full-disclosure mailing list - 2016/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 10	⁴ 6	⁵ 7	⁶ 2	⁷ 1	⁸	⁹
¹⁰	¹¹ 34	¹² 3	¹³	¹⁴	¹⁵	¹⁶
¹⁷	¹⁸	¹⁹ 19	²⁰ 1	²¹	²²	²³ 2
²⁴ 8	²⁵ 1	²⁶ 3	²⁷	²⁸ 5	²⁹	³⁰ 1
³¹

Messages by day:

October 3 (10 messages)

[FD] Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTC_REFRESH_EXPORT_TAB_COMP (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-043: SAP OS Command Injection in SCTC_TMS_MAINTAIN_ALOG (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTC_REFRESH_CHECK_ENV (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-036: SAP Security Audit Log invalid address logging (Onapsis Research <research@...psis.com>)
[FD] CVE-2016-1240 - Tomcat packaging on Debian-based distros - Local Root Privilege Escalation (Dawid Golunski <dawid@...alhackers.com>)
Re: [FD] Critical Vulnerability in Ubiquiti UniFi (Gregory Sloop <gregs@...op.net>)
[FD] Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTC_REFRESH_CHECK_ENV (Matías Mevied <mmevied@...psis.com>)
Re: [FD] Critical Vulnerability in Ubiquiti UniFi (Carlos Silva <r3pek@...ek.org>)
[FD] [RootedHONGKONG 2016] Call for papers opened today! (Román Ramírez Giménez <rramirez@...tedcon.es>)
Re: [FD] Critical Vulnerability in Ubiquiti UniFi (Tim Schughart <t.schughart@...sec-networks.com>)

October 4 (6 messages)

[FD] Aura Video Converter v1.6.3 - DLL Hijacking Exploit (Vulnerability Lab <research@...nerability-lab.com>)
[FD] AuraDVD Ripper Professional v1.6.3 - DLL Hijacking Exploit (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FaceDancer 21 - New Universal Case for PenTests (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Sparkasse (Bank) - Service Security Advisory WB021 2016 (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Serimux SSH Console Switch v2.4 - Multiple Cross Site Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] Critical Vulnerability in Ubiquiti UniFi (Gregory Sloop <gregs@...op.net>)

October 5 (7 messages)

[FD] Clean Master v1.0 - Unquoted Path Privilege Escalation (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cyberoam iview UTM v0.1.2.7 - (Ajax) XSS Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Flash Operator Panel 2.31.03 - CSV Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial of Service (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2016-005 : Cisco Firepower Threat Management Console Hard-coded MySQL Credentials (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2016-006 : Cisco Firepower Threat Management Console Local File Inclusion (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2016-007 : Cisco Firepower Threat Management Console Remote Command Execution Leading to Root Access (KoreLogic Disclosures <disclosures@...elogic.…)

October 6 (2 messages)

[FD] RealEstate CMS 3.00.50 - Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [KIS-2016-12] Magento <= 1.9.2.2 (RSS Feed) Information Disclosure Vulnerability (Egidio Romano <research@...mainsecurity.com>)

October 7 (1 message)

[FD] NEW VMSA-2016-0015 - VMware Horizon View updates address directory traversal vulnerability (VMware Security Response Center <security@...are.com>)

October 11 (34 messages)

