdContributionsAlloc()" Integer Overflow Denial of Service Vulnerability
  • From: Secunia Research
• [SECURITY] [DSA 3640-1] firefox-esr security update
  • From: Moritz Muehlenhoff
• Cross-Site Scripting vulnerability in search function Activity Log WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Scripting in Activity Log WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Scripting in WordPress Landing Pages Plugin
  • From: Summer of Pwnage
• FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Web Vulnerability
  • From: Vulnerability Lab
• FortiManager (Series) - (Bookmark) Persistent Vulnerability
  • From: Vulnerability Lab
• [SYSS-2016-065] NASdeluxe NDL-2400r: OS Command Injection
  • From: klaus . eisentraut
• [SECURITY] [DSA 3641-1] openjdk-7 security update
  • From: Moritz Muehlenhoff
• Cisco Security Advisory: Cisco IOS Software Crafted Network Time Protocol Packets Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance
  • From: Pedro Ribeiro
• Re: Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance
  • From: Pedro Ribeiro
• Cross-Site Scripting vulnerability in Events Made Easy WordPress plugin
  • From: Summer of Pwnage
• Cross-Site Scripting in FormBuilder WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Scripting in Count per Day WordPress Plugin
  • From: Summer of Pwnage
• Stored Cross-Site Scripting vulnerability in Count per Day WordPress Plugin
  • From: Summer of Pwnage
• [0day] net2ftp multiple XSS on unauthenticated users
  • From: Jacobo Avariento
• Typesettercms v5.0.1 - (Delete Files) CSRF Vulnerability
  • From: Vulnerability Lab
• Subrion v4.0.5 CMS - SQL Injection Vulnerability
  • From: Vulnerability Lab
• FortiCloud - (Reports Summary) Multiple Persistent Vulnerabilities
  • From: Vulnerability Lab
• Sophos Mobile Control EAS Proxy Open Reverse Proxy vulnerability (CVE-2016-6597)
  • From: Tim Kretschmann
• Sophos Mobile Control EAS Proxy Open Reverse Proxy vulnerability (CVE-2016-6597)
  • From: Tim Kretschmann
• [SYSS-2016-063] VMware ESXi 6 - Improper Input Validation (CWE-20)
  • From: matthias . deeg
• [SYSS-2016-063] VMware ESXi 6 - Improper Input Validation (CWE-20)
  • From: matthias . deeg
• [SYSS-2016-063] VMware ESXi 6 - Improper Input Validation (CWE-20)
  • From: matthias . deeg
• DLL side loading vulnerability in VMware Host Guest Client Redirector
  • From: Securify B.V.
• Ecwid Ecommerce Shopping Cart WordPress Plugin unauthenticated PHP Object injection vulnerability
  • From: Summer of Pwnage
• [SECURITY] [DSA 3642-1] lighttpd security update
  • From: Sebastien Delafond
• [SECURITY] [DSA 3643-1] kde4libs security update
  • From: Salvatore Bonaccorso
• [slackware-security] mozilla-firefox (SSA:2016-219-02)
  • From: Slackware Security Team
• [slackware-security] stunnel (SSA:2016-219-04)
  • From: Slackware Security Team
• [slackware-security] curl (SSA:2016-219-01)
  • From: Slackware Security Team
• [slackware-security] openssh (SSA:2016-219-03)
  • From: Slackware Security Team
• vBulletin <= 5.2.2 Preauth Server Side Request Forgery (SSRF)
  • From: Dawid Golunski
• phpCollab v2.5 CMS - SQL Injection Vulnerability
  • From: Vulnerability Lab
• [SECURITY] [DSA 3644-1] fontconfig security update
  • From: Salvatore Bonaccorso
• ESA-2016-070: RSA® Authentication Manager Prime SelfService Insecure Direct Object Reference Vulnerability
  • From: Security Alert
• [CVE-2016-6600/1/2/3]: Multiple vulnerabilities (RCE, file download, etc) in WebNMS Framework 5.2 / 5.2 SP1
  • From: Pedro Ribeiro
• [SECURITY] [DSA 3645-1] chromium-browser security update
  • From: Michael Gilbert
• Nagios Network Analyzer v2.2.1 Multiple CSRF
  • From: hyp3rlinx
• Any Video Converter DLL Hijack
  • From: hyp3rlinx
• AirSnort v0.2.7 Stack Corruption DOS
  • From: hyp3rlinx
• Facebook Bug Bounty #33 - Bypass ID user to linked Phone Number Vulnerability
  • From: Vulnerability Lab
• FortiVoice v5.0 - Filter Bypass & Persistent Validation Vulnerability
  • From: Vulnerability Lab
• Nuke Evolution 2.0.9d - Multiple Client Side Cross Site Scripting Vulnerabilities
  • From: Vulnerability Lab
• Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin
  • From: Summer of Pwnage
• Notepad++6.9.2 DLL Hijacking Vulnerability
  • From: mehta . himanshu21
• Nagios NA v2.2.1 XSS
  • From: hyp3rlinx
• Internet Explorer iframe sandbox local file name disclosure vulnerability
  • From: Securify B.V.
