full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 7	² 6	³	⁴	⁵
⁶	⁷ 4	⁸ 1	⁹	¹⁰	¹¹	¹²
¹³ 4	¹⁴ 2	¹⁵ 9	¹⁶ 6	¹⁷	¹⁸ 6	¹⁹
²⁰	²¹ 4	²²	²³ 5	²⁴ 1	²⁵ 10	²⁶
²⁷ 6	²⁸ 8	²⁹	³⁰

Messages by day:

June 1 (7 messages)

[FD] Defense in depth -- the Microsoft way (part 40): seven+ year old "blended" threat still alive and kicking ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Faraday v1.0.20 is here! New conflict resolution, hosts and services views & bug fixes! (Francisco Amato <famato@...obytesec.com>)
[FD] MitM Attack against KeePass 2's Update Check (Bogner Florian <Florian.Bogner@...sch.net>)
[FD] XSS in CMSimple <= v4.6.2 (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] Keystone Assembler Engine is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] CVE-2016-3670 Stored Cross Site Scripting in Liferay CE (Fernando Camara <fernando.camara.007@...il.com>)
[FD] Joomla SecurityCheck extension - Multiple vulnerabilities (Gökmen GÜREŞÇİ <gokmenguresci@...il.com>)

June 2 (6 messages)

[FD] SEC Consult SA-20160602-0 :: Multiple critical vulnerabilities in Ubee EVW3226 Advanced wireless voice gateway (SEC Consult Vulnerability Lab <research@se…)
[FD] Force allow access button to Bypass windows firewall (Raiden lol <coolerlair@...il.com>)
[FD] Nagios XI Multiple Vulnerabilities (Francesco Oddo <francesco.oddo@...urity-assessment.com>)
[FD] Multiple XSS in Babylon (Francisco Javier Santiago Vázquez <franciscojaviersantiagovazquez@...il.com>)
[FD] rConfig, the open source network device configuration management tool, Vulnerable to Local File Inclusion (Gregory Pickett <gpickett71@...oo.com>)
[FD] XML External Entity XXE vulnerability in OpenID component of Liferay (Sandro Gauci <sandro@...blesecurity.com>)

June 7 (4 messages)

[FD] Mapbox (API) - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wordpress Levo-Slideshow 2.3 - Arbitrary File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Microsoft Education - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

June 8 (1 message)

[FD] SQL Injection Vulnerabilities found in European Commisssion & European Parliament (Vulnerability Lab <research@...nerability-lab.com>)

June 13 (4 messages)

[FD] CM Ad Changer 1.7.7 Wordpress Plugin - Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FlashFXP v5.3.0 (Windows) - Memory Corruption Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] nagios phishing vector & xss (randomsec guy <randomsecguy@...look.com>)
[FD] Samsung SW Update - Insecure ACLs on SW Update Service Directory - EoP Vulnerability (Benjamin Gnahm <benjamin@...efrostsecurity.de>)

June 14 (2 messages)

[FD] Bashi v1.6 iOS - Persistent Mail Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CVE-2016-5060 Stored Cross-Site Scripting vulnerability in nGrinder (ljj <9085290852@...pl>)

June 15 (9 messages)

[FD] FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Java Deserialization in Solarwinds Virtualization Manager 6.3.1 (Nate Kettlewell <nate@...thsecurity.com>)
[FD] CVE-2016-3643 - Misconfiguration of sudo in Solarwinds Virtualization Manager (Nate Kettlewell <nate@...thsecurity.com>)
[FD] [CVE-2014-1520] NOT FIXED: privilege escalation via Mozilla's executable installers ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] CVE-2016-3643 - Misconfiguration of sudo in Solarwinds Virtualization Manager (Nate Kettlewell <nate@...thsecurity.com>)
[FD] CVE-2016-3642 - Java Deserialization in Solarwinds Virtualization Manager 6.3.1 (Nate Kettlewell <nate@...thsecurity.com>)
[FD] Siklu EtherHaul Hidden ‘root’ Account (Ian Ling <iancling@...il.com>)
[FD] Face Authentication Bypassing – KeyLemon (omarbv@...eup.net)
[FD] Microsoft Visio multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)

June 16 (6 messages)

[FD] Blindspot Advisory: HTTP Header Injection in Python urllib ("Timothy D. Morgan" <tim-security@...tinelchicken.org>)
[FD] Authentication bypass in Ceragon FibeAir IP-10 web interface (<7.2.0) (Ian Ling <iancling@...il.com>)
[FD] HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Papouch TME Temperature & Humidity Thermometers - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Stack Overflow in BLAT (vishnu raju <rajuvishnu52@...il.com>)
[FD] CVE-2016-5709 - Use of Weak Encryption Algorithm in Solarwinds Virtualization Manager (Nate Kettlewell <nate@...thsecurity.com>)