[FD] SEC Consult SA-20161011-0 :: XXE vulnerability in RSA Enterprise Compromise Assessment Tool (ECAT) (SEC Consult Vulnerability Lab <research@...-consult.co…)
[FD] Facebook API v2.1 - RFC6749 Open Redirect Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-044: SAP OS Command Injection in PREPARE_CHECK_CAPACITY (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-045: SAP OS Command Injection in SCTC_REFRESH_IMPORT_USR_CLNT (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-046: SAP OS Command Injection in SCTC_REFRESH_IMPORT_USR_CLNT (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-001: SAP console insecure password storage (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-029: SAP Missing Signature Check in DSA Algorithm (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-048: SAP OS Command Injection in SCTC_TMS_MAINTAIN_ALOG (Onapsis Research <research@...psis.com>)
[FD] Contenido v4.9.11 CMS - (Backend) Multiple XSS Vulnerabilities ("admin@...lution-sec.com" <admin@...lution-sec.com>)
[FD] CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros - Root Privilege Escalation (affecting CentOS, Fed… (Dawid Golunski <dawid@...alhackers.com>)
[FD] [SEARCH-LAB advisory] AVTECH IP Camera, NVR, DVR multiple vulnerabilities (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] Crashing Android devices with large Assisted-GPS Data Files [CVE-2016-5348] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
Re: [FD] IE11 is not following CORS specification for local files (Ricardo Iramar dos Santos <riramar@...il.com>)
Re: [FD] IE11 is not following CORS specification for local files (Ricardo Iramar dos Santos <riramar@...il.com>)
[FD] [SYSS-2016-033] Microsoft Wireless Desktop 2000 - Insufficient Protection of Code (Firmware) and Data (Cryptographic… (Matthias Deeg <matthias.deeg@...s.de>)
[FD] [SYSS-2016-043] Microsoft Wireless Desktop 2000 - Cryptographic Issues (CWE-310), Insufficient Protection against R… (Matthias Deeg <matthias.deeg@...s.de>)
[FD] [SYSS-2016-068] Fujitsu Wireless Keyboard Set LX901 - Cryptographic Issues (CWE-310), Missing Protection against Rep… (Matthias Deeg <matthias.deeg@...s.de>)
[FD] [SYSS-2016-043] Microsoft Wireless Desktop 2000 - Cryptographic Issues (CWE-310), Insufficient Protection against R… (Matthias Deeg <matthias.deeg@...s.de>)
[FD] IBM WebSphere deserialization of untrusted data (Agazzini Maurizio <inode@...iaservice.net>)
[FD] [SECURITY] CVE-2016-6808 Apache Tomcat JK ISAPI Connector buffer overflow (Mark Thomas <markt@...che.org>)
[FD] BFS-SA-2016-004: LG PC Suite Insecure Update Mechanism (Blue Frost Security Research Lab <research@...efrostsecurity.de>)
[FD] Billion Router 7700NR4 Remote Root Command Execution (Rio Sherri <rio.sherri@...nstudent.info>)
Re: [FD] Critical Vulnerability in Ubiquiti UniFi (Rob Thomas <rthomas@...goma.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-002: SAP UCON Security Protection bypass (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-049: SAP OS Command Injection in SCTC_REORG_SPOOL (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-050: SAP OS Command Injection in SCTC_REFRESH_CONFIG_CTC (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-005: SAP SLDREG memory corruption (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-051: SAP Business Objects Memory Corruption (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-052: Oracle E-Business Suite Cross Site Scripting (XSS) (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-053: Oracle E-Business Suite Cross Site Scripting (XSS) (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-055: Oracle E-Business Suite Cross Site Scripting (XSS) (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-056: Oracle E-Business Suite Cross Site Scripting (XSS) (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-057: Oracle E-Business Suite Cross Site Scripting (XSS) (Onapsis Research <research@...psis.com>)
[FD] NEW VMSA-2016-0016 - vRealize Operations (vROps) updates address privilege escalation vulnerability (VMware Security Response Center <security@...are.com>)

October 12 (3 messages)

[FD] [SYSS-2016-074] Logitech Wireless Presenter R400 - Insufficient Verification of Data Authenticity (CWE-345), Keystr… (Matthias Deeg <matthias.deeg@...s.de>)
[FD] [SYSS-2016-075] Targus Multimedia Presentation Remote - Insufficient Verification of Data Authenticity (CWE-345), M… (Matthias Deeg <matthias.deeg@...s.de>)
[FD] New OpenSSL double-free and invalid free vulnerabilities in X509 parsing (Guido Vranken <guidovranken@...il.com>)

October 19 (19 messages)

