full-disclosure mailing list - 2015/03

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 18	³ 3	⁴ 1	⁵ 9	⁶ 3	⁷ 13	⁸
⁹ 4	¹⁰ 10	¹¹ 5	¹² 11	¹³	¹⁴	¹⁵
¹⁶ 21	¹⁷ 1	¹⁸ 21	¹⁹ 17	²⁰ 5	²¹	²² 5
²³ 2	²⁴ 1	²⁵ 4	²⁶ 2	²⁷	²⁸ 3	²⁹
³⁰ 5	³¹ 1

Messages by day:

March 2 (18 messages)

[FD] Cross-Site-Scripting (XSS) in tcllib's html::textarea (Ben Fuhrmannek <ben@...tioneins.de>)
[FD] Piwik Downloads Updates over HTTP (Taylor Hornby <havoc@...use.ca>)
[FD] Comsenz SupeSite CMS Reflected XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Comsenz SupeSite CMS Arbitrary Code Execution Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] NetCat CMS Multiple Remote File Inclusion (RFI) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] NetCat CMS Full Path Disclosure (Information Disclosure) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] NetCat CMS Multiple URL Redirection (Open Redirect) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] XSS Reflected vulnerabilities in Fortimail version 5.2.1 (CVE-2014-8617) (William Costa <william.costa@...il.com>)
Re: [FD] Reflected File Download in AOL Search Website (Ricardo Iramar dos Santos <riramar@...il.com>)
[FD] upstart logrotate privilege escalation in Ubuntu Vivid (development) (halfdog <me@...fdog.net>)
[FD] 0x08 SEC-T 2015: Call For Papers annoucement (Matt <mattias.baath@...-t.org>)
[FD] D-Link and TRENDnet 'ncc2' service - multiple vulnerabilities (Peter Adkins <peter.adkins@...nelpicnic.net>)
[FD] GDS Labs Alert [CVE-2015-2080] - JetLeak Vulnerability: Remote Leakage Of Shared Buffers In Jetty Web Server (Ron Gutierrez <rgutierrez@...security.com>)
[FD] Tor Browser 4.0.3 with websockets enabled by default? (Pablo <paa.listas@...il.com>)
[FD] Vulnerabilities in Hikvision DS-7204HWI-SH ("MustLive" <mustlive@...security.com.ua>)
[FD] CVE-2015-1187: D-Link DIR-636L Remote Command Injection - Incorrect Authentication (<csirt@...sscom.com>)
[FD] Slim Framework - (CVE-2015-2171, PHP Object Injection), Other Vulnerabilities (Scott Arciszewski <scott@...iszewski.me>)
[FD] RV4sec 2015 CFP Open! (Sullo <sullo@...t.net>)

March 3 (3 messages)

[FD] Multiple SQL injections in core Orion service affecting many Solarwinds products (CVE-2014-9566) (Brandon Perry <bperry.volatile@...il.com>)
[FD] PHPMoAdmin Unauthorized Remote Code Execution (0-Day) (Pichaya Morimoto <pichaya@...e.org>)
[FD] [Call for Papers] SOURCE Boston (May 27/28) (Squirrel Herder Productions <Squirrelherderproductions@...il.com>)

March 4 (1 message)

[FD] CSRF in Contact Form DB allows attacker to delete all stored form submissions (WordPress plugin) (dxw Security <security@....com>)

March 5 (9 messages)

[FD] Partial pointer leaks (Christophe Hauser <christophe@...ucsb.edu>)
[FD] WordPress Newsletter Plug-in URL Redirection (Open Redirect) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] WordPress "Max Banner Ads" Plug-in XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Webshop hun v1.062S XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Webshop hun v1.062S Directory Traversal Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Webshop hun v1.062S SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Java 8u40 released: why? (paul.szabo@...ney.edu.au)
Re: [FD] Java 8u40 released: why? (Gsunde Orangen <gsunde.orangen@...il.com>)
[FD] ProjectSend r561 - SQL injection vulnerability ("ITAS Team" <itas.team@...s.vn>)

