full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
²	³ 10	⁴ 6	⁵ 1	⁶ 16	⁷ 3	⁸
⁹ 5	¹⁰ 4	¹¹	¹²	¹³	¹⁴ 24	¹⁵
¹⁶ 2	¹⁷ 10	¹⁸ 1	¹⁹ 5	²⁰	²¹	²²
²³	²⁴ 1	²⁵ 11	²⁶	²⁷ 4	²⁸ 3	²⁹
³⁰ 5

Messages by day:

November 3 (10 messages)

[FD] Unauthenticated remote command execution on Cisco Linksys x2000 routers (Lorenzo Pistone <blaffablaffa@...il.com>)
[FD] SQL Buddy 1.3.3: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] SQL Buddy 1.3.3: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Chyrp CMS 2.5.2: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] CVE-2015-6498 (<csirt@...sscom.com>)
[FD] Cross-Site Scripting | Zeuscart V4 ("ITAS Team" <itas.team@...s.vn>)
[FD] TeleGraph All Photo (Picture) Pages Have Been Vulnerable to XSS Cyber Attacks (Jing Wang <justqdjing@...il.com>)
[FD] Daily Mail Registration Page Unvalidated Redirects and Forwards & XSS Web Security Problem (Jing Wang <justqdjing@...il.com>)
[FD] DAVOSET v.1.2.6 ("MustLive" <mustlive@...security.com.ua>)
[FD] Winehat Security Conference (Lorenzo Primiterra <lorenzoprimiterra@...il.com>)

November 4 (6 messages)

[FD] [KIS-2015-05] ATutor <= 2.2 (Custom Course Icon) Unrestricted File Upload Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2015-06] ATutor <= 2.2 (confirm.php) Session Variable Overloading Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2015-07] ATutor <= 2.2 (popuphelp.php) Reflected Cross-Site Scripting Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2015-08] ATutor <= 2.2 (edit_marks.php) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2015-09] Piwik <= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2015-10] Piwik <= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

November 5 (1 message)

[FD] SEC Consult SA-20151105-0 :: Insecure default configuration in Ubiquiti Networks products (SEC Consult Vulnerability Lab <research@...-consult.com>)

November 6 (16 messages)

[FD] New release: UFONet v0.6 - "Galactic OFFensive!" (psy <epsylon@...eup.net>)
Re: [FD] eBay Magento <= 1.9.2.1 XML eXternal Entity Injection (XXE) on PHP FPM (Dawid Golunski <dawid@...alhackers.com>)
[FD] MiniBB 3.1.1: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] MyWebSQL 3.6: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] OpenCart 2.0.3.1: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Supercali Event Calendar 1.0.8: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Supercali Event Calendar 1.0.8: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] CubeCart 6.0.7: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] CubeCart 6.0.7: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Quick.Cart 6.6: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Quick.Cart 6.6: Multiple XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] TheHostingTool 1.2.6: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] TheHostingTool 1.2.6: Multiple SQL Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] TheHostingTool 1.2.6: Multiple XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] SQLiteManager 1.2.4: Multiple XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] First annual BloomCON CFP (Philip Polstra <ppolstra@...il.com>)

November 7 (3 messages)

[FD] Broken, Abandoned, and Forgotten Code, Part 14 (Zach Cutlip <uid000@...il.com>)
[FD] Google AdWords API PHP client library <= 6.2.0 Arbitrary PHP Code Execution (Dawid Golunski <dawid@...alhackers.com>)
[FD] Google AdWords API client libraries - XML eXternal Entity Injection (XXE) (Dawid Golunski <dawid@...alhackers.com>)

November 9 (5 messages)

[FD] [Onapsis Security Advisory 2015-024-040] SAP HANA TrexNet Vulnerabilities (Onapsis Research Team <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-041] SAP HANA Remote Trace Disclosure (Onapsis Research Team <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-042] SAP HANA EXECUTE_SEARCH_RULE_SET Stored Procedure Memory corruption (Onapsis Research Team <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-043] SAP HANA Remote Code Execution (HTTP Login based) (Onapsis Research Team <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-044] SAP HANA Remote Code Execution (SQL Login based) (Onapsis Research Team <research@...psis.com>)

November 10 (4 messages)

[FD] TestLink 1.9.14 Persistent XSS (Aravind <altoarun@...il.com>)
[FD] TestLink 1.9.14 CSRF Vulnerability (Aravind <altoarun@...il.com>)
[FD] Joomla CMS - Bad Cryptography - Multiple Vulnerabilities (Scott Arciszewski <scott@...agonie.com>)
Re: [FD] SQLiteManager 1.2.4: Multiple XSS (Henri Salo <henri@...v.fi>)

November 14 (24 messages)

[FD] D-link wireless router DIR-816L – Cross-Site Request Forgery (CSRF) vulnerability (Bhadresh Patel <Bhadresh.Patel@...pag.com>)
[FD] Huawei HG630a and HG630a-50 Modems Default SSH Admin Password (Murat Sahin <mrtshn1@...il.com>)
[FD] OpenBSD package 'net-snmp' information disclosure (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] ZTE ADSL modems - Multiple vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] XCart 5.2.6: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] XCart 5.2.6: Path Traversal ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] XCart 5.2.6: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] XCart 5.2.6: Code Execution Exploit ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] TomatoCart v1.1.8.6.1: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] TomatoCart v1.1.8.6.1: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Thelia 2.2.1: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Sitemagic CMS 4.1: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Open Source Social Network 3.5: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] dotclear 2.8.1: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] dotclear 2.8.1: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] ClipperCMS 1.3.0: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] ClipperCMS 1.3.0: Code Execution Exploit ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] ClipperCMS 1.3.0: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] ClipperCMS 1.3.0: SQL Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] ClipperCMS 1.3.0: Path Traversal ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] ClipperCMS 1.3.0: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] LiteCart 1.3.2: Multiple XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] AlegroCart 1.2.8: LFI/RFI ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] AlegroCart 1.2.8: SQL Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)

