full-disclosure mailing list - 2013/09

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2013/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 7
² 11	³ 5	⁴ 7	⁵ 2	⁶ 9	⁷ 2	⁸ 1
⁹ 4	¹⁰ 8	¹¹ 14	¹² 9	¹³ 18	¹⁴ 2	¹⁵
¹⁶ 3	¹⁷ 8	¹⁸ 12	¹⁹ 6	²⁰ 4	²¹ 1	²² 3
²³ 2	²⁴ 5	²⁵ 23	²⁶ 4	²⁷ 4	²⁸ 2	²⁹ 2
³⁰ 9

Messages by day:

September 1 (7 messages)

nullcon Goa 2014 Call for Paper/Event (nullcon <nullcon@...lcon.net>)
Re: nullcon Goa 2014 Call for Paper/Event (xnite@...te.org)
Re: nullcon Goa 2014 Call for Paper/Event (nullcon <nullcon@...lcon.net>)
[SECURITY] [DSA 2748-1] exactimage security update (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 2740-2] python-django regression update (Florian Weimer <fw@...eb.enyo.de>)
IndiaNIC Testimonial WP plugin - Multiple vulnerabilities ("Adéla Goldová" <roguecoder@...h.com>)
Insufficient Authorization vulnerability in Act ("MustLive" <mustlive@...security.com.ua>)

September 2 (11 messages)

Re: Defense in depth -- the Microsoft way (part 9): erroneous documentation ("Stefan Kanthak" <stefan.kanthak@...go.de>)
list of vulnerabilities discovered by realpentesting (Pedro Guillen <pgn.pedroguillen@...il.com>)
DotNetNuke (DNNArticle Module) SQL Injection Vulnerability ("Sajjad Pourali" <S.pourali@...l.com>)
DotNetNuke (DNN) Cross-Site Scripting Vulnerability !!!! ("Sajjad Pourali" <S.pourali@...l.com>)
Re: list of vulnerabilities discovered by realpentesting (Źmicier Januszkiewicz <gauri@....by>)
Mikrotik RouterOS 5.* and 6.* sshd remote preauth heap corruption (king cope <isowarez.isowarez.isowarez@...glemail.com>)
[SECURITY] [DSA 2749-1] asterisk security update (Moritz Muehlenhoff <jmm@...ian.org>)
Permanent XSS and user enumeration on campus-party.eu (klondike <klondike@...ndike.es>)
[ MDVSA-2013:224 ] libtiff (security@...driva.com)
[ MDVSA-2013:225 ] libdigidoc (security@...driva.com)
Re: list of vulnerabilities discovered by realpentesting (Mgr. Martin Žember <zember@...il.com>)

September 3 (5 messages)

Remote Command Injection in fog-dragonfly-0.8.2 Ruby Gem ("Larry W. Cashdollar" <larry0@...com>)
Re: list of vulnerabilities discovered by realpentesting (Pedro Guillen <pgn.pedroguillen@...il.com>)
[SECURITY] [DSA 2750-1] imagemagick security update (Florian Weimer <fw@...eb.enyo.de>)
DAVOSET v.1.1.3 ("MustLive" <mustlive@...security.com.ua>)
Kiwicon 7 CFP (Kiwicon <kiwicon@...icon.org>)

September 4 (7 messages)

[PSA-2013-0903-1] Apple Safari Heap Buffer Overflow (fulldis@...ketstormsecurity.org)
SEC Consult SA-20130904-0 :: GroupLink everything HelpDesk - undocumented password reset/admin takeover and XSS vulner… (SEC Consult Vulnerability Lab <research…)
Cisco Security Advisory: Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Pl… (Cisco Systems Product Security Incident…)
[Security-news] SA-CONTRIB-2013-073 - Make Meeting Scheduler - Access Bypass (security-news@...pal.org)
[CVE-2013-5675] Symantec Endpoint Protection un-installation password bypass (Aaron Lewis <the.warl0ck.1989@...il.com>)
[Security-news] PSA-2013-001: Drupal core - Users can insert hidden text and links (security-news@...pal.org)
[Onapsis Research Labs] New SAP Security In-Depth issue: "Preventing Cyber-Attacks Against SAP Solution Manager" (Onapsis Research Labs <research@...psis.com>)

September 5 (2 messages)