• Cisco Security Advisory: Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• [CORE-2016-0006] - SAP CAR Multiple Vulnerabilities
  • From: CORE Advisories Team
• Microsoft Education - Stored Cross Site Web Vulnerability
  • From: Vulnerability Lab
• QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability
  • From: Vulnerability Lab
• Directory Traversal Vulnerability in ColoradoFTP v1.3 Prime Edition (Build 8)
  • From: Rv3Lab.org
• [SECURITY] [DSA 3646-1] postgresql-9.4 security update
  • From: Salvatore Bonaccorso
• Defense in depth -- the Microsoft way (part 42): Sysinternals utilities load and execute rogue DLLs from %TEMP%
  • From: Stefan Kanthak
• [SECURITY] [DSA 3647-1] icedove security update
  • From: Moritz Muehlenhoff
• [CVE-2016-3089] Apache OpenMeetings XSS in SWF panel
  • From: Maxim Solodovnik
• [security bulletin] HPSBHF03440 rev.1 - HPE iLO 3 using JQuery, Remote Cross-Site Scripting (XSS)
  • From: security-alert
• [security bulletin] HPSBGN03630 rev.2 - HP Operations Manager for Unix, Solaris, and Linux using Apache Commons Collections (ACC), Remote Code Execution
  • From: security-alert
• [SECURITY] [DSA 3648-1] wireshark security update
  • From: Moritz Muehlenhoff
• WSO2 IDENTITY-SERVER v5.1.0 XML External-Entity
  • From: hyp3rlinx
• WSO2-CARBON v4.4.5 LOCAL FILE INCLUSION
  • From: apparitionsec
• WSO2 CARBON v4.4.5 PERSISTENT XSS COOKIE THEFT
  • From: hyp3rlinx
• WSO2-CARBON v4.4.5 CSRF / DOS
  • From: hyp3rlinx
• OpenCart 2.0.3.1 Cross Site Scripting Vulnerability (product_id - GET)
  • From: hamedizadi
• OpenCart 2.0.3.1 Cross Site Scripting Vulnerability (product_id - GET)
  • From: hamedizadi
• OpenCart 2.0.3.1 Cross Site Scripting Vulnerability (product_id - GET)
  • From: hamedizadi
• Linksys E1200 and E2500 (Missing authorization on parental control)
  • From: samhuntley84
• Linksys E2500 and E1200 (Unauth Command Injection)
  • From: samhuntley84
• Reflected Cross Site Scripting (XSS) Vulnerability in nopcommerce 3.70
  • From: tal argoni
• Stash v1.0.3 CMS - SQL Injection Vulnerability
  • From: Vulnerability Lab
• PayPal Inc BB #127 - 2FA Bypass Vulnerability
  • From: Vulnerability Lab
• Taser Axon Dock (Body-Worn Camera Docking Station) v3.1 - Authentication Bypass
  • From: reggie . dodd30
• Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of galleries
  • From: Summer of Pwnage
• Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows adding of images
  • From: Summer of Pwnage
• Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of images
  • From: Summer of Pwnage
• Stored Cross-Site Scripting vulnerability in Photo Gallery WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Scripting vulnerability in Google Maps WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Request Forgery vulnerability in Email Users WordPress Plugin
  • From: Summer of Pwnage
• Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin
  • From: Summer of Pwnage
• Ajax Load More Local File Inclusion vulnerability
  • From: Summer of Pwnage
• Cross-Site Scripting in Link Library WordPress Plugin
  • From: Summer of Pwnage
• Persistent Cross-Site Scripting in Magic Fields 2 WordPress Plugin
  • From: Summer of Pwnage
• Persistent Cross-Site Scripting in Magic Fields 1 WordPress Plugin
  • From: Summer of Pwnage
• [security bulletin] HPSBST03629 rev.1 - HP StoreFabric B-series Switches, Remote Disclosure of Privileged Information
  • From: security-alert
• [security bulletin] HPSBGN03634 rev.1 - HPE Enterprise Solution Sizers and Storage Sizer running Smart Update, Remote Arbitrary Code Execution
  • From: security-alert
• [security bulletin] HPSBHF03441 rev.1 - HPE ilO 3 and iLO 4 and iLO 4 mRCA, Remote Multiple Vulnerabilities
  • From: security-alert
• Lepton CMS Archive Directory Traversal
  • From: hyp3rlinx
• Lepton CMS PHP Code Injection
  • From: hyp3rlinx
