full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2014/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 1	² 1	³
⁴ 15	⁵ 4	⁶ 4	⁷ 5	⁸	⁹	¹⁰
¹¹	¹² 7	¹³ 2	¹⁴ 1	¹⁵ 1	¹⁶ 6	¹⁷ 1
¹⁸ 3	¹⁹ 2	²⁰ 8	²¹ 1	²² 1	²³	²⁴
²⁵ 7	²⁶ 3	²⁷ 8	²⁸ 3	²⁹	³⁰ 3	³¹ 3

Messages by day:

August 1 (1 message)

[FD] Photo WiFi Transfer 1.01 - Directory Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 2 (1 message)

[FD] C++11 <regex> insecure by default ("[CXSEC]" <submit@...ec.org>)

August 4 (15 messages)

[FD] Video WiFi Transfer 1.01 - Directory Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FreeDisk v1.01 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Inc Magento ProStore CP #4 - Filter Validation Bypass & Persistent (Payment Information) Vulnerability (Vulnerability Lab <research@...nerability-lab…)
[FD] CVE-2014-2595 - Authentication Bypass in Barracuda Web Application Firewall (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] Superfish 7.x Minor Cross Site Scripting Vulnerability (Ubani Balogun <ubani@....upenn.edu>)
[FD] Paypal Complete 2-Factor Authentication(2FA) Bypass Exploit. Working as of August 5th, 2014. (Joshua Rogers <megamansec@...il.com>)
[FD] [CVE- Requested][Vembu Storegrid - Multiple Critical Vulnerabilities] (Mike Antcliffe <mikeantcliffe@...icallysecure.com>)
[FD] LinkedIn User Account Handling Vulnerability(s) (Kishor Sonawane <kishorsonawane@...il.com>)
[FD] HybridAuth <= 2.1.2 Remote Code Execution (Pichaya Morimoto <pichaya@...e.org>)
[FD] Microsoft Exchange Multiple Vulnerabilities (Nathan Power <np@...uritypentest.com>)
Re: [FD] XXE Injection in HP Release Control (Douglas Held <risk@...glasheld.net>)
[FD] Outdated Software on Huffington Post (BM-2cUyyVgPPf214fLtM7Kj9NxMSmKpdkYnog@...message.ch)
[FD] Preferred Roaming List Zero Intercept Attack [was: DEF CON nostalgia [before that: going double cryptome at DEF CON 22]][sti… (coderman <coderman@...il.com>)
Re: [FD] Preferred Roaming List Zero Intercept Attack [was: DEF CON nostalgia [before that: going double cryptome at DEF CON 22]]… (coderman <coderman@...il.com>)
Re: [FD] Preferred Roaming List Zero Intercept Attack [was: DEF CON nostalgia [before that: going double cryptome at DEF CON 22]]… (coderman <coderman@...il.com>)

August 5 (4 messages)

Re: [FD] XXE Injection in HP Release Control (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] Superfish 7.x Minor Cross Site Scripting Vulnerability (Greg Knaddison <greg.knaddison@...il.com>)
[FD] (kind of) new tool: american fuzzy lop (Michal Zalewski <lcamtuf@...edump.cx>)
[FD] SEC Consult SA-20140805-0 :: Multiple vulnerabilities in Readsoft Invoice Processing and Process Director (SEC Consult Vulnerability Lab <research@...-con…)

August 6 (4 messages)

[FD] (CVE-2014-3500/1/2) Apache Cordova for Android - Multiple Vulnerabilities (David Kaplan <DAVIDKA@...ibm.com>)
[FD] HybridAuth <= 2.2.2 Remote Code Execution (0-day again) (Pichaya Morimoto <pichaya@...e.org>)
[FD] PhotoSync Wifi & Bluetooth v1.0 - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PhotoSync v2.2 iOS - Command Inject Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 7 (5 messages)

[FD] TomatoCart v1.x (latest-stable) Multiple Vulnerabilities (Kenny Mathis <kenny@...aking.technology>)
[FD] Vulnerabilities in Vembu Backup and Disaster Recovery addressed (Len Srinivasan <len@...bu.com>)
[FD] Outlook XML Bomb? (Melchior Limacher <mli@...tect7.com>)
[FD] nullcon CFP is open (nullcon <nullcon@...lcon.net>)
[FD] Easy FTP Pro v4.2 iOS - Command Inject Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