[SECURITY] [DSA 2751-1] libmodplug security update (Raphael Geissert <geissert@...ian.org>)
[ MDVSA-2013:226 ] roundcubemail (security@...driva.com)

September 6 (9 messages)

[Tool] nimbostratus: Pivoting in Amazon Clouds (Andres Riancho <andres.riancho@...il.com>)
Internet has vuln. (coderman <coderman@...il.com>)
Re: Analysis of the Carna Botnet (Internet Census 2012) ("Parth Shukla" <pparth@...cert.org.au>)
possible backdoor in OpenSSL X509 verification (Arnis <arnis@...ee>)
TWSL2013-027: Multiple Vulnerabilities in AjaXplorer (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
Re: possible backdoor in OpenSSL X509 verification (Jeffrey Walton <noloader@...il.com>)
Re: possible backdoor in OpenSSL X509 verification (Ben Laurie <ben@...ks.org>)
[CORE-2013-0809] Sophos Web Protection Appliance Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
Check Point ClusterXL/CCP issue (DoS) (Jakub Jozwiak <jozwiack@...il.com>)

September 7 (2 messages)

Event Easy Calendar 1.0.0 WP plugin ("Adéla Goldová" <roguecoder@...h.com>)
[SECURITY] [DSA 2752-1] phpbb3 security update (Thijs Kinkhorst <thijs@...ian.org>)

September 8 (1 message)

[CVE-2013-5701] Watchguard Server Center v11.7.4 wgpr.dll Insecure Library Loading Local Privilege Escalation Vulnerabilit… (Julien Ahrens <info@...security.com>)

September 9 (4 messages)

FREE Webinar On Setting Up A Successful E-Commerce Store (Shubhneet Goel <skg102@...il.com>)
SQL Injection Vulnerability in glFusion (Netsparker Advisories <advisories@...itunasecurity.com>)
List Charter (John Cartwright <johnc@...k.org.uk>)
[ MDVSA-2013:227 ] python-setuptools (security@...driva.com)

September 10 (8 messages)

[ MDVSA-2013:228 ] cacti (security@...driva.com)
[ MDVSA-2013:229 ] bzr (security@...driva.com)
An Analysis of the (In)Security State of the GameHouse Game Installation Mechanism (RBS Research <research@...kbasedsecurity.com>)
Talkie Bluetooth Video iFiles 2.0 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Synology DSM multiple vulnerabilities (Andrea Fabrizi <andrea.fabrizi@...il.com>)
Unauthenticated Remote File Upload via HTTP for lua-Programming language 1.6 on iOS ("Larry W. Cashdollar" <larry0@...com>)
Re: Unauthenticated Remote File Upload via HTTP for lua-Programming language 1.6 on iOS ("Larry W. Cashdollar" <larry0@...com>)

September 11 (14 messages)

Microsoft SharePoint 2013 (Cloud) - Persistent Exception Handling Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2754-1] exactimage security update (Raphael Geissert <geissert@...ian.org>)
Insecure CHIASMUS encryption in GSTOOL (Jan Schejbal <jan.mailinglisten@...glemail.com>)
Automated SQL Injection Detection (Arne Swinnen <contact@...eswinnen.net>)
ProFTPd mod_sftp/mod_sftp_pam invalid pool allocation in kbdint authentication (king cope <isowarez.isowarez.isowarez@...glemail.com>)
[SECURITY] [DSA 2755-1] python-django security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2013:230 ] gdm (security@...driva.com)
[Security-news] SA-CONTRIB-2013-074 - MediaFront - Cross Site Scripting (XSS) (security-news@...pal.org)
[Security-news] SA-CONTRIB-2013-075 - Click2Sell - Multiple Vulnerabilities (XSS and CSRF) (security-news@...pal.org)
Unauthenticated Remote File Upload via HTTP for ruby-Programming language 1.7 on iOS ("Larry W. Cashdollar" <larry0@...com>)
Unauthenticated Remote File Upload via HTTP for perl-Programming language 1.6 on iOS ("Larry W. Cashdollar" <larry0@...com>)
[Security-news] SA-CONTRIB-2013-076 - jQuery Countdown - Cross Site Scripting (XSS) (security-news@...pal.org)
Re: Internet has vuln. (coderman <coderman@...il.com>)
Re: Internet has vuln. (coderman <coderman@...il.com>)