March 6 (3 messages)

Re: [FD] Partial pointer leaks (Robert Święcki <robert@...ecki.net>)
Re: [FD] Java 8u40 released: why? (Guy Dawson <g.dawson@...ssflight.com>)
Re: [FD] Java 8u40 released: why? (paul.szabo@...ney.edu.au)

March 7 (13 messages)

[FD] WordPress Daily Edition Theme v1.6.2 SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] WordPress Daily Edition Theme v1.6.2 Unrestricted Upload of File Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] NetCat CMS Multiple HTTP Response Splitting (CRLF) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] NetCat CMS Multiple XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Webshop hun v1.062S Information Leakage (Full Path Disclosure - FPD) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Fw: Vulnerabilities in ASUS RT-G32 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] Java 8u40 released: why? (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: [FD] Java 8u40 released: why? (Alexander Burke <alex@...xburke.ca>)
Re: [FD] Java 8u40 released: why? (James Hodgkinson <yaleman@...etek.net>)
Re: [FD] Java 8u40 released: why? (paul.szabo@...ney.edu.au)
Re: [FD] Java 8u40 released: why? (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: [FD] Partial pointer leaks (Christophe Hauser <christophe@...ucsb.edu>)
Re: [FD] Java 8u40 released: why? ("Nick FitzGerald" <nick@...us-l.demon.co.uk>)

March 9 (4 messages)

[FD] Multiple vulnerabilities in Untangle NGFW 9-11 (Hutton <c.e.hutton@...mail.com>)
[FD] OpenKM Platform Remote Reflected Cross Site Scripting ("Mohamed A. Baset" <symbian2010@...il.com>)
[FD] MikroTik RouterOS Admin Password Change CSRF ("Mohamed A. Baset" <symbian2010@...il.com>)
Re: [FD] Partial pointer leaks (Gil Besso <gil.besso@...security.com>)

March 10 (10 messages)

[FD] [CVE Identifier Updated] OpenKM Platform Remote Reflected Cross Site Scripting ("Mohamed A. Baset" <symbian2010@...il.com>)
[FD] Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response. (Marek Kroemeke <kroemeke@...il.com>)
Re: [FD] Java 8u40 released: why? (James Hodgkinson <yaleman@...etek.net>)
Re: [FD] Java 8u40 released: why? (Dave Warren <davew@...eahit.com>)
[FD] SuperWebMailer 5.50.0.01160 XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] WordPress Daily Edition Theme v1.6.2 XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] WordPress Daily Edition Theme v1.6.2 Information Leakage Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Vastal I-tech phpVID 1.2.3 SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Vastal I-tech phpVID 1.2.3 Multiple XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] [CORE-2015-0005] - Windows Pass-Through Authentication Methods Improper Validation (CORE Advisories Team <advisories@...esecurity.com>)

March 11 (5 messages)

[FD] Vulnerability in the Dropbox SDK for Android (CVE-2014-8889) (Roee Hay <roeeh@...ibm.com>)
[FD] Capstone disassembly engine 3.0.2 is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] [CVE-2015-1474]Integer overflow leading to heap corruption while unflattening GraphicBuffer (Guang Gong <higongguang@...il.com>)
[FD] [CVE-2015-1530]An integer overflow in Android media could be exploited to get media_server permission (Guang Gong <higongguang@...il.com>)
[FD] Community Gallery - Srored Corss-Site Scripting vulnerability ("ITAS Team" <itas.team@...s.vn>)

March 12 (11 messages)

