full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 1	²	³
⁴ 2	⁵	⁶ 13	⁷ 4	⁸ 2	⁹	¹⁰ 2
¹¹ 2	¹² 12	¹³ 6	¹⁴	¹⁵ 9	¹⁶	¹⁷
¹⁸	¹⁹ 4	²⁰ 2	²¹	²²	²³	²⁴ 2
²⁵ 15	²⁶ 1	²⁷ 4	²⁸ 4	²⁹ 1	³⁰	³¹ 3

Messages by day:

July 1 (1 message)

[FD] KL-001-2016-003 : SQLite Tempdir Selection Vulnerability (KoreLogic Disclosures <disclosures@...elogic.com>)

July 4 (2 messages)

[FD] KWSPHP CMS v1.6.995 - Persistent Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 6 (13 messages)

[FD] IBM BlueMix Cloud - (API) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Teampass 2.1.26 - Authenticated File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Micron CMS v5.3 - (cat_id) SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Executable installers are vulnerable^WEVIL (case 34): Microsoft's vs-community-*.exe susceptible to DLL hijacking ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] Samsung SW Update - Insecure ACLs on SW Update Service Directory - EoP Vulnerability (Benjamin Gnahm <benjamin@...efrostsecurity.de>)
Re: [FD] [oss-security] libical 0.47 SEGV on unknown address (Brandon Perry <bperry.volatile@...il.com>)
[FD] Putty (beta 0.67) DLL Hijacking Vulnerability (Sachin Wagh <wsachin092@...il.com>)
[FD] PrinceXML PHP wrapper command injection (Brandon Perry <bperry.volatile@...il.com>)
[FD] CVE-2016-4979: HTTPD webserver - X509 Client certificate based authentication can be bypassed when HTTP/2 is used … (Dirk-Willem van Gulik <dirkx@...weaving…)
[FD] CVE ID Request : OpenFire multiple vulnerabilities (Sysdream Labs <labs@...dream.com>)
[FD] CIMA DocuClass ECM - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] RS232-NET Converter (JTC-200) - Multiple vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] GNU Wget < 1.18 Arbitrary File Upload (Dawid Golunski <dawid@...alhackers.com>)

July 7 (4 messages)

[FD] Zero-day flaw lets hackers tamper with your car through BMW portal (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Acer Portal Android Application - MITM SSL Certificate Vulnerability (CVE-2016-5648) (David Coomber <davidcoomber.infosec@...il.com>)
[FD] CODEBLUE.JP - Conference in Tokyo Calling for Papers by Aug.10 (CFP <cfp@...eblue.jp>)
[FD] [KIS-2016-11] IPS Community Suite <= 4.1.12.3 Autoloaded PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

July 8 (2 messages)

[FD] BMW - (Token) Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] BMW ConnectedDrive - (Update) VIN Session Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 10 (2 messages)

[FD] Ultimate Member Local File Inclusion vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting in All in One SEO Pack WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

July 11 (2 messages)

[FD] Persistent Cross-Site Scripting in WP Live Chat Support plugin ("Securify B.V." <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting in WordPress Activity Log plugin (Summer of Pwnage <lists@...urify.nl>)

July 12 (12 messages)

[FD] Cross-Site Scripting vulnerability in Email Users WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Master Slider WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Profile Builder WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] WP Fastest Cache Member Local File Inclusion vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] Easy Forms for MailChimp Local File Inclusion vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] [CVE-2016-1014, CVE-2016-4247] Executable installers are vulnerable^WEVIL (case 35): Adobe's Flash Player (un)ins… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] RootExplorer remote code execution (0x3d5157636b525761 iddqd <0x3d5157636b525761@...il.com>)
[FD] RCE by abusing NAC to gain Domain Persistence. (Alexander Korznikov <nopernik@...il.com>)
[FD] WSO2 SOA Enablement Server - Server Side Request Forgery (Paweł Gocyla <pawellgocyla@...il.com>)
[FD] WSO2 SOA Enablement Server - XML External Entity Injection (Paweł Gocyla <pawellgocyla@...il.com>)
[FD] WSO2 SOA Enablement Server - Reflected Cross Site Scripting vulnerability (Paweł Gocyla <pawellgocyla@...il.com>)
[FD] [RCESEC-2016-003][CVE-2016-4469] Apache Archiva 1.3.9 Multiple Cross-Site Request Forgeries (Julien Ahrens <info@...security.com>)

July 13 (6 messages)

[FD] [RCESEC-2016-004][CVE-2016-5005] Apache Archiva 1.3.9 admin/addProxyConnector_commit.action connector.sourceRepoId Pe… (Julien Ahrens <info@...security.com>)
[FD] Hpak - package manager for pentesters. Release announcement (Hypsurus <hypsurus@...l.ru>)
[FD] Cross-Site Scripting vulnerability in Simple Membership WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Top 10 - Popular posts plugin for WordPress (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in WP No External Links WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Google Forms WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

