full-disclosure mailing list - 2014/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2014/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 17	² 25	³ 16	⁴ 17	⁵ 3	⁶ 12
⁷ 3	⁸ 18	⁹ 7	¹⁰ 35	¹¹ 38	¹² 4	¹³ 3
¹⁴ 6	¹⁵ 14	¹⁶ 21	¹⁷ 8	¹⁸ 5	¹⁹ 2	²⁰ 3
²¹ 3	²² 2	²³ 9	²⁴ 2	²⁵ 16	²⁶ 5	²⁷ 5
²⁸ 14	²⁹ 15	³⁰ 11

Messages by day:

April 1 (17 messages)

[FD] [SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service (details) (Security Explorations <contact@...urity-explorations.com>)
[FD] [SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service (details) (Security Explorations <contact@...urity-explorations.com>)
Re: [FD] [SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service (details) (Security Explorations <contact@...urity-explorations.com>)
Re: [FD] [SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service (details) (Security Explorations <contact@...urity-explorations.com>)
[FD] CBS Sports/CBS Interactive Security Contacts? (sec.research@...hmail.com)
[FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Bipin Gautam <bipin.gautam@...il.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction ("Philip Whitehouse" <philip@...uk.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Bipin Gautam <bipin.gautam@...il.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction ("Philip Whitehouse" <philip@...uk.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Willie Gillespie <wgillespie+fulldisclosure@...eng.co…)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Mario Vilas <mvilas@...il.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Eric Rand <eric.rand@...wnhatsecurity.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Andreas Lindh <addelindh@...il.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Sven 'Darkman' Michels <sven@...kman.de>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Ron <ron@...llsecurity.net>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (coderaptor <coderaptor@...il.com>)
[FD] Sorry I can't do this anymore. List closed! (Fyodor <fyodor@...p.org>)

April 2 (25 messages)

Re: [FD] CBS Sports/CBS Interactive Security Contacts? (Jeffrey Walton <noloader@...il.com>)
[FD] [Quantum Leap Advisory] #QLA140402 - A10 Networks remote Buffer Overflow (Francesco Perna <f.perna@...ntumleap.it>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Źmicier Januszkiewicz <gauri@....by>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (Joerg Mertin <smurphy@...sys.org>)
[FD] iShare Your Moving Library 1.0 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SEC Consult SA-20140402-0 :: Multiple vulnerabilities in Rhythm File Manager (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20140402-0 :: Multiple vulnerabilities in Rhythm File Manager (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] [MATTA-2013-004] CVE-2014-1409; MobileIron authentication bypass vulnerability (Florent Daigniere <florent.daigniere@...stmatta.com>)
[FD] Unusual XSS in Kyocera FS5250 printer control panel. (Jeff Sergeant <jeffuk@...il.com>)
[FD] Security flaw in Full Disclosure mailing list (Nick Lindridge <nick@...cube.com>)
Re: [FD] Security flaw in Full Disclosure mailing list (Ron <ron@...llsecurity.net>)
Re: [FD] Security flaw in Full Disclosure mailing list (Fyodor <fyodor@...p.org>)
Re: [FD] Security flaw in Full Disclosure mailing list (Reindl Harald <h.reindl@...lounge.net>)
Re: [FD] Security flaw in Full Disclosure mailing list (Eric G <eric@...wizard.net>)
Re: [FD] Bank of the West security contact? (raccoon <raccoon+fd@...post.org>)
Re: [FD] Security flaw in Full Disclosure mailing list (Jimmy Crossley <jcrossley@...etrix.com>)
Re: [FD] Security flaw in Full Disclosure mailing list (Fyodor <fyodor@...p.org>)
Re: [FD] Security flaw in Full Disclosure mailing list (Jim Popovitch <jimpop@...il.com>)
Re: [FD] Bank of the West security contact? (Stefan Weimar <stefan@...nhop3.de>)
Re: [FD] Security flaw in Full Disclosure mailing list (Ron <ron@...llsecurity.net>)
Re: [FD] Bank of the West security contact? ("Sholes, Joshua" <Joshua_Sholes@...le.comcast.com>)
Re: [FD] Security flaw in Full Disclosure mailing list (Jim Popovitch <jimpop@...il.com>)
Re: [FD] Security flaw in Full Disclosure mailing list (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] Security flaw in Full Disclosure mailing list (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] Security flaw in Full Disclosure mailing list (Brandon Perry <bperry.volatile@...il.com>)