November 16 (2 messages)

[FD] Call For Papers - BSidesCharm (Baltimore, MD) (Brian Baskin <brian@...baskins.com>)
[FD] Defense in depth -- the Microsoft way (part 36): CWE-428 or fun with unquoted paths ("Stefan Kanthak" <stefan.kanthak@...go.de>)

November 17 (10 messages)

[FD] Port Scan v2.0 iOS - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] LAN Scan HD v1.20 iOS - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Magento Bug Bounty #22 - (Profile) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Magento Bug Bounty #24 - Multiple CSRF Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] LineNity WP Premium Theme - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Murgent CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Free WMA MP3 Converter - Buffer Overflow Exploit (SEH) (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Google AOSP Email App HTML Injection (Cláudio André <ca@...egrity.pt>)
[FD] CVE-2015-6357: Cisco FireSIGHT Management Center SSL Validation Vulnerability (Matthew Flanagan <mattimustang@...il.com>)
[FD] zTree v3 Security Advisory - XSS Vulnerability - CVE-2015-7348 (Onur Yilmaz <onur@...sparker.com>)

November 18 (1 message)

[FD] Adobe Premiere Clip v1.1.1 iOS - (cid:x) Filter Bypass & Persistent Software Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

November 19 (5 messages)

[FD] LinkedIn - Persistent Cross-Site Scripting vulnerability(XSS) (Rohit Dua <8ohit.dua@...il.com>)
[FD] [CFP] No Big Thing Conference #2 San Francisco, December 5 2015 (Jonathan Brossard <endrazine@...il.com>)
Re: [FD] LiteCart 1.3.2: Multiple XSS (Henri Salo <henri@...v.fi>)
[FD] Cambium ePMP 1000 - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Qualsoft Systems - (AddNewsDetails.php) Auth ByPass Vulnerability (ZoRLu Bugrahan <zorlu@...w00rm.com>)

November 24 (1 message)

[FD] List of Bug Bounty Programs INTERNATIONAL 427+ OFFICIAL - Bug Bounty Sheet (Vulnerability Lab <research@...nerability-lab.com>)

November 25 (11 messages)

[FD] CVE-2015-8300: Polycom BToE Connector v2.3.0 Privilege Escalation Vulnerability (SBA Research Advisory <advisory@...-research.org>)
[FD] : CVE-2015-8299 RCE Vulnerability in the KNX management software ETS (SBA Research Advisory <advisory@...-research.org>)
[FD] : CVE-2015-8298 SQL Injection Vulnerability in RXTEC RXAdmin (SBA Research Advisory <advisory@...-research.org>)
[FD] Cross Site Scripting (XSS) 0day in SimpleViewer all versions (bugbasher@...hmail.com)
Re: [FD] LiteCart 1.3.2: Multiple XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Leak information on Huawei HG253s v2, Comtrend VG 8050 and ADB P.DGA4001N (HomeStation) (Daniel Díez <danihzt@...il.com>)
[FD] [ERPSCAN-15-018] SAP NetWeaver 7.4 - XXE (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-15-019] SAP Afaria - Stored XSS (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-15-020] SAP Mobile Platform 2.3 - XXE in application import (ERPScan inc <erpscan.online@...il.com>)
[FD] Celoxis <= 9.5 - Cross Site Scripting (XSS) (Manuel Mancera <mmancera@...ecure.com>)
[FD] CIS Manager Content Management System 2015Q4 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

November 27 (4 messages)

[FD] Google Translator affected by Cross-Site Scripting vulnerability (Francisco Javier Santiago Vázquez <franciscojaviersantiagovazquez@...il.com>)
[FD] [CVE-2015-6942] CoreMail XT3.0 Stored XSS (shack.li <shack.li@...ppsecurity.com.cn>)
[FD] Mitigations for "carpet bombing" alias "directory poisoning" attacks against executable installers ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] PRTG Network Monitor Tool – Multiple Cross-Site Scripting Vulnerability (Sachin Wagh <wsachin092@...il.com>)

November 28 (3 messages)

[FD] BlackArch Linux: New ISOs and Guide released (Black Arch <blackarchlinux@...il.com>)
Re: [FD] Google Translator affected by Cross-Site Scripting vulnerability (Gynvael Coldwind <gynvael@...dwind.pl>)
[FD] Visual Paradigm Server v10.0 - Cross Site Scripting (XSS) (Manuel Mancera <mmancera@...ecure.com>)

November 30 (5 messages)

[FD] LSE Leading Security Experts GmbH - LSE-2015-10-14 - HumHub SQL-Injection (advisories <advisories@...xperts.de>)
[FD] [SE-2014-02] Errata document for Issue 42 (CVE-2015-4871 affecting Java SE 7) (Security Explorations <contact@...urity-explorations.com>)
[FD] [Advisory]LibRaw Multi Memory error[CVE-2015-8366 and CVE-2015-8367] (ChenQin <chenqin@...sec.com.cn>)
[FD] Brocade Fabric OS v6.3.1b Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Mutliple Vulnerabilities in ZurmoCRM 3.0.5 ("NaxoneZ ." <naxonez@...il.com>)

111 messages