September 12 (9 messages)

Re: Internet has vuln. (Georgi Guninski <guninski@...inski.com>)
[ MDVSA-2013:231 ] openswan (security@...driva.com)
Re: Internet has vuln. (Steve Wray <stevedwray@...il.com>)
Re: Internet has vuln. (coderman <coderman@...il.com>)
Re: Internet has vuln. (coderman <coderman@...il.com>)
Unauthenticated Remote File Upload via HTTP for lua-Programming language 2.0 on iOS ("Larry W. Cashdollar" <larry0@...com>)
Re: Internet has vuln. (Valdis.Kletnieks@...edu)
Re: Unauthenticated Remote File Upload via HTTP for lua-Programming language 2.0 on iOS ("Larry W. Cashdollar" <larry0@...com>)
Re: Internet has vuln. (Jeffrey Walton <noloader@...il.com>)

September 13 (18 messages)

OpenSSL, OpenSSH ecdsa authentication code inconsistent return values.. no vulnerability? (king cope <isowarez.isowarez.isowarez@...glemail.com>)
Re: OpenSSL, OpenSSH ecdsa authentication code inconsistent return values.. no vulnerability? (Georgi Guninski <guninski@...inski.com>)
Re: OpenSSL, OpenSSH ecdsa authentication code inconsistent return values.. no vulnerability? (king cope <isowarez.isowarez.isowarez@...glemail.com>)
[SECURITY] [DSA 2753-1] mediawiki security update (Thijs Kinkhorst <thijs@...ian.org>)
Kwok Information Server Blind Sql Injection (YOGESH PHADTARE <yog4567@...il.com>)
WordPress Fixes Multiple Vulnerabilities With 3.6.1 Release (Osama Alrashid <osama.alrashid@...il.com>)
Re: OpenSSL, OpenSSH ecdsa authentication code inconsistent return values.. no vulnerability? (Aris Adamantiadis <aris@...adc0de.be>)
[ MDVSA-2013:232 ] libmodplug (security@...driva.com)
[ MDVSA-2013:233 ] python-OpenSSL (security@...driva.com)
[ MDVSA-2013:234 ] python-django (security@...driva.com)
[SECURITY] [DSA 2756-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Internet has vuln. (Tracy Reed <treed@...raviolet.org>)
Re: Internet has vuln. ("Marcio B. Jr." <marcio.barbado@...il.com>)
Re: Internet has vuln. (Valdis.Kletnieks@...edu)
Re: Internet has vuln. (Justin Ferguson <jf@...co.net>)
Re: Internet has vuln. (Jeffrey Walton <noloader@...il.com>)
Re: Internet has vuln. (Justin Ferguson <jf@...co.net>)
AFU, AFD and XSS vulnerabilities in Uploadify ("MustLive" <mustlive@...security.com.ua>)

September 14 (2 messages)

Re: Internet has vuln. (Steve Wray <stevedwray@...il.com>)
[SECURITY] [DSA 2757-1] wordpress security update (Yves-Alexis Perez <corsac@...ian.org>)

September 16 (3 messages)

OWASP ESAPI Security Advisory: MAC Bypass in ESAPI Symmetric Encryption ("Kevin W. Wall" <kevin.w.wall@...il.com>)
Botconf 2013 - Pre-programme published & registration open (Nantes, France 5-6/12/2013) (Eric Freyssinet <eric.freyssinet@....org>)
[ MDVSA-2013:235 ] mediawiki (security@...driva.com)

September 17 (8 messages)

Inkasso Trojaner - Part 3 (Curesec Research Team <crt@...esec.com>)
EarthVPN certificate configuration vulnerabilities (y6whynrzab@...mail.com)
New Version of JBrute (Gonzalo Camino <gonzalocamino@...il.com>)
TWSL2013-028: Persistent DoS Vulnerability in Vino VNC Server (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
[ MDVSA-2013:236 ] subversion (security@...driva.com)
[SECURITY] [DSA 2758-1] python-django security update (Salvatore Bonaccorso <carnil@...ian.org>)
Multiple vulnerabilities in RokStories for WordPress ("MustLive" <mustlive@...security.com.ua>)
Multiple vulnerabilities in RokNewsPager for WordPress ("MustLive" <mustlive@...security.com.ua>)

September 18 (12 messages)