April 3 (16 messages)

[FD] 0A29-14-1 : NCCGroup EasyDA privilege escalation & credential disclosure vulnerability [0day] (0a29 40 <0a2940@...il.com>)
[FD] Capstone 2.1.2 released! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] Drupal Custom Search module XSS (Justin Klein Keane <justin@...irish.net>)
Re: [FD] Security flaw in Full Disclosure mailing list (Jeffrey Walton <noloader@...il.com>)
Re: [FD] Fulldisclosure Digest, Vol 2, Issue 3 (Greg Bromage <gbromage@...neta.com>)
Re: [FD] Bank of the West security contact? (Eric Rand <eric.rand@...wnhatsecurity.com>)
Re: [FD] Bank of the West security contact? (raccoon <raccoon+fd@...post.org>)
Re: [FD] Bank of the West security contact? (Stefan Weimar <stefan@...nhop3.de>)
Re: [FD] Bank of the West security contact? (Jeffrey Walton <noloader@...il.com>)
Re: [FD] Security flaw in Full Disclosure mailing list (George Chatzisofroniou <sophron@...thi.com>)
[FD] Private Photo+Video v1.1 Pro iOS - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Announcing sysdig: a new open source system exploration tool (Loris Degioanni <loris@...ios.com>)
Re: [FD] CBS Sports/CBS Interactive Security Contacts? (sec.research@...hmail.com)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (illwill <illwill@...mob.org>)
[FD] XSS Reflected vulnerabilities in OS of FortiADC v3.2 (CVE-2014-0331) (William Costa <william.costa@...il.com>)
Re: [FD] Access anyone's Facebook "profile picture" in full resolution regardless of the ACL restriction (William Reyor <opticfiber@...il.com>)

April 4 (17 messages)

[FD] Security Industry Scams and Lies (Pete Herzog <pete@...com.org>)
[FD] Uncontrolled Resource Consumption with Highly-Compressed XMPP Stanzas (Giancarlo Pellegrino <gpellegrino@...tu-darmstadt.de>)
[FD] Phrack Security Advisory 2014-001 - Paper leak on release timeout (Phrack Staff <staff@...ack.org>)
[FD] Remote Command Execution within the ASUS RT-AC68U Managing Web Interface (Palula Brasil <palulabrasil@...il.com>)
[FD] Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface (Palula Brasil <palulabrasil@...il.com>)
[FD] Legality of Open Source Tools (Bryan Bickford <bryan@...wildhats.com>)
Re: [FD] Legality of Open Source Tools (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] Legality of Open Source Tools (Andres Riancho <andres.riancho@...il.com>)
Re: [FD] Legality of Open Source Tools (Andres Riancho <andres.riancho@...il.com>)
[FD] Call for Papers: Privacy-Preserving IR (PIR) Workshop At SIGIR 2014 (lei cen <cenlei2000@...il.com>)
[FD] Credit Cards for 1.2 Million Drivers Vulnerable at TxTag.org (David Longenecker <dnlongen@...il.com>)
Re: [FD] Remote Command Execution within the ASUS RT-AC68U Managing Web Interface (Craig Young <vuln-report@...ur3.us>)
Re: [FD] Legality of Open Source Tools (Ryan Dewhurst <ryandewhurst@...il.com>)
Re: [FD] Legality of Open Source Tools (Sullo <csullo@...il.com>)
Re: [FD] Legality of Open Source Tools (Not EcksKaySeeDee <noteckskayseedee@...il.com>)
Re: [FD] Legality of Open Source Tools ("Brunner, Mark" <Mark.Brunner@...okfield.com>)
Re: [FD] Legality of Open Source Tools (Volker Tanger <vtlists@...e.de>)