June 18 (6 messages)

[FD] [CVE-2016-1014] Escalation of privilege via executable (un)installers of Flash Player ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] [ERPSCAN-16-012] SAP NetWeaver AS JAVA - directory traversal vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-013] SAP NetWeaver AS Java ctcprotocol servlet - XXE vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-014] SAP NetWeaver AS Java NavigationURLTester - XSS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] Multiple vulnerabilities in squid 0.4.16_2 running on pfSense (Remco Sprooten <remco@...ooten.org>)
[FD] CVE-2016-0199 / MS16-063: MSIE 11 garbage collector attribute type confusion (Berend-Jan Wever <berendjanwever@...il.com>)

June 21 (4 messages)

[FD] APPLE-SA-2016-06-20-1 AirPort Base Station Firmware Update 7.6.7 and 7.7.7 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] [ERPSCAN-16-016] SAP NetWeaver Java AS WD_CHAT - Information disclosure vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-015] SAP NetWeaver Java AS - multiple XSS vulnerabilities (ERPScan inc <erpscan.online@...il.com>)
[FD] CVE ID Request : Horsys v8 multiple vulnerabilities (Sysdream Labs <labs@...dream.com>)

June 23 (5 messages)

[FD] [KIS-2016-03] SugarCRM <= 6.5.18 (SAML Authentication) XML External Entity Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2016-04] SugarCRM <= 6.5.18 Missing Authorization Check Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2016-05] SugarCRM <= 6.5.18 Two PHP Code Injection Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2016-06] SugarCRM <= 6.5.18 (MySugar::addDashlet) Insecure fopen() Usage Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2016-07] SugarCRM <= 6.5.23 (SugarRestSerialize.php) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

June 24 (1 message)

[FD] SEC Consult SA-20160624-0 :: ASUS DSL-N55U router XSS and information disclosure (SEC Consult Vulnerability Lab <research@...-consult.com>)

June 25 (10 messages)

[FD] [ERPSCAN-16-017] SAP JAVA AS icman - DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-018] SAP Application server for Javat - DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] Faraday v1.0.21 with our new GTK interface! (Francisco Amato <famato@...obytesec.com>)
[FD] Magic values in 32-bit processes on 64-bit OS-es and how to exploit them (Berend-Jan Wever <berendjanwever@...il.com>)
Re: [FD] Magic values in 32-bit processes on 64-bit OS-es and how to exploit them (Berend-Jan Wever <berendjanwever@...il.com>)
[FD] Sierra Wireless AirLink Raven XE Industrial 3G Gateway - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
Re: [FD] Magic values in 32-bit processes on 64-bit OS-es and how to exploit them (Berend-Jan Wever <berendjanwever@...il.com>)
[FD] EdgeCore - ES3526XA Manager - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] #146416 Ruby:HTTP Header injection in 'net/http' (redrain root <rootredrain@...il.com>)
[FD] libical 0.47 SEGV on unknown address (Brandon Perry <bperry.volatile@...il.com>)

June 27 (6 messages)

Re: [FD] [oss-security] libical 0.47 SEGV on unknown address (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: [FD] [oss-security] libical 0.47 SEGV on unknown address (Brandon Perry <bperry.volatile@...il.com>)
[FD] Panda Security Privilege Escalation (Ash <ashraf.alharbi@...urity-assessment.com>)
[FD] Riverbed SteelCentral NetProfiler & NetExpress Multiple Vulnerabilities (Francesco Oddo <francesco.oddo@...urity-assessment.com>)
[FD] Aramadito remote arbitrary file write in case of MiTM (<thedeadcow@...anota.com>)
[FD] Craft CMS affected by server side template injection ("Securify B.V." <lists@...urify.nl>)

June 28 (8 messages)

[FD] Ladesk Agent #1 (Bug Bounty) - Session Reset Password Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Mutualaid CMS v4.3.1 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Alfine CMS v2.6 - (Login) Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Iranian Weblog Services v3.3 CMS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [KIS-2016-08] Concrete5 <= 5.7.3.1 Multiple Cross-Site Request Forgeries Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2016-09] Concrete5 <= 5.7.3.1 Multiple Stored Cross-Site Scripting Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2016-10] Concrete5 <= 5.7.3.1 (Application::dispatch) Local File Inclusion Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] KL-001-2016-002 : Ubiquiti Administration Portal CSRF to Remote Command Execution (KoreLogic Disclosures <disclosures@...elogic.com>)

79 messages