full-disclosure mailing list - 2014/01

Messages by day:

January 1 (13 messages)

• [SECURITY] [DSA 2831-1] puppet security update (Luciano Bello <luciano@...ian.org>)
• Re: Open phones for privacy/anonymity applications, Guardian (coderman <coderman@...il.com>)
• Re: Open phones for privacy/anonymity applications, Guardian (coderman <coderman@...il.com>)
• [SECURITY] [DSA 2832-1] memcached security update (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: Open phones for privacy/anonymity applications, Guardian (coderman <coderman@...il.com>)
• [SECURITY] [DSA 2833-1] openssl security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: [SECURITY] [DSA 2833-1] openssl security update (coderman <coderman@...il.com>)
• Tool Update: Bing-ip2hosts version 0.4 (Andrew Horton <andrew@...ningstarsecurity.com>)
• Targeted CSRF vulnerability on LinkedIn to delete posts [FIXED] (Bhavesh Naik <bhavesh_shouts@...oo.com>)
• Re: Open phones for privacy/anonymity applications, Guardian (Lodewijk andré de la porte <l@...wijk.nl>)
• [SECURITY] [DSA 2834-1] typo3-src security update (Salvatore Bonaccorso <carnil@...ian.org>)
• [CVE-2013-6480] Libcloud doesn't send scrub_data query parameter when destroying a DigitalOcean node (Tomaz Muraus <tomaz@...che.org>)
• DAVOSET v.1.1.5 ("MustLive" <mustlive@...security.com.ua>)

• Re: Securelist.com (Kaspersky) released a misleading information about Kelihos Botnet actual status (アドリアンヘンドリック <unixfreaxjp22@...il.co…)

• SCADA StrangeLove 30C3 releases: all in one (scadastrangelove <scadastrangelove@...il.com>)

• Re: SCADA StrangeLove 30C3 releases: all in one (coderman <coderman@...il.com>)
• "the Fairphone is fatally flawed for security" (Bernhard Kuemel <bernhard@...ys.at>)
• Re: "the Fairphone is fatally flawed for security" (coderman <coderman@...il.com>)
• [SECURITY] [DSA 2835-1] asterisk security update (Moritz Muehlenhoff <jmm@...ian.org>)

• [SECURITY] [DSA 2836-1] devscripts security update (Raphael Geissert <geissert@...ian.org>)
• Re: DoS vulnerability in Adobe Flash Player (BSOD) (sixtyvividtails <sixtyvividtails@...dex.com>)
• Re: Open phones for privacy/anonymity applications, Guardian (Anonymous <anonymous@...-polloi.org>)
• Re: Open phones for privacy/anonymity applications, Guardian (Bzzz <lazyvirus@....com>)

• [HITB-Announce] HITB Magazine Issue 10 Out Now (Hafez Kamal <aphesz@...kinthebox.org>)
• AusCERT2014 Call for Presentations and Tutorials (AusCERT <auscert@...cert.org.au>)
• Re: Open phones for privacy/anonymity applications, Guardian (Daniel Corbe <corbe@...be.net>)
• [SECURITY] [DSA 2837-1] openssl security update (Moritz Muehlenhoff <jmm@...ian.org>)
• [SECURITY] [DSA 2838-1] libxfont security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: FPU-state NULL-deref exploitation (was vm86 syscall kernel-panic and some more goodies waiting to be analyzed) (halfdog <me@...fdog.net>)

• Wordpress Plugin WP-Members Version 2.8.9 - Stored and reflected Cross-site Scripting vulnerabilities (Stefan Schurtz <sschurtz@...nline.de>)
• [SECURITY] [DSA 2839-1] spice security update (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: Where are you guys standing re: the (full) disclosure (Georgi Guninski <guninski@...inski.com>)
• [CVE-2014-1203] Eyou Mail System Remote Code Execution (conqu3r.zeng <conqu3r.zeng@...ppsecurity.com.cn>)
• [Wooyun] NVIDIA a SAP NETWEAVER remote command execution ("En.wooyun.org" <help.en@...yun.org>)
• [Wooyun] OVH a subsite Zabbix Sql injection ("En.wooyun.org" <help.en@...yun.org>)
• [Security-news] SA-CONTRIB-2014-001 - Entity API - Access Bypass (security-news@...pal.org)
• [Security-news] PSA-2014-001 - Media - Access Bypass (security-news@...pal.org)