[FD] Raritan PowerIQ known session secret (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] [CVE-2015-1530]An integer overflow in Android media could be exploited to get media_server permission (Guang Gong <higongguang@...il.com>)
Re: [FD] [CVE-2015-1474]Integer overflow leading to heap corruption while unflattening GraphicBuffer (Guang Gong <higongguang@...il.com>)
[FD] Vulnerabilities in the Samsung SNS Provider application for Android [STIC-2015-0511] (Programa STIC <stic@...dacionsadosky.org.ar>)
[FD] MSA-2015-03: iPass Mobile Client Service Local Privilege Escalation (Advisories <advisories@...waisecurity.de>)
[FD] WPML WordPress plug-in SQL injection etc. (Jouko Pynnonen <jouko@....fi>)
[FD] 'Rowhammer' - Software-triggered DRAM corruption (Nick Boyce <nick.boyce@...il.com>)
[FD] WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection (Ryan Dewhurst <ryandewhurst@...il.com>)
Re: [FD] MSA-2015-03: iPass Mobile Client Service Local Privilege Escalation (Advisories <advisories@...waisecurity.de>)
[FD] Alkacon OpenCms 9.5.1 Multiple XSS Vulnerabilities (Rehan Ahmed <knight_rehan@...mail.com>)
Re: [FD] 'Rowhammer' - Software-triggered DRAM corruption (Aris Adamantiadis <aris@...code.be>)

March 16 (21 messages)

[FD] [SE-2014-02] Google App Engine Java security sandbox bypasses (details) (Security Explorations <contact@...urity-explorations.com>)
Re: [FD] 'Rowhammer' - Software-triggered DRAM corruption (fulldisclosure <fulldisclosure@...lution-hosting.eu>)
Re: [FD] WPML WordPress plug-in SQL injection etc. (Jouko Pynnonen <jouko@....fi>)
[FD] Innovative WebPAC Pro 2.0 Unvalidated Redirects and Forwards (URL Redirection) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Comsenz SupeSite 7.0 CMS SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] 724CMS 5.01 Multiple Information Leakage Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] 724CMS 5.01 Directory (Path) Traversal Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] 724CMS 5.01 Multiple SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] 724CMS 5.01 Multiple XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Multiple Buffer Overflows in .NetFramework v4.03 - Win 8.0 Pro - x64 (Nick Prowse <nick_prowse34@...oo.co.uk>)
[FD] Multiple Buffer Overflows in Diagnostic Troubleshooting Wizard - msdt.exe - Win 8.0 Pro - x64 (Nick Prowse <nick_prowse34@...oo.co.uk>)
[FD] Having fun with dmesg (halfdog <me@...fdog.net>)
[FD] Defense in depth -- the Mozilla way: return and exit codes are dispensable ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Defense in depth -- the Microsoft way (part 30): on exploitable Win32 functions ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Defense in depth -- the Microsoft way (part 31): UAC is for binary planting ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Jolla Phone tel URI Spoofing (NSO Research <nso-research@...iriu.de>)
[FD] Metasploit Project initial User Creation CSRF ("Mohamed A. Baset" <symbian2010@...il.com>)
[FD] Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution (Onur Alanbel <onur.a@...dowslive.com>)
Re: [FD] 'Rowhammer' - Software-triggered DRAM corruption (Nick Boyce <nick.boyce@...il.com>)
[FD] A local application could cause a denial-of-service to the audio_policy app in Android (Guang Gong <higongguang@...il.com>)
Re: [FD] 'Rowhammer' - Software-triggered DRAM corruption (Dirk-Willem van Gulik <dirkx@...weaving.org>)

March 17 (1 message)

[FD] D-RamPage: POC for zero-risk row-hammer exploitation (halfdog <me@...fdog.net>)

March 18 (21 messages)