• [ERPSCAN-16-022] SAP Hybris E-commerce Suite VirtualJDBC – Default Credentials
  • From: ERPScan inc
• [ERPSCAN-16-023] Potential backdoor via hardcoded system ID
  • From: ERPScan inc
• [SYSS-2016-067] NetIQ Access Manager (iManager) - Temporary Second Order Cross-Site Scripting (CWE-79)
  • From: Micha Borrmann
• Cisco Security Advisory: Cisco Firepower Management Center Privilege Escalation Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory:Cisco Application Policy Infrastructure Controller Enterprise Module Remote Code Execution Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco Firepower Management Center Remote Command Execution Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• Cisco Security Advisory: Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability
  • From: Cisco Systems Product Security Incident Response Team
• [SECURITY] [DSA 3649-1] gnupg security update
  • From: Salvatore Bonaccorso
• [SECURITY] [DSA 3650-1] libgcrypt20 security update
  • From: Salvatore Bonaccorso
• Telus Actiontec T2200H Modem Input Validation Flaw Allows Elevated Shell Access
  • From: Andrew Klaus
• [SYSS-2016-052] QNAP QTS - OS Command Injection
  • From: bugtraq
• [SYSS-2016-053] QNAP QTS - Arbitrary File Overwrite
  • From: bugtraq
• [SYSS-2016-048] QNAP QTS - OS Command Injection
  • From: bugtraq
• [SYSS-2016-050] QNAP QTS - Persistent Cross-Site Scripting
  • From: bugtraq
• [SYSS-2016-048] QNAP QTS - OS Command Injection
  • From: bugtraq
• [SYSS-2016-054] QNAP QTS - OS Command Injection
  • From: bugtraq
• [SYSS-2016-051] QNAP QTS - Reflected Cross-Site Scripting
  • From: bugtraq
• [SYSS-2016-048] QNAP QTS - OS Command Injection
  • From: bugtraq
• [SYSS-2016-055] QNAP QTS - OS Command Injection
  • From: bugtraq
• [SYSS-2016-050] QNAP QTS - Persistent Cross-Site Scripting
  • From: bugtraq
• [SYSS-2016-049] QNAP QTS - Persistent Cross-Site Scripting
  • From: bugtraq
• [SYSS-2016-054] QNAP QTS - OS Command Injection
  • From: bugtraq
• [SYSS-2016-049] QNAP QTS - Persistent Cross-Site Scripting
  • From: bugtraq
• [CVE-2016-6582] Doorkeeper gem does not revoke tokens & uses wrong auth/auth method
  • From: Justin Bull
• Horizontal Privilege Escalation/Code Injection in ownCloud’s Windows Client
  • From: Florian Bogner
• Path traversal vulnerability in WordPress Core Ajax handlers
  • From: Summer of Pwnage
• [security bulletin] HPSBNS03635 rev.1 - HPE NonStop Servers OSS Script Languages running Perl and PHP, Multiple Local and Remote Vulnerabilities
  • From: security-alert
• [slackware-security] gnupg (SSA:2016-236-01)
  • From: Slackware Security Team
• nullcon 8-bit Call for Papers is open
  • From: nullcon
• WebKitGTK+ Security Advisory WSA-2016-0005
  • From: Carlos Alberto Lopez Perez
• SEC Consult SA-20160825-0 :: Multiple vulnerabilities in Micro Focus (Novell) GroupWise
  • From: SEC Consult Vulnerability Lab
• APPLE-SA-2016-08-25-1 iOS 9.3.5
  • From: Apple Product Security
• [SECURITY] [DSA 3652-1] imagemagick security update
  • From: Moritz Muehlenhoff
• Necroscan <= v0.9.1 Buffer Overflow
  • From: hyp3rlinx
• [SECURITY] [DSA 3654-1] quagga security update
  • From: Sebastien Delafond
• Apple libc incomplete fix of Security Update for OS X El Capitan 10.11.2
  • From: submit
• [security bulletin] HPSBGN03638 rev.1 - HPE Remote Device Access: Virtual Customer Access System (vCAS) using lighttpd and OpenSSH, Unauthorized Modification of Information, Remote Denial of Service (DoS), Remote Disclosure of Information
  • From: security-alert
• [slackware-security] kernel (SSA:2016-242-01)
  • From: Slackware Security Team
• [security bulletin] HPSBHF03641 rev.1 - HPE Integrated Lights-Out 3 (iLO 3), Remote Disclosure of Information
  • From: security-alert
• [security bulletin] HPSBGN03637 rev.1 - HP Operations Manager for Unix, Solaris, and Linux, Remote Cross-Site Scripting (XSS)
  • From: security-alert