• Re: [Wooyun] OVH a subsite Zabbix Sql injection (thomas.soete@....net)
• Security is fun(ny) again ("J. Oquendo" <sil@...iltrated.net>)
• Re: Security is fun(ny) again (illwill <illwill@...mob.org>)

• nullcon Blackshield Awards 2014 (nullcon <nullcon@...lcon.net>)
• [CVE -2014-1201] Lorex security DVD ActiveX control buffer overflow (Pedro Ribeiro <pedrib@...il.com>)
• Re: [CVE -2014-1201] Lorex security DVD ActiveX control buffer overflow (Pedro Ribeiro <pedrib@...il.com>)
• ObamaCare California Admin Interface Exposed to Entire Internet + more! (Whitehat Whistleblower <whitehat.whistleblower@...il.com>)
• Re: Where are you guys standing re: the (full) disclosure (Pedro Luis Karrasquillo <peter_toyota@...mail.com>)
• [SECURITY] [DSA 2840-1] srtp security update (Salvatore Bonaccorso <carnil@...ian.org>)
• Cisco Security Advisory: Undocumented Test Interface in Cisco Small Business Devices (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)

• Dates for the opening of registration for Rooted CON 2014 (Omar Benbouazza <bvomar@...il.com>)
• Updated [CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall rules allowing additional access (David Nalley <ke4qqq@...che.org>)
• Updated [CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users (David Nalley <ke4qqq@...che.org>)
• [SECURITY] [DSA 2841-1] movabletype-opensource security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Yahoo Bug Bounty Program Vulnerability #2 Open Redirect (Stefan Schurtz <sschurtz@...nline.de>)

• Sex links fail (Marshall Whittaker <marshallwhittaker@...il.com>)
• BlackArch Linux (BlackArch Linux <blackarchlinux@...il.com>)
• Re: Yahoo Bug Bounty Program Vulnerability #2 Open Redirect ("Kenneth F. Belva" <full-disclosure@...verbackventuresllc.com>)
• Re: ObamaCare California Admin Interface Exposed to Entire Internet + more! (Pedro Luis Karrasquillo <peter_toyota@...mail.com>)
• Re: Yahoo Bug Bounty Program Vulnerability #2 Open Redirect (Stefan Schurtz <sschurtz@...nline.de>)
• [ MDVSA-2014:001 ] kernel (security@...driva.com)
• List Charter (John Cartwright <johnc@...k.org.uk>)
• [SECURITY] [DSA 2842-1] libspring-java security update (Moritz Muehlenhoff <jmm@...ian.org>)
• Microsoft Twitter accounts, blog hijacked by SEA (Georgi Guninski <guninski@...inski.com>)
• [SECURITY] [DSA 2843-1] graphviz security update (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: Microsoft Twitter accounts, blog hijacked by SEA (Mohammad Hosein <mhtajik@...il.com>)

• Rooted CON 2014 attendee registration is open! (Omar Benbouazza <bvomar@...il.com>)
• [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application (Daniel Wood <daniel.wood@...sp.org>)
• Ubuntu, duckduckgo, and additional info (silence_is_best@...hmail.com)