RFID research hardware project (Major Malfunction <majormal@...ate-radio.org>)
[ MDVSA-2013:237 ] firefox (security@...driva.com)
[SECURITY] [DSA 2759-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
XSS and Redirector vulnerabilities in InstantCMS ("MustLive" <mustlive@...security.com.ua>)
[SECURITY] [DSA 2760-1] chrony security update (Moritz Muehlenhoff <jmm@...ian.org>)
Cisco Security Advisory: Cisco Prime Central for Hosted Collaboration Solution Assurance Unauthenticated Username and … (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Prime Data Center Network Manager (Cisco Systems Product Security Incident Response Team <psirt@...c…)
XSS on Bing maps (Bhavesh Naik <bhavesh_shouts@...oo.com>)
Security Vulnerability in German ERP system "Sage Office Line" (x180913erp@...h.com)
Wordpress Plugin Complete Gallery Manager 3.3.3 - Arbitrary File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[Security-news] SA-CONTRIB-2013-077 - Google Site Search - Cross Site Scripting (XSS) (security-news@...pal.org)
Multiple vulnerabilities in RokIntroScroller for WordPress ("MustLive" <mustlive@...security.com.ua>)

September 19 (6 messages)

NSA Apparently Purchasing Software Exploits From French Security Firm | Techdirt Lite ("Ivan .Heca" <ivanhec@...il.com>)
[ MDVSA-2013:238 ] wireshark (security@...driva.com)
Multiple vulnerabilities in RokMicroNews for WordPress ("MustLive" <mustlive@...security.com.ua>)
Re: %windir%\temp\sso\ssoexec.dll (or: howtrustworthy is Microsoft's build process) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
New version of JBrute (Gonzalo Camino <gonzalocamino@...il.com>)
[ MDVSA-2013:239 ] wordpress (security@...driva.com)

September 20 (4 messages)

Paypal Inc Bug Bounty #99 - Filter Bypass & Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2761-1] puppet security update (Raphael Geissert <geissert@...ian.org>)
GreHack 2013 - 15 Nov. Grenoble, France - Conf. Registration OPEN (Fab Duchene <f.duchene@...hack.org>)
Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

September 21 (1 message)

Defense in depth -- the Microsoft way (part 10) ("Stefan Kanthak" <stefan.kanthak@...go.de>)

September 22 (3 messages)

[ANN] Struts 2.3.15.2 GA release available - security fix (Lukasz Lenart <lukaszlenart@...che.org>)
Remote access to Android ftp server 1.2 configuration file allows login as admin ("Larry W. Cashdollar" <larry0@...com>)
DC4420 - London DEFCON - September meet - Tuesday 24th September 2013 (Tony Naggs <tonynaggs@...il.com>)

September 23 (2 messages)

[SECURITY] [DSA 2762-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)
Re: DC4420 - London DEFCON - September meet - Tuesday 24th September 2013 (Tony Naggs <tonynaggs@...il.com>)

September 24 (5 messages)

SYN ACK scans to random ports (silence_is_best@...hmail.com)
Re: SYN ACK scans to random ports (Fabio <ctrlaltca@...il.com>)
IBM AIX 6.1 / 7.1 - Local root Privilege Escalation (Kristian Erik Hermansen <kristian.hermansen@...il.com>)
[SECURITY] [DSA 2763-1] pyopenssl security update (Salvatore Bonaccorso <carnil@...ian.org>)
jetty shutdown ("Alonso Caballero Quezada / ReYDeS" <reydes@...il.com>)

September 25 (23 messages)