[FD] Upcoming new OpenSSL version with "high severity" security issues (Patrik Kernstock <info@...rn.at>)
Re: [FD] Multiple Buffer Overflows in Diagnostic Troubleshooting Wizard - msdt.exe - Win 8.0 Pro - x64 (jericho <jericho@...rition.org>)
[FD] Regarding how can I request a CVE number? (XiaopengZhang <tfrist@...h.net>)
[FD] Websense Data Security DLP incident Forensics Preview is vulnerable to Cross-Site Scripting ("Securify B.V." <lists@...urify.nl>)
[FD] Websense Email Security vulnerable to persistent Cross-Site Scripting in audit log details view ("Securify B.V." <lists@...urify.nl>)
[FD] Command injection vulnerability in network diagnostics tool of Websense Appliance Manager ("Securify B.V." <lists@...urify.nl>)
[FD] Source code disclosure of Websense Triton JSP files via double quote character ("Securify B.V." <lists@...urify.nl>)
[FD] Missing access control on Websense Explorer web folder ("Securify B.V." <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Websense Data Security block page ("Securify B.V." <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Websense Explorer report scheduler ("Securify B.V." <lists@...urify.nl>)
[FD] Multiple Cross-Site Scripting vulnerabilities in Websense Reporting ("Securify B.V." <lists@...urify.nl>)
[FD] Error messages of Websense Content Gateway are vulnerable to Cross-Site Scripting ("Securify B.V." <lists@...urify.nl>)
[FD] [CORE-2015-0006] - Fortinet Single Sign On Stack Overflow (CORE Advisories Team <advisories@...esecurity.com>)
[FD] EMC M&R (Watch4net) data storage collector credentials are not properly protected ("Securify B.V." <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in EMC M&R (Watch4net) Web Portal Report Favorites ("Securify B.V." <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in EMC M&R (Watch4net) Centralized Management Console ("Securify B.V." <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in EMC M&R (Watch4net) Alerting Frontend ("Securify B.V." <lists@...urify.nl>)
[FD] Path traversal vulnerability in EMC M&R (Watch4net) MIB Browser ("Securify B.V." <lists@...urify.nl>)
[FD] Path traversal vulnerability in EMC M&R (Watch4net) Device Discovery ("Securify B.V." <lists@...urify.nl>)
[FD] Command injection vulnerability in EMC Secure Remote Services Virtual Edition ("Securify B.V." <lists@...urify.nl>)
[FD] EMC Secure Remote Services Virtual Edition Provisioning component is affected by SQL injection ("Securify B.V." <lists@...urify.nl>)

March 19 (17 messages)

[FD] Mac OS X 10.10.2 IOHIDFamily.kext IOHIDSecurePromptClient Heap Overflow (info@...rtyoruiop.com)
[FD] Mac OS X 10.10.2 Default KEXT heap overflow LPE ("Luca Todesco" <info@...rtyoruiop.com>)
[FD] Mac OS X 10.10.2 kernel extension heap overflow resulting in LPE (Luca Todesco <info@...rtyoruiop.com>)
Re: [FD] Regarding how can I request a CVE number? (James Hooker <seidrhrafn@...glemail.com>)
[FD] Web-Dorado ECommerce-WD for Joomla plugin multiple unauthenticated SQL injections (Brandon Perry <bperry.volatile@...il.com>)
[FD] Chamilo LMS 1.9.10 Multiple XSS & CSRF Vulnerabilities (Rehan Ahmed <knight_rehan@...mail.com>)
[FD] Citrix Command Center allows downloading of configuration files ("Securify B.V." <lists@...urify.nl>)
[FD] Advent JMX Servlet of Citrx Command Center is accessible to unauthenticated users ("Securify B.V." <lists@...urify.nl>)
[FD] Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting ("Securify B.V." <lists@...urify.nl>)
[FD] Command injection vulnerability in Citrix NITRO SDK xen_hotfix page ("Securify B.V." <lists@...urify.nl>)
[FD] Citrix NetScaler VPX help pages are vulnerable to Cross-Site Scripting ("Securify B.V." <lists@...urify.nl>)
[FD] cve-assign delays ("Steven M. Christey" <coley@...re.org>)
Re: [FD] Regarding how can I request a CVE number? (Daniel Wood <daniel.wood@...sp.org>)
Re: [FD] Regarding how can I request a CVE number? (Peter Adkins <peter.adkins@...nelpicnic.net>)
Re: [FD] Regarding how can I request a CVE number? (Nick Boyce <nick.boyce@...il.com>)
[FD] [CFP] BSides Las Vegas August 2015 (BSidesLV Info <info@...deslv.org>)
[FD] Google Analytics by Yoast stored XSS (Jouko Pynnonen <jouko@....fi>)

