full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2017/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	² 1
³	⁴	⁵ 2	⁶ 6	⁷ 5	⁸	⁹
¹⁰	¹¹ 3	¹² 9	¹³	¹⁴ 2	¹⁵	¹⁶
¹⁷	¹⁸ 6	¹⁹	²⁰ 14	²¹ 2	²²	²³
²⁴ 9	²⁵ 4	²⁶ 8	²⁷ 3	²⁸ 4	²⁹	³⁰
³¹ 14

Messages by day:

July 2 (1 message)

[FD] InsomniaX loader allows loading of arbitrary Kernel Extensions ("Securify B.V. via Fulldisclosure" <fulldisclosure@...lists.org>)

July 5 (2 messages)

[FD] [RT-SA-2017-011] Remote Command Execution in PDNS Manager (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] Buffer over-read vulnerability in Virtuozzo Power Panel (VZPP) and Automator ("Securify B.V. via Fulldisclosure" <fulldisclosure@...lists.org>)

July 6 (6 messages)

[FD] KL-001-2017-010 : Barracuda WAF Early Boot Root Shell (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-011 : Barracuda WAF Internal Development Credential Disclosure (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-012 : Barracuda WAF Grub Password Complexity (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-013 : Barracuda WAF Management Application Username and Session ID Leak (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-014 : Barracuda WAF Support Tunnel Hijack (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-015 : Solarwinds LEM Hardcoded Credentials (KoreLogic Disclosures <disclosures@...elogic.com>)

July 7 (5 messages)

[FD] SSD Advisory – Odoo CRM Code Execution (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – EMC IsilonSD Edge Command Injection (Maor Shwartz <maors@...ondsecurity.com>)
[FD] ESA-2017-075: EMC Data Protection Advisor Multiple Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)
[FD] ESA-2017-011: EMC ESRS Policy Manager Undocumented Account Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] Defense in depth -- the Microsoft way (part 48): privilege escalation for dummies -- they didn't make SUCH a stupi… ("Stefan Kanthak" <stefan.kanthak@...go.…)

July 11 (3 messages)

[FD] [CVE-2017-10798] ObjectPlanet Opinio 7.6.3 Cross-Site Scripting (XSS) (Kasper Karlsson <Kasper.Karlsson@...gapoint.se>)
[FD] CVE-2017-4918: Code Injection in VMware Horizon’s macOS Client (Florian Bogner <florian@...ner.sh>)
[FD] DefenseCode Security Advisory: IBM Informix DB-Access Buffer Overflow (DefenseCode <defensecode@...ensecode.com>)

July 12 (9 messages)

[FD] SEC Consult SA-20170712-0 :: Multiple critical vulnerabilities in AGFEO smart home ES 5xx/6xx products (SEC Consult Vulnerability Lab <research@...-consul…)
[FD] ekoparty: Call for Papers 2017! Open! (Francisco Amato <famato@...obytesec.com>)
[FD] [CVE-2017-7726] - Missing SSL Certificate Validation in iSmartAlarm (Ilia Shnaidman <Ilia.Shnaidman@...lguard.com>)
[FD] [CVE-2017-7727] - SSRF vulnerability in iSmartAlarm (Ilia Shnaidman <Ilia.Shnaidman@...lguard.com>)
[FD] CVE-2017-11173 Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to… (Security Researcher <rootresearcher@gma…)
[FD] ESA-2017-089: EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net) for SAS Solution Packs Undocumented … (EMC Product Security Response Center <S…)
[FD] ESA-2017-084: RSA® Authentication Manager Self-Service Console Brute Force PIN-Guessing Vulnerability (EMC Product Security Response Center <Security_Aler…)
[FD] ESA-2017-076: RSA Identity Governance and Lifecycle Multiple Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)
[FD] ESA-2017-068: RSA® Authentication Manager Stored Cross-Site Scripting Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)

July 14 (2 messages)

[FD] CVE request: Multiple vulnerabilities in Cisco DDR2200 Series (The Gambler <gambler@...anota.com>)
[FD] [CVE-2017-7728] - Authentication Bypass allows alarm's commands execution in iSmartAlarm (Ilia Shnaidman <Ilia.Shnaidman@...lguard.com>)

July 18 (6 messages)

[FD] PEGA Platform <= 7.2 ML0 - Multiple vulnerabilities (Daniel Correa <admin@...focol.org>)
[FD] CVE-2017-7642 Local root privesc in Hashicorp vagrant-vmware-fusion <= 4.0.20 (Mark Wadham <fd@....io>)
[FD] [CVE-2017-7728] -Denial of Service in iSmartAlarm (Ilia Shnaidman <Ilia.Shnaidman@...lguard.com>)
[FD] Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities (InterN0T via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] SSD Advisory – Geneko Routers Unauthenticated Path Traversal (Maor Shwartz <maors@...ondsecurity.com>)
[FD] DotCMS /servlets/ajax_file_upload Arbitrary File Upload Vulnerability ("xiaotian.wang@...ppsecurity.com.cn"<xiaotian.wang@...ppsecurity.com.cn>)

July 20 (14 messages)