April 5 (3 messages)

Re: [FD] Legality of Open Source Tools (Toni Korpela <admin@...fork.com>)
Re: [FD] Legality of Open Source Tools (Toni Korpela <admin@...fork.com>)
Re: [FD] Legality of Open Source Tools (John Young <jya@...eline.com>)

April 6 (12 messages)

Re: [FD] Legality of Open Source Tools (Henri Salo <henri@...v.fi>)
Re: [FD] Legality of Open Source Tools (coderman <coderman@...il.com>)
Re: [FD] Legality of Open Source Tools (Jeffrey Walton <noloader@...il.com>)
Re: [FD] AUTO: Bryant Smith is out of the office (returning 04/08/2014) (coderman <coderman@...il.com>)
Re: [FD] Legality of Open Source Tools (coderman <coderman@...il.com>)
Re: [FD] SCADA StrangeLove 30C3 releases: all in one (coderman <coderman@...il.com>)
Re: [FD] Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface (coderman <coderman@...il.com>)
Re: [FD] Remote Command Execution within the ASUS RT-AC68U Managing Web Interface (coderman <coderman@...il.com>)
Re: [FD] Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface (Palula Brasil <palulabrasil@...il.com>)
[FD] MacOSX 10.9.2/XNU HFS Multiple Vulnerabilities ("[CXSEC]" <submit@...ec.org>)
Re: [FD] Legality of Open Source Tools (Toni Korpela <admin@...fork.com>)
Re: [FD] Legality of Open Source Tools (Toni Korpela <admin@...fork.com>)

April 7 (3 messages)

[FD] Advisory: Security Industry Scams and Lies (Nico Le Moin <nicolemoin01@...il.com>)
Re: [FD] Legality of Open Source Tools (Daniel Wood <daniel.wood@...sp.org>)
[FD] NoSuchCon 2014 CFP is now open (NoSuchCon <cfp@...uchcon.org>)

April 8 (18 messages)

[FD] heartbleed OpenSSL bug CVE-2014-0160 (Kirils Solovjovs <kirils.solovjovs@...ils.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Andrew Case <atcuno@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (David H <ispcolohost@...il.com>)
[FD] Bluetooth Text Chat v1.0 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Fraser Scott <fraser.scott@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Joerg Mertin <smurphy@...sys.org>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Nik Mitev <nik@...ev.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Jann Horn <jann@...jh.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Chris Schmidt <chris.schmidt@...trastsecurity.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Justin Bull <me@...tinbull.ca>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Francesc Guitart <fguitart@....com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (David H <ispcolohost@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Matthew Musingo <matthew.musingo@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Nik Mitev <nik@...ev.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Ricardo Iramar dos Santos <riramar@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Jann Horn <jann@...jh.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Tim Schütt <schuett@...a-net.de>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Chris Schmidt <chris.schmidt@...trastsecurity.com>)

April 9 (7 messages)

[FD] iis cgi 0day (yuange <yuange1975@...mail.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Fabien Bourdaire <lists@...c.co.uk>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Reindl Harald <h.reindl@...lounge.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Jeremy Voorhis <jvoorhis@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Daniel Franke <dfoxfranke@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Aidan Thornton <makosoft@...il.com>)

April 10 (35 messages)

Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Rob van der Putten <rob@...t.nl>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Peter Malone <peter@...ermalone.org>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Peter Malone <peter@...ermalone.org>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Coderaptor <coderaptor@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Craig Holmes <craig@...eaunetworks.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Juergen Christoffel <jc@...er.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Ronny Lauenstein <Lauenstein@...l.mpg.de>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Walt Williams <walt.williams@...il.com>)
Re: [FD] iis cgi 0day (yuange <yuange1975@...mail.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Menso Heus <heus@...epressunlimited.org>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (* <turmoil@...vacyrequired.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Txalin <txalin@...il.com>)
Re: [FD] iis cgi 0day (YiFei Yang <le.concorde.4590@...il.com>)
[FD] When two-factor authentication is not enough (Alfie John <alfiej@...tmail.fm>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Javier Reoyo <javier.reoyo@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Pål Nilsen <paal.nilsen@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Reindl Harald <h.reindl@...lounge.net>)
[FD] AppFish Offline Coder v2.2 iOS - Persistent Software Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] BlueMe Bluetooth v5.0 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] iVault Private P&V 1.1 iOS - Path Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] New tool: sn00p - Automation framework for security tests. (Levon Kayan <noptrix@...lsecurity.net>)
Re: [FD] When two-factor authentication is not enough (Jeff Sergeant <jeffuk@...il.com>)
[FD] Malware + Analyse = Malwarelyse (<mschratt@...-enterprise.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 ("Brandon Vincent (Student)" <Brandon.Vincent@....edu>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Carlos P <charly_en_el_trabajo@...oo.com>)
[FD] heartbleed.c (Hacker Fantastic <hackerfantastic@...glemail.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Ken Connelly <Ken.Connelly@....edu>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Pål Nilsen <paal.nilsen@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Reindl Harald <h.reindl@...lounge.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Ingo Schmitt <ingo.schmitt@...arysignals.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (David Tomaschik <david@...temoverlord.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 ("Ivan .Heca" <ivanhec@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Jann Horn <jann@...jh.net>)

April 11 (38 messages)

Re: [FD] heartbleed.c (Hacker Fantastic <hackerfantastic@...glemail.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] heartbleed.c (Hacker Fantastic <hackerfantastic@...glemail.com>)
[FD] Heartbleed exploited since 2013 (des-apare.cido_77@...istici.org)
[FD] NEW VMSA-2014-0003 VMware vSphere Client updates address security vulnerabilities ("\"VMware Security Response Center\"" <security@...are.com>)
Re: [FD] iis cgi 0day (YiFei Yang <le.concorde.4590@...il.com>)
[FD] FW: dve bypass dep+aslr+emet+cfi (yuange <yuange1975@...mail.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Paul Vixie <paul@...barn.org>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Paul Vixie <paul@...barn.org>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Paul Vixie <paul@...barn.org>)
[FD] SEC Consult SA-20140411-0 :: Multiple vulnerabilities in Plex Media Server (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Woltlab Burning Board 3.9.1 - Persistent Web Vulnerability & Editor Reverse Encoding Issue (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Michal Zalewski <lcamtuf@...edump.cx>)
[FD] CVE-2014-2384 - Invalid Pointer Dereference in VMware Workstation and Player (Portcullis Advisories <advisories@...tcullis-security.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 ("Ivan .Heca" <ivanhec@...il.com>)
Re: [FD] FW: dve bypass dep+aslr+emet+cfi (YiFei Yang <le.concorde.4590@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Manuel Tiago Pereira <mt.pereira@...il.com>)
[FD] The state of infection in Uanet 2013 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Ricardo Iramar dos Santos <riramar@...il.com>)
[FD] AIMSICD: Developers for Android-App WANTED! ("SecUpwN" <secupwn@....biz>)
[FD] CSRF and stored XSS in Quick Page/Post Redirect Plugin (WordPress plugin) (dxw Security <security@....com>)
[FD] CSRF/XSS vulnerability in Twitget 3.3.1 (WordPress plugin) (dxw Security <security@....com>)
[FD] MRI Rubies may contain statically linked, vulnerable OpenSSL (glitch <glitch@...tchwrks.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Reindl Harald <h.reindl@...lounge.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (HaCKsPy <hackspy@...il.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 ("Marco Davids (priv)" <mdavids@...fun.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Juergen Christoffel <jc@...er.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Ferenc Kovacs <tyra3l@...il.com>)
[FD] Andrew "Weev" Auernheimer's Conviction Thrown Out ("g@...7.io" <g@...7.io>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Joerg Mertin <smurphy@...sys.org>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Seth Arnold <seth.arnold@...onical.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 ("Schmidt, Michael" <michael.schmidt@...greens.com>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Carlos P <charly_en_el_trabajo@...oo.com>)
[FD] Multiple CSRF and XSS vulnerabilities in D-Link DAP 1150 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] Andrew "Weev" Auernheimer's Conviction Thrown Out (Jeffrey Paul <sneak@...avibe.net>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] Andrew "Weev" Auernheimer's Conviction Thrown Out (Groundworks Technologies Advisories <advisories@...undworkstech.com>)