March 20 (5 messages)

[FD] Viber for Android exposes insecure Javascript interface ("Securify B.V." <lists@...urify.nl>)
[FD] Type Confusion Infoleak Vulnerabilities in SoapClient (Taoguang Chen <taoguangchen@...il.com>)
[FD] Type Confusion Vulnerability in SoapClient (Taoguang Chen <taoguangchen@...il.com>)
[FD] Use After Free Vulnerability in unserialize() with DateInterval (Taoguang Chen <taoguangchen@...il.com>)
[FD] Use After Free Vulnerability in unserialize() (Taoguang Chen <taoguangchen@...il.com>)

March 22 (5 messages)

[FD] [CVE-2015-0250] Apache Batik Information Disclosure Vulnerability (XXE Injection) (Kevin Schaller <kschaller@...w.de>)
Re: [FD] D-RamPage: POC for zero-risk row-hammer exploitation (halfdog <me@...fdog.net>)
[FD] The Palinopsia Bug: Recovering framebuffers from VRAM (Bastian <Reitemei@...dents.uni-marburg.de>)
[FD] Multiple reflecting/stored XSS- and SQLi-vulnerabilities in openEMR v.4.2.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Cisco Unified Computing System Manager (UCSM) username and password hashes sent via SYSLOG ("tom@...edcode.net" <tom@...edcode.net>)

March 23 (2 messages)

[FD] CVE-2011-2461 is back! (Mauro Gentile <gentile.mauro.mg@...il.com>)
[FD] Wall of Sheep Speaker Workshops at DEF CON 23 CFP Now Open (Ming <ming@...lofsheep.com>)

March 24 (1 message)

[FD] Windows Local WebDAV NTLM Reflection Elevation of Privilege (James Forshaw <forshaw@...gle.com>)

March 25 (4 messages)

[FD] WAHCKon[2] - Perth - May 2nd and 3rd 2015 ("WAHCKon CFP" <cfp@...ckon.org.au>)
[FD] Announcing NorthSec 2015 - Montreal, May 21-24 (Pierre-David / NorthSec Conference <conference@...c.io>)
[FD] CSRF in Realms Wiki (Javantea <jvoss@...sci.com>)
[FD] Remote Code Execution in Realms Wiki install.sh (Javantea <jvoss@...sci.com>)

March 26 (2 messages)

[FD] 1501H - MSIE 8 - F12 Developer Tools tooltips use-after-free (Berend-Jan Wever <berendjanwever@...il.com>)
[FD] Insecure file upload in Berta CMS (Simon Waters <simon.waters@...evine.com>)

March 28 (3 messages)

[FD] (0DAY) WebDepo -SQL injection / INURL BRASIL (INURL Brasil <inurlbr@...il.com>)
[FD] Advisory: CVE-2014-9707: GoAhead Web Server 3.0.0 - 3.4.1 (Matthew Daley <mattd@...fuzz.com>)
[FD] Advisory: CVE-2014-9708: Appweb Web Server (Matthew Daley <mattd@...fuzz.com>)

March 30 (5 messages)

[FD] [CORE-2015-0007] - Schneider Vampset Stack and Heap Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Stack overflow in libtasn1 (Hanno Böck <hanno@...eck.de>)
[FD] Vulnerabilities in multiple Hikvision IP cameras and DVR ("MustLive" <mustlive@...security.com.ua>)
[FD] New BlackArch Linux ISOs & installer (Black Arch <blackarchlinux@...il.com>)
Re: [FD] CVE-2011-2461 is back! (Mauro Gentile <gentile.mauro.mg@...il.com>)

March 31 (1 message)

[FD] mDNS VU#550620 (dirt diggler <the.real.d1rt.diggler@...il.com>)

165 messages

Powered by blists - more mailing lists