• Re: Ubuntu, duckduckgo, and additional info (Seth Arnold <seth.arnold@...onical.com>)
• Re: Ubuntu, duckduckgo, and additional info (Daniel Wood <daniel.wood@...sp.org>)
• CVE-2013-6429 Fix for XML External Entity (XXE) injection (CVE-2013-4152) in Spring Framework was incomplete (Pivotal Security Team <security@...ivotal.com>)
• CVE-2013-6430 Possible XSS when using Spring MVC (Pivotal Security Team <security@...ivotal.com>)
• Re: Ubuntu, duckduckgo, and additional info (Gabriel Weinberg <yegg@...kduckgo.com>)
• Re: Ubuntu, duckduckgo, and additional info (silence_is_best@...hmail.com)
• Collabtive Sql Injection (YOGESH PHADTARE <yog4567@...il.com>)
• [SECURITY] [DSA 2844-1] djvulibre security update (Raphael Geissert <geissert@...ian.org>)
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Access Control System (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
• Re: Ubuntu, duckduckgo, and additional info (silence_is_best@...hmail.com)
• [Security-news] SA-CORE-2014-001 - Drupal core - Multiple vulnerabilities (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS) (security-news@...pal.org)
• Re: Ubuntu, duckduckgo, and additional info (Seth Arnold <seth.arnold@...onical.com>)
• Re: Ubuntu, duckduckgo, and additional info (Jordon Bedwell <envygeeks@...il.com>)
• EE BrightBox router hacked - bares all if you ask nicely (Scott Helme <scotthelme@...mail.com>)

• Re: EE BrightBox router hacked - bares all if you ask nicely (Dan Ballance <tzewang.dorje@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Źmicier Januszkiewicz <gauri@....by>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (gold flake <ptinstructor@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Źmicier Januszkiewicz <gauri@....by>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Dan Ballance <tzewang.dorje@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Źmicier Januszkiewicz <gauri@....by>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Dan Ballance <tzewang.dorje@...il.com>)
• [HITB-Announce] #HITB2014AMS Call for Papers - FINAL CALL (Hafez Kamal <aphesz@...kinthebox.org>)
• : EE BrightBox router hacked - bares all if you ask nicely ("Mikhail A. Utin" <mutin@...monwealthcare.org>)
• [ MDVSA-2014:002 ] bind (security@...driva.com)
• [ MDVSA-2014:003 ] nrpe (security@...driva.com)
• [ MDVSA-2014:004 ] nagios (security@...driva.com)
• [ MDVSA-2014:005 ] ejabberd (security@...driva.com)
• [ MDVSA-2014:006 ] libxslt (security@...driva.com)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Valdis.Kletnieks@...edu)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Dan Ballance <tzewang.dorje@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Valdis.Kletnieks@...edu)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Dan Ballance <tzewang.dorje@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Jeffrey Walton <noloader@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Dan Ballance <tzewang.dorje@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Jeffrey Walton <noloader@...il.com>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Tracy Reed <treed@...raviolet.org>)
• [CVE-2013-6838] Enghouse Interactive IVR Pro (VIP2000) remote root authentication bypass Vulnerability (Fredrik Söderblom <security-alert@....se>)
• Re: EE BrightBox router hacked - bares all if you ask nicely (Daniël W. Crompton <daniel.crompton@...il.com>)

• NEW : VMSA-2014-0001 - VMware Workstation, Player, Fusion, ESXi, ESX and vCloud Director address several security issue… ("\"VMware Security Response Center\"" <…)
• Romanian hacker unknown string (Asheesh Tripathi <informationhacker08@...il.com>)
• Re: Romanian hacker unknown string (James Condron <james@...o-internet.org.uk>)
• Re: Romanian hacker unknown string (Asheesh Tripathi <informationhacker08@...il.com>)
• Re: Romanian hacker unknown string (James Condron <james@...o-internet.org.uk>)
• Re: Romanian hacker unknown string (Asheesh Tripathi <informationhacker08@...il.com>)
• Re: Romanian hacker unknown string (Henri Salo <henri@...v.fi>)
• Re: Romanian hacker unknown string (James Condron <james@...o-internet.org.uk>)
• Re: Romanian hacker unknown string (Asheesh Tripathi <informationhacker08@...il.com>)
• Re: Romanian hacker unknown string (James Condron <james@...o-internet.org.uk>)
• [ MDVSA-2014:007 ] openssl (security@...driva.com)
• [ MDVSA-2014:008 ] openjpeg (security@...driva.com)
• [ MDVSA-2014:009 ] librsvg (security@...driva.com)
• [ MDVSA-2014:010 ] memcached (security@...driva.com)
• [SECURITY] [DSA 2845-1] mysql-5.1 security update (Moritz Muehlenhoff <jmm@...ian.org>)
• [SECURITY] [DSA 2831-2] puppet regression update (Salvatore Bonaccorso <carnil@...ian.org>)
• SI6 Networks' IPv6 Toolkit v1.5.2 released! (Fernando Gont <fgont@...networks.com>)
• [SECURITY] [DSA 2846-1] libvirt security update (Moritz Muehlenhoff <jmm@...ian.org>)

• Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application (Daniel Wood <daniel.wood@...sp.org>)
• Ubuntu, duckduckgo, and additional info (Patrick O'Keeffe <seclists-fulldisclosure@...eeffe.net>)

• Multiple vulnerabilities at president.gov.ua ("MustLive" <mustlive@...security.com.ua>)

• Hackito Ergo Sum 2014 CFP (Alexandre De Oliveira <alex@...ec.com>)
• [ MDVSA-2014:011 ] java-1.7.0-openjdk (security@...driva.com)
• [ MDVSA-2014:012 ] nss (security@...driva.com)
• [SECURITY] [DSA 2847-1] drupal7 security update (Salvatore Bonaccorso <carnil@...ian.org>)

• 0day - MuPDF Stack-based Buffer Overflow in xps_parse_color() (Jean-Jamil Khalifé <jean@...sec.fr>)
• TWSL2014-001: Multiple Vulnerabilities in Franklin Fueling's TS-550 evo (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
• TWSL2014-002: Buffer Overflow Vulnerability in DaumGame ActiveX (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
• [ MDVSA-2014:013 ] libxfont (security@...driva.com)
• [ MDVSA-2014:014 ] php (security@...driva.com)

• DDoS against Gamerfirst (dave <mrx@...pergander.org.uk>)
• 22 January 2014, SEA : M$ = 3 : 0 (Georgi Guninski <guninski@...inski.com>)
• [CVE-2013-6040] MW6 Technologies ActiveX buffer overflows and remote code execution (Pedro Ribeiro <pedrib@...il.com>)
• Chrome (and Safari) antiXSS filter bypass ("vulns@...aths.com" <vulns@...aths.com>)
• Capstone 2.0 is released! (Nguyen Anh Quynh <aquynh@...il.com>)
• SEC Consult SA-20140122-0 :: Critical vulnerabilities in T-Mobile HOME NET Router LTE (Huawei B593u-12) (SEC Consult Vulnerability Lab <research@...-consult.co…)
• [ MDVSA-2014:015 ] cups (security@...driva.com)
• [ MDVSA-2014:016 ] spice (security@...driva.com)
• [ MDVSA-2014:017 ] net-snmp (security@...driva.com)
• [ MDVSA-2014:018 ] net-snmp (security@...driva.com)
• [ MDVSA-2014:019 ] elinks (security@...driva.com)
• Cisco Security Advisory: Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psir…)
• Cisco Security Advisory: Cisco TelePresence Video Communication Server SIP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Te…)
• Cisco Security Advisory: Cisco TelePresence System Software Command Execution Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co…)
• [ MDVSA-2014:020 ] x11-server (security@...driva.com)
• [Security-news] SA-CONTRIB-2014-003 - Doubleclick for Publishers DFP - Cross Site Scripting (XSS) (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2014-004 - Secure Cookie Data - Faulty Hashing (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2014-005 - Leaflet - Access bypass (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2014-006 - Language Switcher Dropdown - Open Redirect (security-news@...pal.org)

• [SECURITY] [DSA 2848-1] mysql-5.5 security update (Salvatore Bonaccorso <carnil@...ian.org>)