April 12 (4 messages)

[FD] DoS condition mt-daapd/Firefly Media Server 0.2.4.2 (Eric Michaud <michaud.eric.c@...il.com>)
Re: [FD] DoS condition mt-daapd/Firefly Media Server 0.2.4.2 ("Brandon Vincent (Student)" <Brandon.Vincent@....edu>)
Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 (Afonso Araújo Neto <afonso.araujo@...il.com>)
[FD] Synergy's Crypto Sucks (Taylor Hornby <havoc@...use.ca>)

April 13 (3 messages)

[FD] Adobe Reader for Android exposes insecure Javascript interfaces ("Securify B.V." <lists@...urify.nl>)
[FD] Socialtext as a DoS tool? (Brandon Perry <bperry.volatile@...il.com>)
[FD] New multiple CSRF and XSS vulnerabilities in D-Link DAP 1150 ("MustLive" <mustlive@...security.com.ua>)

April 14 (6 messages)

[FD] Two Possible Vulnerabilities in courier-imapd? (Peter Malone <peter@...ermalone.org>)
Re: [FD] Two Possible Vulnerabilities in courier-imapd? (Dan Anderson <dan-anderson@....net>)
Re: [FD] Two Possible Vulnerabilities in courier-imapd? (Peter Malone <peter@...ermalone.org>)
[FD] CVE-2013-6216 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH in multiple HP products on Li… (Portcullis Advisories <advisories@...tc…)
[FD] CVE-2014-2591 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH in BMC Patrol for AIX (Portcullis Advisories <advisories@...tcullis-s…)
[FD] PDF Album v1.7 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

April 15 (14 messages)

[FD] New PHP-Attack Vector ? (Thomas Lußnig <lussnig@...he.org>)
Re: [FD] New PHP-Attack Vector ? (Michael Baker <michael@...ttlecorp.com>)
Re: [FD] New PHP-Attack Vector ? (Martti Kühne <mar77i@...77i.ch>)
[FD] Unitrends enterprise backup remote unauthenticated root (Brandon Perry <bperry.volatile@...il.com>)
[FD] Xerox DocuShare authenticated SQL injection (Brandon Perry <bperry.volatile@...il.com>)
[FD] CVE-2013-6216 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH in multiple HP products on Li… (Portcullis Advisories <advisories@...tc…)
[FD] WebTitan 4.01 multiple vulnerabilities (Brandon Perry <bperry.volatile@...il.com>)
[FD] HackMiami 2014 Hackers Conference in Miami Beach, FL - May 9-11, 2014 (Alex HackMiami <alex@...kmiami.info>)
[FD] Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Georgi Guninski <guninski@...inski.com>)
[FD] Auditing systems for vulnerable 3rd-party OpenSSL (Gabriel Brezi <gb@...rau.lc>)
[FD] lxml (python lib) vulnerability (Максим Кочкин <maxxarts@...il.com>)
Re: [FD] Auditing systems for vulnerable 3rd-party OpenSSL (Dotzero <dotzero@...il.com>)
Re: [FD] Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Hanno Böck <hanno@...eck.de>)
Re: [FD] Auditing systems for vulnerable 3rd-party OpenSSL (Mike Iglesias <iglesias@....edu>)

April 16 (21 messages)