[FD] APPLE-SA-2017-07-19-1 iOS 10.3.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-07-19-2 macOS 10.12.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-07-19-3 watchOS 3.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-07-19-4 tvOS 10.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-07-19-5 Safari 10.1.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-07-19-6 iTunes 12.6.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-07-19-7 iCloud for Windows 6.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Multiple XSS (POST request) Vulnerabilities in TestServlet (PeopleSoft) (ERPScan inc <erpscan.online@...il.com>)
[FD] Directory Traversal vulnerability in Integration Gateway (PSIGW) (ERPScan inc <erpscan.online@...il.com>)
[FD] File Upload in Integration Gateway (PSIGW) (ERPScan inc <erpscan.online@...il.com>)
[FD] Directory Traversal vulnerability in Integration Gateway (PSIGW) (ERPScan inc <erpscan.online@...il.com>)
[FD] Multiple XSS (POST request) Vulnerabilities in TestServlet (PeopleSoft) (ERPScan inc <erpscan.online@...il.com>)
[FD] File Upload in Integration Gateway (PSIGW) (ERPScan inc <erpscan.online@...il.com>)
[FD] Google’s Android News and Weather App Doesn’t Always Use SSL [CVE-2017-9245] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)

July 21 (2 messages)

[FD] SKILLS.com.au Industry App - Remote Code Execution via MITM (InterN0T via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Virtual Postage (VPA) - Remote Code Execution via MITM (InterN0T via Fulldisclosure <fulldisclosure@...lists.org>)

July 24 (9 messages)

[FD] [RT-SA-2017-003] Cross-Site Scripting in REDDOXX Appliance (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2017-004] Unauthenticated Arbitrary File Disclosure in REDDOXX Appliance (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2017-005] Unauthenticated Extraction of Session-IDs in REDDOXX Appliance (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2017-006] Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance (RedTeam Pentesting GmbH <release@...team-pentestin…)
[FD] [RT-SA-2017-007] Undocumented Administrative Service Account in REDDOXX Appliance (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2017-008] Unauthenticated Access to Diagnostic Functions in REDDOXX Appliance (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2017-009] Remote Command Execution as root in REDDOXX Appliance (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] SEC Consult SA-20170724-0 :: Cross-Site Scripting (XSS) issue in multiple Ubiquiti Networks products (SEC Consult Vulnerability Lab <research@...-consult.…)
[FD] SEC Consult SA-20170724-1 :: Open Redirect issue in multiple Ubiquiti Networks products (SEC Consult Vulnerability Lab <research@...-consult.com>)

July 25 (4 messages)

[FD] CVE-2017-9457 CompuLab Intense PC lacks firmware signature validation ("Hal Martin" <hal.martin@...chmysys.com>)
[FD] SSD Advisory – Nitro Pro PDF Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] Faraday v2.6: Collaborative Penetration Test and Vulnerability Management Platform (Francisco Amato <famato@...obytesec.com>)
[FD] MEDHOST Connex contains hard-coded database credentials (Allen F <afranks2131@...il.com>)

July 26 (8 messages)

Re: [FD] MEDHOST Connex contains hard-coded database credentials (Allen Franks <afranks2131@...il.com>)
[FD] DAVOSET v.1.3.5 ("MustLive" <mustlive@...security.com.ua>)
[FD] SoundTouch multiple vulnerabilities ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] LAME multiple vulnerabilities ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] mpg123 buffer over-read vulnerability ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] libjpeg-turbo denial of service vulnerability ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin (WordPress… (dxw Security <security@....com>)
[FD] Stop User Enumeration allows user enumeration via the REST API (WordPress plugin) (dxw Security <security@....com>)

July 27 (3 messages)

[FD] [RT-SA-2016-007] Cross-Site Scripting in TYPO3 Formhandler Extension (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] SEC Consult SA-20170727-0 :: Ubiquiti Networks UniFi Cloud Key multiple critical vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20170727-1 :: Kathrein UFSconnect 916 multiple vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)

July 28 (4 messages)

[FD] MEDHOST Document Management System contains multiple hard-coded credentials (Allen Franks <afranks2131@...il.com>)
[FD] Broken mutual tls authentication on bluemix (Oscar Martinez <oscarmrdc@...il.com>)
[FD] Boozt Fashion Android App Didn’t Use SSL for Login [CVE-2017-11706] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] Chrome for Android Didn’t Use FLAG_SECURE for Credit Card Prefill Settings [CVE-2017-5082] (Nightwatch Cybersecurity Research <research@...htwatchcyberse…)

July 31 (14 messages)

[FD] CVE-2017-11743 MEDHOST Connex contains hard-coded Mirth Connect admin password (Allen Franks <afranks2131@...il.com>)
[FD] Links buffer over-read vulnerability ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] OpenExif multiple vulnerabilities ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] Nosefart denial of service vulnerability ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] DivFix++ denial of service vulnerability ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] vorbis-tools oggenc vulnerability ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] Sound eXchange (SoX) multiple vulnerabilities ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] libvorbis multiple vulnerabilities ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] TiMidity++ multiple vulnerabilities ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] libao memory corruption vulnerability ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] libid3tag multiple vulnerabilities ("qflb.wu" <qflb.wu@...ppsecurity.com.cn>)
[FD] Spider Player 2.5.3 [ Unsafe DLL Loading Vulnerability ] (Whatis Yourbug <whatisyourbug@...il.com>)
[FD] FTP Commander 8.02 [ Unsafe DLL Loading Vulnerability ] (Whatis Yourbug <whatisyourbug@...il.com>)
[FD] SSD Advisory – McAfee Security Scan Plus Remote Command Execution (Maor Shwartz <maors@...ondsecurity.com>)

92 messages