July 15 (9 messages)

[FD] [ERPSCAN-16-019] SAP NetWeaver Enqueue Server - DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-020] SAP NetWeaver AS JAVA UDDI component - XXE vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-021] SAP xMII - Reflected XSS vulnerability (ERPScan inc <erpscan.online@...il.com>)
Re: [FD] RCE by abusing NAC to gain Domain Persistence. (Kurt Buff <kurt.buff@...il.com>)
[FD] missing input validation in pmount: arbitrary mount as non-root (Imre RAD <imre.rad@...rch-lab.hu>)
Re: [FD] RCE by abusing NAC to gain Domain Persistence. (Joey Maresca <jmaresca@...il.com>)
[FD] Blind SQL Injection PivotX <= v2.3.11 (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] opensshd - user enumeration ("Harari, Eddie" <EddieEzra.Harari@...int.com>)
[FD] x-originating-ip: [25.162.68.132] (bashis <mcw@...mail.eu>)

July 19 (4 messages)

[FD] Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186) (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Multiple Cross-Site Scripting vulnerabilities in Ninja Forms WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery in Icegram WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Multiple SQL injection vulnerabilities in WordPress Video Player (Summer of Pwnage <lists@...urify.nl>)

July 20 (2 messages)

[FD] Cross-Site Scripting vulnerability in Paid Memberships Pro WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting in WooCommerce using image metadata (EXIF) (Summer of Pwnage <lists@...urify.nl>)

July 24 (2 messages)

[FD] Cross-Site Scripting in Contact Form to Email WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Code Snippets WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

July 25 (15 messages)

[FD] SEC Consult SA-20160725-0 :: Multiple vulnerabilities in Micro Focus (Novell) Filr (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Executable installers are vulnerable^WEVIL (case 37): eclipse-inst-win*.exe vulnerable to DLL redirection and man… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Defense in depth -- the Microsoft way (part 41): vulnerable by (poor implementation of bad) design ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] [SEARCH-LAB advisory] UPC Hungary network problems (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] [SEARCH-LAB advisory] Ubee EVW3226 modem/router multiple vulnerabilities (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] [SEARCH-LAB advisory] Technicolor TC7200 modem/router multiple vulnerabilities (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] [SEARCH-LAB advisory] Hitron CGNV4 modem/router multiple vulnerabilities (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] [SEARCH-LAB advisory] Compal CH7465LG-LC modem/router multiple vulnerabilities (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] [SEARCH-LAB advisory] Cisco EPC3925 UPC modem/router default passphrase vulnerabilities (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] CVE-2016-5080: Memory corruption in code generated by Objective Systems Inc. ASN1C compiler for C/C++ [STIC-2016-0… (Programa STIC <stic@...dacionsadosky.or…)
[FD] Reflected XSS in LinkedIn (Elar Lang <elarlang@...il.com>)
[FD] CVE-2016-5399: php: out-of-bounds write in bzread() (Hans Jerry Illikainen <hji@...topia.com>)
[FD] Amazon’s Silk Browser on the Kindle Didn’t Use SSL for Google Search (Nightwatch Cybersecurity <research@...htwatchcybersecurity.com>)
[FD] XSS and SQLi in huge IT gallery v1.1.5 for Joomla ("Larry W. Cashdollar" <larry0@...com>)
[FD] Bellini/Supercook Wi-Fi Yumi SC200 - Multiple vulnerabilities (James McLean <james.mclean@...il.com>)

July 26 (1 message)

[FD] Cross-Site Scripting vulnerability in ColorWay WordPress Theme (Summer of Pwnage <lists@...urify.nl>)

July 27 (4 messages)

[FD] Nusiorung CMS 2016 - (Login) Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] DornCMS v1.4 - (FileManager) Persistent Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] VUPlayer 2.49 - (.pls) Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] VUPlayer 2.49 - (.wax) Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 28 (4 messages)

[FD] Zortam Media Studio 20.60 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Exponent CMS 2.3.9 - Useraccounts Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Zoll Checklist v1.2.2 iOS - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Saveya Bounty #1 - Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 29 (1 message)

[FD] ZMS v3.2 CMS - Multiple Client Side Cross Site Scripting Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

July 31 (3 messages)

[FD] Insert PHP WordPress Plugin allows authenticated user to execute arbitrary PHP (Summer of Pwnage <lists@...urify.nl>)
[FD] Stored Cross-Site Scripting vulnerability in Easy Testimonials WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Multiple vulnerabilities in All In One WP Security & Firewall plugin login CAPTCHA (Summer of Pwnage <lists@...urify.nl>)

89 messages