[FD] Audit: don't only focus on heartbleed issue (Shawn <citypw@...il.com>)
Re: [FD] Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Georgi Guninski <guninski@...inski.com>)
Re: [FD] Auditing systems for vulnerable 3rd-party OpenSSL (James Lay <jlay@...ve-tothe-box.net>)
Re: [FD] iis cgi 0day (Davide Davini <diotonante@...il.com>)
Re: [FD] Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Hanno Böck <hanno@...eck.de>)
Re: [FD] iis cgi 0day (Reindl Harald <h.reindl@...lounge.net>)
Re: [FD] Audit: don't only focus on heartbleed issue (Ron Bowes <ron@...llsecurity.net>)
[FD] CVE-2014-2597 - Denial of Service in PCNetSoftware RAC Server (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] [CORE-2014-0003] - SAP Router Password Timing Attack (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Reflected XSS Attacks vulnerabilities F-Secure Messaging Security Gateway V7.5.0.892 (CVE-2014-2844) (William Costa <william.costa@...il.com>)
[FD] Suspect arrested who used Heartbleed to infiltrate the Canada Revenue Agency (Our IRS) (Justin Bull <me@...tinbull.ca>)
[FD] ASUS RT-XXXX SOHO routers expose admin password, fixed in 3.0.0.4.374.5517 (David Longenecker <dnlongen@...il.com>)
[FD] Buggy insecure "security" software executes rogue binary during installation and uninstallation ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] Audit: don't only focus on heartbleed issue (Hanno Böck <hanno@...eck.de>)
Re: [FD] Audit: don't only focus on heartbleed issue (Paul McMillan <paul@...illan.ws>)
Re: [FD] Audit: don't only focus on heartbleed issue (antisnatchor <antisnatchor@...il.com>)
Re: [FD] Audit: don't only focus on heartbleed issue (Reindl Harald <h.reindl@...lounge.net>)
[FD] Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC (Gregory Disney <gdisney@...rust.com>)
Re: [FD] Audit: don't only focus on heartbleed issue (Tim <tim-security@...tinelchicken.org>)
Re: [FD] Audit: don't only focus on heartbleed issue (Reindl Harald <h.reindl@...lounge.net>)
Re: [FD] Suspect arrested who used Heartbleed to infiltrate the Canada Revenue Agency (Our IRS) (Andrew Klaus <andrewklaus@...il.com>)

April 17 (8 messages)

Re: [FD] Suspect arrested who used Heartbleed to infiltrate the Canada Revenue Agency (Our IRS) (Joe Pierini <jpierini@...sw.com>)
[FD] ldd for OS X WAS:Auditing systems for vulnerable 3rd-party OpenSSL (Gabriel Brezi) (Douglas Held <risk@...glasheld.net>)
Re: [FD] ldd for OS X WAS:Auditing systems for vulnerable 3rd-party OpenSSL (Gabriel Brezi) (Tim Heckman <tim+fd@...erduty.com>)
[FD] CVE-2014-2597 - Denial of Service in PCNetSoftware RAC Server (Portcullis Advisories <advisories@...tcullis-security.com>)
Re: [FD] Audit: don't only focus on heartbleed issue (Stephane Bortzmeyer <bortzmeyer@....fr>)
Re: [FD] Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
[FD] NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (golunski <golunski@...t.eu>)
Re: [FD] Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Jeffrey Walton <noloader@...il.com>)

April 18 (5 messages)

Re: [FD] NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (Jakob Rößler <roessler@...halt.de>)
[FD] Remote Command Injection in Ruby Gem sfpagent 0.4.14 ("Larry W. Cashdollar" <larry0@...com>)
[FD] CS and XSS vulnerabilities in CU3ER ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] iis cgi 0day (Homer Parker <hparker@...ershut.net>)
[FD] CSRF, AoF and XSS vulnerabilities in D-Link DAP 1150 ("MustLive" <mustlive@...security.com.ua>)

April 19 (2 messages)

Re: [FD] iis cgi 0day (YiFei Yang <le.concorde.4590@...il.com>)
[FD] no good signals in infosec (coderman <coderman@...il.com>)

April 20 (3 messages)