[FD] CVE-2016-8600 dotCMS - CAPTCHA bypass by reusing valid code (Elar Lang <elarlang@...il.com>)
[FD] [ERPSCAN-16-028] SAP Adaptive Server Enterprise - DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-029] SAP NetWeaver AS JAVA - deserialization of untrusted user value (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-030] SAP NetWeaver - buffer overflow vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] cgiemail (included with cPanel) local file inclusion vulnerability (Finbar Crago <finbar.crago@...il.com>)
[FD] Man in the Middle Remote Code Execution Vulnerability in WineBottler and its Bundles (Bogner Florian <Florian.Bogner@...sch.net>)
[FD] OpenSSL 1.1.0 remote client memory corruption (Guido Vranken <guidovranken@...il.com>)
[FD] CVE-2016-7980: SPIP 3.1.2 Exec Code Cross-Site Request Forgery (Sysdream Labs <labs@...dream.com>)
[FD] CVE-2016-7981: SPIP 3.1.2 Reflected Cross-Site Scripting (Sysdream Labs <labs@...dream.com>)
[FD] CVE-2016-7982: SPIP 3.1.1/3.1.2 File Enumeration / Path Traversal (Sysdream Labs <labs@...dream.com>)
[FD] CVE-2016-7998: SPIP 3.1.2 Template Compiler/Composer PHP Code Execution (Sysdream Labs <labs@...dream.com>)
[FD] CVE-2016-7999: SPIP 3.1.2 Server Side Request Forgery (Sysdream Labs <labs@...dream.com>)
[FD] Defense in depth -- the Microsoft way (part 44): complete failure of Windows Update ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Evernote for Windows DLL Loading Remote Code Execution (Himanshu Mehta <mehta.himanshu21@...il.com>)
[FD] Ghostscript sadbox bypass lead ImageMagick to remote code execution (redrain root <rootredrain@...il.com>)
[FD] Multiple Vulnerabilities in Plone CMS (Sebastian Perez <s3bap3@...il.com>)
[FD] Ubiquiti (Tim Schughart <t.schughart@...sec-networks.com>)
Re: [FD] Critical Vulnerability in Ubiquiti UniFi (Carlos Silva <r3pek@...ek.org>)
Re: [FD] Critical Vulnerability in Ubiquiti UniFi (kvnjs <kvnjs@...eup.net>)

October 20 (1 message)

[FD] Defense in depth -- the Microsoft way (part 45): filesystem redirection fails to redirect the application director… ("Stefan Kanthak" <stefan.kanthak@...go.…)

October 23 (2 messages)

[FD] New release: UFONet v0.8 - "U-NATi0n!" (psy <epsylon@...eup.net>)
[FD] XSS on public PGP servers (John Strander <tech.pain@...dex.com>)

October 24 (8 messages)

[FD] Security Vulnerability : Cisco web site CSRF in change password lead to full account take over (mohamed sayed <eng.mohamed8860@...il.com>)
[FD] Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS ("[CXSEC]" <submit@...ec.org>)
[FD] APPLE-SA-2016-10-24-1 iOS 10.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-10-24-2 macOS Sierra 10.12.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-10-24-3 Safari 10.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-10-24-4 tvOS 10.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-10-24-5 watchOS 3.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] daloRADIUS 0.9-9 - Multiple vulnerabilities leading to arbitrary shell execution (fwagglechop <fwaggle@...ggle.org>)

October 25 (1 message)

[FD] AST-2016-007: UPDATE ("Asterisk Security Team" <security@...erisk.org>)

October 26 (3 messages)

[FD] New VMSA-2016-0017 - VMware product updates address multiple information disclosure issues (VMware Security Response Center <security@...are.com>)
[FD] CVE-2016-1240 - Tomcat packaging on Debian-based distros - Local Root Privilege Escalation (Dawid Golunski <dawid@...alhackers.com>)
[FD] [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) (Harry Sintonen <fulldisclosure@...er.fi>)

October 28 (5 messages)

[FD] Wickr Inc - When honesty disappears behind the VCP Mountain (Vulnerability Lab <research@...nerability-lab.com>)
[FD] APPLE-SA-2016-10-27-1 Xcode 8.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-10-27-2 iCloud for Windows v6.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-10-27-3 iTunes 12.5.2 for Windows (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] [FOXMOLE SA 2016-07-20] Lupusec XT1 Alarm System - Multiple Issues (FOXMOLE Advisories <advisories@...mole.com>)

October 30 (1 message)

[FD] [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) - patch update (Harry Sintonen <fulldisclosure@...er.fi>)

103 messages

Powered by blists - more mailing lists