August 12 (7 messages)

[FD] Perverting Embedded Devices - ZKSoftware Fingerprint Reader (Part I) (Francisco Amato <famato@...obytesec.com>)
[FD] CS-Cart v4.2.0 Session Hijack and Other Vulnerabilities (Nik Cubrilovic <nikcub@...il.com>)
[FD] “Steganos Online Shield VPN” leaks the user’s hostname in the HTTP “Via” header (Stefan Paletta <stefanp@...al1.net>)
[FD] Beginners error: QuickTime for Windows runs rogue program C:\Program.exe when opening associated files ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] CVE-2014-5035 - Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service (Gregory Pickett <gpickett71@...oo.com>)
[FD] Multiple Vulnerabilities in Disqus for Wordpress v2.7.5 (Nik Cubrilovic <nikcub@...il.com>)
Re: [FD] Beginners error: QuickTime for Windows runs rogue program C:\Program.exe when opening associated files (Reindl Harald <h.reindl@...lounge.net>)

August 13 (2 messages)

[FD] mind tricks and other hacks (Pete Herzog <lists@...com.org>)
[FD] [TOOL] Haka v0.2 release! (Mehdi Talbi <talbimehdi@...il.com>)

August 14 (1 message)

[FD] Optical Society of America's peer-review system can leaks reviewers' usernames (peter.wiedekind@...hmail.com)

August 15 (1 message)

Re: [FD] “Steganos Online Shield VPN” leaks the user’s hostname in the HTTP “Via” header (Adam Dodson <adam@...mdodson.org>)

August 16 (6 messages)

[FD] XSS Reflected vulnerability in RiverBed Stingray Traffic Manager Virtual Appliance V 9.6 (William Costa <william.costa@...il.com>)
[FD] Reminder: CFP closes next week for PacSec.jp in Tokyo Nov12-13 ("Dragos Ruiu" <dr@....net>)
[FD] Beginners error: Windows Live Mail 2011 runs rogue C:\Program.exe when opening associated URLs ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Beginners error: Apple's Software Update runs rogue program C:\Program.exe (and some more) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Beginners error: Apple's iCloudServices for Windows run rogue program C:\Program.exe (and some more) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] CSRF in Disqus for Wordpress 2.77 ("Voxel@...ht" <voxelnight@...atioustendencies.com>)

August 17 (1 message)

[FD] Outlook.com for Android fails to validate server certificates ("Securify B.V." <lists@...urify.nl>)

August 18 (3 messages)

[FD] CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack (Dirk-Willem van Gulik <dirkx@...weaving.org>)
[FD] Hilariously Bad SQRL Implementation (Scott Arciszewski <kobrasrealm@...il.com>)
[FD] VISA USA VULNERABILITY (labz@....com)

August 19 (2 messages)

Re: [FD] Outlook XML Bomb? (Melchior Limacher) (<Louis.Nadeau@...tley.com>)
[FD] PRESS RELEASE :: Phuture Conference Denver OCT 11 (stevyn prothero <ironfeatherbooks@...il.com>)

August 20 (8 messages)

[FD] CVE-2014-4973 - Privilege Escalation in ESET Windows Products (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-5307 - Privilege Escalation in Panda Security Products (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] Information disclosure vulnerability in WordPress Mobile Pack allows anybody to read password protected posts (WordPress p… (dxw Security <security@....com>)
[FD] [The ManageOwnage Series, part I]: blind SQL injection in two servlets (metasploit module included) (Pedro Ribeiro <pedrib@...il.com>)
[FD] WHMCS Moipapi DoS & Memory Consumption Vulnerability 5.3.5 (surivaton surivaton <surivaton@...il.com>)
[FD] [CORE-2014-0004] - Delphi and C++ Builder VCL library Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)
Re: [FD] Hilariously Bad SQRL Implementation (Scott Arciszewski <kobrasrealm@...il.com>)
Re: [FD] Hilariously Bad SQRL Implementation (Travis Biehn <tbiehn@...il.com>)