Re: SYN ACK scans to random ports (Crist Clark <cjclark@...m.mit.edu>)
Re: SYN ACK scans to random ports (Jan Murawski <der@...goetze.de>)
[Ruby on Rails] Move away from CookieStore if you care about your users and their security. Here is a technical explanat… ("G. S. McNamara" <main@...cnamara.com>)
Re: [Ruby on Rails] Move away from CookieStore if you care about your users and their security. Here is a technical explana… (joernchen <joernchen@...noelit.de>)
[ MDVSA-2013:240 ] glpi (security@...driva.com)
[ MDVSA-2013:241 ] perl-Crypt-DSA (security@...driva.com)
Re: [Ruby on Rails] Move away from CookieStore if you care about your users and their security. Here is a technical exp… (Tim <tim-security@...tinelchicken.org>)
Re: IBM AIX 6.1 / 7.1 - Local root Privilege Escalation (Bacanu Adrian-Daniel <darkzatarra@...oo.com>)
CVE-2013-5572 (Pablo González <pablo.gonzalezpe@...il.com>)
Re: SYN ACK scans to random ports (silence_is_best@...hmail.com)
Re: IBM AIX 6.1 / 7.1 - Local root Privilege Escalation (Timur R KHAKIMZYANOV <Timur.KHAKIMZYANOV@...ffeisen.ru>)
Re: SYN ACK scans to random ports (Justin Ferguson <jf@...co.net>)
Re: IBM AIX 6.1 / 7.1 - Local root Privilege Escalation (Tim Brown <tmb@...35.com>)
Cisco Security Advisory: Cisco IOS Software IPv6 Virtual Fragmentation Reassembly Denial of Service Vulnerability (Cisco Systems Product Security Incident Resp…)
Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Cisco Security Advisory: Cisco IOS Software Zone-Based Firewall and Content Filtering Vulnerability (Cisco Systems Product Security Incident Response Team <psi…)
Cisco Security Advisory: Cisco IOS Software Multicast Network Time Protocol Denial of Service Vulnerability (Cisco Systems Product Security Incident Response T…)
Cisco Security Advisory: Cisco IOS Software Queue Wedge Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com…)
Cisco Security Advisory: Cisco IOS Software DHCP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Memory Leak Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co…)
Cisco Security Advisory: Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability (Cisco Systems Product Security Incident Response…)
Multiple vulnerabilities in InstantCMS ("MustLive" <mustlive@...security.com.ua>)
[SECURITY] [DSA 2764-1] libvirt security update (Moritz Muehlenhoff <jmm@...ian.org>)

September 26 (4 messages)

[ MDVSA-2013:242 ] kernel (security@...driva.com)
XAMPP 1.8.1 Local Write Access Vulnerability (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[ISecAuditors Security Advisories] Multiple Reflected Cross-Site Scripting vulnerabilities (ISecAuditors Security Advisories <advisories@...cauditors.com>)
mod_accounting Blind SQL Injection (DS-2013-006) (Wire Ghoul <wireghoul@...il.com>)

September 27 (4 messages)

Announcment http://www.farlight.org (king cope <isowarez.isowarez.isowarez@...glemail.com>)
[SECURITY] [DSA 2765-1] davfs2 security update (Luciano Bello <luciano@...ian.org>)
Fwd: New version of JBrute (Gonzalo Camino <gonzalocamino@...il.com>)
[ MDVSA-2013:243 ] polkit (security@...driva.com)

September 28 (2 messages)

[SECURITY] [DSA 2766-1] linux-2.6 security update (dann frazier <dannf@...ian.org>)
Linux Kernel Patches For Linux Kernel Security (x90c <geinblues@...il.com>)

September 29 (2 messages)

Re: Linux Kernel Patches For Linux Kernel Security (Daniel Cegiełka <daniel.cegielka@...il.com>)
Pentest Mag, Data Recovery Magazine, and Software Developer's Journal Vulnerable to DOM XSS (Jay Turla <shipcodez@...il.com>)

September 30 (9 messages)

CVE-2013-4330: Apache Camel critical disclosure vulnerability (Christian Müller <christian.mueller@...il.com>)
Re: Pentest Mag, Data Recovery Magazine, and Software Developer's Journal Vulnerable to DOM XSS (silence_is_best@...hmail.com)
Re: Linux Kernel Patches For Linux Kernel Security (yersinia <yersinia.spiros@...il.com>)
[SECURITY] [DSA 27671-1] proftpd-dfsg security update (Nico Golde <nion@...ian.org>)
[ MDVSA-2013:244 ] davfs2 (security@...driva.com)
SimpleRisk v.20130915-01 CSRF-XSS Account Compromise (Ryan Dewhurst <ryandewhurst@...il.com>)
iOS: List of available trusted root certificates (iOS 7) (Jeffrey Walton <noloader@...il.com>)
Vulnerability in Privat24 for Android and iOS ("MustLive" <mustlive@...security.com.ua>)
iOS: List of available trusted root certificates (Jeffrey Walton <noloader@...il.com>)

187 messages

Powered by blists - more mailing lists