[FD] phpManufaktur / kitForm Unauthenticated SQL Injection Vulnerability (Chapp <chapp@...ox.com>)
Re: [FD] [ANN] Struts 2.3.16.1 GA release available - security fix (Takeshi Terada <mbsdtest01@...il.com>)
[FD] Vulnerabilities in plugins with CU3ER for WordPress, Joomla, SilverStripe and Plone ("MustLive" <mustlive@...security.com.ua>)

April 21 (3 messages)

[FD] CS, XSS and FPD vulnerabilities in multiple plugins with CU3ER for WordPress ("MustLive" <mustlive@...security.com.ua>)
[FD] BlackArch Linux / New ISOs released (Levon Kayan <noptrix@...lsecurity.net>)
[FD] RAT C2 Domains (Kevin Breen <mymalwaresamples@...il.com>)

April 22 (2 messages)

[FD] Parallels Plesk Panel 12.x & 11.x /etc/psa/private/secret_key leakage (Tim Rots <timrots.nl.throwaway@...il.com>)
[FD] (CVE-2014-1648) Symantec Messaging Gateway Management Console Cross Site Scripting Vulnerability (William Costa <william.costa@...il.com>)

April 23 (9 messages)

[FD] SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances (SEC Consult Vulnerability Lab <research@...-cons…)
[FD] CVE-2014-2383 - Arbitrary file read in dompdf (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive (Portcullis Advisories <advisories@...tcullis-secur…)
[FD] CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] AirPhoto WebDisk v4.1.0 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive (Portcullis Advisories <advisories@...tcullis-secur…)
[FD] CVE-2014-2383 - Arbitrary file read in dompdf (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] Request for help exploiting seunshare (Andrew Lutomirski <luto@....edu>)

April 24 (2 messages)

[FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Rene Gielen <rgielen@...che.org>)
[FD] Advisory: jruby-sandbox Breakout (joernchen <joernchen@...noelit.de>)

April 25 (16 messages)

[FD] Multiple Vulnerabilities in iMember360 (Wordpress plugin) (Everett Griffiths <everett@...eproofsocks.com>)
[FD] Depot WiFi v1.0.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Tim <tim-security@...tinelchicken.org>)
[FD] UI redress attack on live.com (affected all pages) (Sandeep Kamble <sandeepk.l337@...il.com>)
Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Rene Gielen <rgielen@...che.org>)
Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Rene Gielen <rgielen@...che.org>)
[FD] Legitimacy of new Heartbleed exploit? (Dillon Korman <me@...lonkorman.com>)
Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Tim <tim-security@...tinelchicken.org>)
Re: [FD] Legitimacy of new Heartbleed exploit? (Jann Horn <jann@...jh.net>)
[FD] CS, XSS and FPD vulnerabilities in multiple themes with CU3ER for WordPress ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] Legitimacy of new Heartbleed exploit? (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] Legitimacy of new Heartbleed exploit? ("H. Dong" <julius.kivimaki@...il.com>)
Re: [FD] Legitimacy of new Heartbleed exploit? (Bennett Todd <bet@...ul.net>)
Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Tim <tim-security@...tinelchicken.org>)
Re: [FD] Legitimacy of new Heartbleed exploit? (Peter Malone <peter@...ermalone.org>)
Re: [FD] Legitimacy of new Heartbleed exploit? (david switzer <david.e.switzer@...il.com>)

April 26 (5 messages)

Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Rene Gielen <rgielen@...che.org>)
Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Alexander Georgiev <alexander.georgiev@...oo.de>)
[FD] Divx plugin suite heap-based buffer overflow (Andres Gomez Ramirez <andres.gomez@...n.ch>)
[FD] Symantec Endpoint Protection – Remote Buffer Overflow PoC (CVE-2013-1612) (Jérôme Nokin <jerome@...laby.be>)
[FD] DAVOSET v.1.2 ("MustLive" <mustlive@...security.com.ua>)

April 27 (5 messages)