• How a teenager helpfully reported a government security flaw – and could be charged in return ("Ivan .Heca" <ivanhec@...il.com>)
• [CTF] nullcon HackIM 2014 will start at 24-01-2014, when the clock will strike at 11:59 (+5:30 GMT) (nullcon <nullcon@...lcon.net>)
• Fwd: Trustlook discovered Microsoft’s first high risk Android Vulnerability (Raymond Zhang <bugfree@...il.com>)
• Contact PSIRT Fortinet (William Costa <william.costa@...il.com>)
• Remote Command Injection Vulnerability in SkyBlueCanvas CMS (Scott Parish <Scott.Parish@...ecurity.org>)
• [SECURITY] [DSA 2826-2] denyhosts regression update (Yves-Alexis Perez <corsac@...ian.org>)
• CALL FOR PAPERS - NUIT DU HACK - 28/29 JUNE 2014 (freeman <freeman@...kerzvoice.net>)
• [CVE-2013-6030]Emerson Network Power Avocent MergePoint Unity 2016 KVM switches contain a directory traversal vulnerab… (shady.liu <shady.liu@...ppsecurity.com.…)
• Healthcare.gov noise (truthinallthings@...hmail.me)
• Re: Chrome (and Safari) antiXSS filter bypass (Pedro Worcel <pedro@...cel.com>)
• [CVE-2013-6235] - Multiple Reflected XSS vulnerabilities in JAMon v2.7 (Christian Catalano <ch.catalano@...il.com>)
• ADV: IBM QRadar SIEM (Thomas Pollet <thomas.pollet@...il.com>)
• DAVOSET v.1.1.6 ("MustLive" <mustlive@...security.com.ua>)
• [ MDVSA-2014:021 ] perl-Proc-Daemon (security@...driva.com)
• [ MDVSA-2014:022 ] augeas (security@...driva.com)
• [ MDVSA-2014:023 ] hplip (security@...driva.com)
• [ MDVSA-2014:024 ] graphviz (security@...driva.com)
• Dictatorial laws in Ukraine ("MustLive" <mustlive@...security.com.ua>)

• ssl.bing.com - Cross-site Scripting vulnerability (Stefan Schurtz <sschurtz@...nline.de>)
• Re: RFP: FOIA with privacy waivers[0] for oversight (coderman <coderman@...il.com>)

• Making waves on Twitter! (David Kennedy <davek@...bycon.com>)
• Satellite Security - A story NASA would love to see. ("Nicholas Lemonias." <lem.nikolas@...glemail.com>)

• Re: Making waves on Twitter! (Brandon Perry <bperry.volatile@...il.com>)
• Re: Making waves on Twitter! (David Kennedy <davek@...bycon.com>)
• Re: Making waves on Twitter! (Brandon Perry <bperry.volatile@...il.com>)
• Re: Making waves on Twitter! (David Kennedy <davek@...bycon.com>)
• DC4420 - London DEFCON - January meet - Tuesday 28th January 2014 (Major Malfunction <majormal@...ate-radio.org>)
• Mozilla Bug Bounty #5 - WireTap Remote Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
• RVAsec 2014 CFP (Sullo <csullo@...il.com>)
• Sentinel beta version released ("Nicolas A. Economou" <neconomou@...esecurity.com>)
• [CVE-2014-1673] Check Point Session Authentication Agent vulnerability (Jakub Jozwiak <jozwiack@...il.com>)

• Oracle Reports Exploit - Remote Shell/Dump Passwords ("NI @root" <security@...infiltration.com>)
• pfSense 2.1 Privilege Escalation from less privileged users (LFI/RCE) (Pichaya Morimoto <pichaya@...e.org>)

• SimplyShare v1.4 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
• [Security-news] SA-CONTRIB-2014-007 - Services - Multiple access bypass vulnerabilities (security-news@...pal.org)
• [Security-news] SA-CONTRIB-2014-008 - Tribune - Cross Site Scripting (XSS) (security-news@...pal.org)

• [SECURITY] [DSA 2849-1] curl security update (Florian Weimer <fw@...eb.enyo.de>)
• [SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service (Security Explorations <contact@...urity-explorations.com>)
• [SECURITY] [DSA 2850-1] libyaml security update (Salvatore Bonaccorso <carnil@...ian.org>)

194 messages

Powered by blists - more mailing lists