August 21 (1 message)

Re: [FD] Hilariously Bad SQRL Implementation (Sanguinarious <Sanguinarious@...ultusTerra.com>)

August 22 (1 message)

[FD] DoS attacks (ICMPv6-based) resulting from IPv6 EH drops (Fernando Gont <fgont@...networks.com>)

August 25 (7 messages)

[FD] Barracuda Networks Web Security Flex Appliance Application v4.x - Filter Bypass & Persistent Vulnerabilities (BNSE… (Vulnerability Lab <research@...nerabili…)
[FD] Barracuda Networks Web Security Flex v4.1 - Persistent Vulnerabilities (BNSEC-699) (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CVE-2014-2081 - VTLS Virtua InfoStation.cgi SQLi. ("J. Tozo" <juniorbsd@...il.com>)
[FD] ntopng 1.2.0 XSS injection using monitored network traffic (Steffen Bauch <mail@...ffenbauch.de>)
Re: [FD] Hilariously Bad SQRL Implementation (Scott Arciszewski <scott@...iszewski.me>)
[FD] MyBB 1.6 - MyAwards CSRF (surivaton surivaton <surivaton@...il.com>)
[FD] RCE in dragonfly gem (leex <leex@...m.me>)

August 26 (3 messages)

[FD] CVE-2014-5119 glibc __gconv_translit_find() exploit (Tavis Ormandy <taviso@...gle.com>)
[FD] LSE Leading Security Experts GmbH - LSE-2014-07-13 - Granding Grand MA 300 - Weak Pin Verification (advisories <advisories@...xperts.de>)
[FD] VMware vm-support multiple vulnerabilities ("Dolev Farhi" <dolevf@...oo.com>)

August 27 (8 messages)

[FD] Fwd: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks (Fernando Gont <fgont@...networks.com>)
[FD] Mathematica10.0.0 on Linux /tmp/MathLink vulnerability (paul.szabo@...ney.edu.au)
[FD] ManageEngine EventLog Analyzer 7 Reflective cross-site scripting Vulnerability [CVE-2014-4930] ("Contarino, Rodrigo (LATCO - Buenos Aires)" <rcontarino@DE…)
[FD] [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert (Pedro Ribeiro <pedrib@...il.com>)
Re: [FD] [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert (Pedro Ribeiro <pedrib@...il.com>)
[FD] PHP-Wiki Command Injection ("Benjamin Harris" <bch@...h.ai>)
[FD] XRMS SQLi to RCE 0day ("Benjamin Harris" <bch@...h.ai>)
[FD] Actual Analyzer Unauthenticated Command Execution ("Benjamin Harris" <bch@...h.ai>)

August 28 (3 messages)

[FD] Aerohive Hive Manager and Hive OS Multiple Vulnerabilities (Disclosure <Disclosure@...urity-assessment.com>)
[FD] SEC Consult SA-20140828-0 :: F5 BIG-IP Reflected Cross-Site Scripting (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] F5 Unauthenticated rsync access to Remote Root Code Execution (Thomas Hibbert <Thomas.Hibbert@...urity-assessment.com>)

August 30 (3 messages)

[FD] [CVE-2014-5440] MX-SmartTimer SQL Injection ("Seybold, Juan (LATCO - Buenos Aires)" <jseybold@...OITTE.com>)
Re: [FD] [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert (Pedro Ribeiro <pedrib@...il.com>)
Re: [FD] [The ManageOwnage Series, part I]: blind SQL injection in two servlets (metasploit module included) (Pedro Ribeiro <pedrib@...il.com>)

August 31 (3 messages)

[FD] Mogwai Security Advisory MSA-2014-01: ManageEngine EventLog Analyzer Multiple Vulnerabilities (Advisories <advisories@...waisecurity.de>)
[FD] XSS vulnerability in In-Portal CMS ("MustLive" <mustlive@...security.com.ua>)
[FD] [The ManageOwnage Series, part III]: Multiple vulnerabilities / RCE in ManageEngine Desktop Central (Pedro Ribeiro <pedrib@...il.com>)

90 messages