Re: [FD] DAVOSET v.1.2 (laurent gaffie <laurent.gaffie@...il.com>)
Re: [FD] DAVOSET v.1.2 (Brandon Perry <bperry.volatile@...il.com>)
[FD] Exploit: McAfee ePolicy 0wner (ePowner) – Release (Jérôme Nokin <jerome@...laby.be>)
Re: [FD] Exploit: McAfee ePolicy 0wner (ePowner) – Release (Jérôme Nokin <jerome@...laby.be>)
Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Rene Gielen <gielen@...neering.net>)

April 28 (14 messages)

Re: [FD] [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical) (Rene Gielen <rgielen@...che.org>)
Re: [FD] Legitimacy of new Heartbleed exploit? (Ivan Kwiatkowski <ivan@...atkowski.fr>)
[FD] Telegram authentication bypass (jdiaz@...t.inteco.es)
[FD] [Onapsis Security Advisory 2014-005] Information disclosure in SAP Software Lifeclycle Manager (Onapsis Research Labs <research@...psis.com>)
Re: [FD] Telegram authentication bypass (Dominik Schürmann <dominik@...inikschuermann.de>)
Re: [FD] Telegram authentication bypass (Hanno Böck <hanno@...eck.de>)
[FD] What the hell am I reading? (was: Telegram authentication bypass) (Munchausen <munchausen@...eup.net>)
[FD] Multiple CSRF and XSS vulnerabilities in D-Link DAP 1150 ("MustLive" <mustlive@...security.com.ua>)
[FD] [Onapsis Security Advisory 2014-005] Information disclosure in SAP Software Lifeclycle Manager (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-006] Missing authorization check in SAP Background Processing RFC (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-008] SAP NW Portal WD Information Disclosure (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-009] SAP BASIS Missing Authorization Check (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-010] SAP BusinessObjects InfoView Reflected Cross Site Scripting (Onapsis Research Labs <research@...psis.com>)

April 29 (15 messages)

Re: [FD] Telegram authentication bypass (jdiaz@...t.inteco.es)
[FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin) (dxw Security <security@....com>)
[FD] [Onapsis Security Advisory 2014-008] SAP NW Portal WD Information Disclosure (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-006] Missing authorization check in SAP Background Processing RFC (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-009] SAP BASIS Missing Authorization Check (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-010] SAP BusinessObjects InfoView Reflected Cross Site Scripting (Onapsis Research Labs <research@...psis.com>)
[FD] AOL confirms compromise (Daniel Hadfield <dan@...gsweep.co.uk>)
[FD] DoS - Intuit QuickBase (Scott Arciszewski <scott@...iszewski.me>)
Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin) (Illwill <illwill@...mob.org>)
Re: [FD] Telegram authentication bypass (Mario Vilas <mvilas@...il.com>)
Re: [FD] Telegram authentication bypass (Tony Arcieri <bascule@...il.com>)
Re: [FD] AOL confirms compromise (Jeffrey Walton <noloader@...il.com>)
Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin) (Dave Warren <davew@...eahit.com>)
Re: [FD] AOL confirms compromise (Brandon Perry <bperry.volatile@...il.com>)

April 30 (11 messages)

[FD] SEC Consult SA-20140430-0 :: SQL injection and persistent XSS in the Typo3 3rd party extension si_bibtex (SEC Consult Vulnerability Lab <research@...-cons…)
Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin) (Harry Metcalfe <harry@....com>)
Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin) (Harry Metcalfe <harry@....com>)
[FD] LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access ("LSE Leading Security Experts GmbH (Security Advisories)" <ad…)
[FD] Syhunt Advisory: CGILua session.lua Predictable Session ID Vulnerability (Felipe Daragon <felipe@...unt.com>)
Re: [FD] lxml (python lib) vulnerability (Źmicier Januszkiewicz <gauri@....by>)
[FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files (Alton Blom <altonius@...il.com>)
Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files (Gynvael Coldwind <gynvael@...dwind.pl>)
Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files (Alton Blom <altonius@...il.com>)
Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files (Mike Cramer <mike.cramer@...look.com>)

339 messages

Powered by blists - more mailing lists