full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2014/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 9	² 9	³ 7	⁴	⁵	⁶	⁷ 2
⁸	⁹ 7	¹⁰ 1	¹¹ 7	¹² 4	¹³	¹⁴
¹⁵ 6	¹⁶ 7	¹⁷ 7	¹⁸ 6	¹⁹ 2	²⁰	²¹
²² 4	²³ 5	²⁴	²⁵ 17	²⁶ 7	²⁷ 6	²⁸
²⁹	³⁰ 3

Messages by day:

September 1 (9 messages)

[FD] SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
[FD] [The ManageOwnage Series, part IV]: RCE / file upload in Eventlog Analyzer, feat. special guests h0ng10 and Mogwai Secur… (Pedro Ribeiro <pedrib@...il.com>)
[FD] Few bugs in Wonderware Information Server (SCADA StrangeLove <scadastrangelove@...il.com>)
[FD] Avira License Application - Cross Site Request Forgery Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WWW File Share Pro v7.0 - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (Stephanie Daugherty <sdaugherty@...il.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (Jeroen van der Ham <jeroen@...nd0s.nl>)
Re: [FD] SSH host key fingerprint - through HTTPS (Jeroen van der Ham <jeroen@...d.nl>)
Re: [FD] SSH host key fingerprint - through HTTPS (maxigas <maxigas@...rgeek.net>)

September 2 (9 messages)

[FD] Apple iOS v7.1.2 - Merge Apps Service Local Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] XSS Reflected JQuery 1.4.2 - Create object option in runtime client-side (Mauro Risonho de Paula Assumpção <mauro.risonho@...il.com>)
[FD] Wordpress Plugin Vulnerability Dump - Part 1 ("Voxel@...ht" <voxelnight@...atioustendencies.com>)
[FD] Defense in depth -- the Microsoft way (part 18): Microsoft Office 2010 registers command lines with unquoted pathn… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Reflected XSS Attacks vulnerabilities used MIME Sniffing in Facebook Messenger and Facebook App for iOS. (William Costa <william.costa@...il.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (John Leo <johnleo@...ckssh.com>)
[FD] [CORE-2014-0005] - Advantech WebAccess Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Syslog LogAnalyzer persistent XSS injection CVE-2014-6070 ("Dolev Farhi" <dolevf@...oo.com>)

September 3 (7 messages)

[FD] Uninit memory disclosure via truncated images in Firefox (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] Mogwai Security Advisory MSA-2014-01: ManageEngine EventLog Analyzer Multiple Vulnerabilities (Pedro Ribeiro <pedrib@...il.com>)
Re: [FD] Mogwai Security Advisory MSA-2014-01: ManageEngine EventLog Analyzer Multiple Vulnerabilities (Pedro Ribeiro <pedrib@...il.com>)
[FD] Advanced Access Manager allows admin users to write arbitrary files and execute arbitrary php (WordPress plugin) (dxw Security <security@....com>)
Re: [FD] ntopng 1.2.0 XSS injection using monitored network traffic (Steffen Bauch <mail@...ffenbauch.de>)
[FD] Mpay24 prestashop payment module multiple vulnerabilities (Wire Ghoul <wireghoul@...il.com>)
Re: [FD] SSH host key fingerprint - through HTTPS (Árpád Magosányi <mag@...was.rulez.org>)

September 7 (2 messages)

[FD] Defense in depth -- the Microsoft way (part 19): still no "perfect forward secrecy" per default in Windows 8/7/Vi… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] ALCASAR <= 2.8 Remote Root Code Execution Vulnerability (john doe <ef523@...dex.com>)

September 9 (7 messages)

Re: [FD] SSH host key fingerprint - through HTTPS (Busindre ™ <busilezas@...il.com>)
Re: [FD] ntopng 1.2.0 XSS injection using monitored network traffic (Luca Carettoni <luca.carettoni@...isoft.com>)
[FD] WordPress Plugin Vulnerability Dump - Part 2 ("Voxel@...ht" <voxelnight@...atioustendencies.com>)
[FD] Public WiFi Pcaps (Bryan Bickford <bryan@...wildhats.com>)
Re: [FD] Public WiFi Pcaps (Eric Rand <eric.rand@...wnhatsecurity.com>)
Re: [FD] Public WiFi Pcaps (uname -a <sec.list@....net>)
[FD] NEW VMSA-2014-0008 VMware vSphere product updates to third party libraries (VMware Security Response Center <security@...are.com>)

September 10 (1 message)

[FD] [SECURITY] CVE-2013-4444 Remote Code Execution in Apache Tomcat (Mark Thomas <markt@...che.org>)

September 11 (7 messages)

[FD] rcrypt 1.5 public release and website (rage <ragesploit@...age.com>)
[FD] Ammyy Admin 0day (Matt Weeks <scriptjunkie@...iptjunkie.us>)
Re: [FD] Public WiFi Pcaps (Wesley Spikes <wesley.spikes@...il.com>)
[FD] CSRF vulnerabilities in CacheGuard-OS v5.7.7 (CVE-2014-4865) (William Costa <william.costa@...il.com>)
[FD] Photorange v1.0 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] NEW VMSA-2014-0009 VMware NSX and vCNS product updates address a critical information disclosure vulnerability (VMware Security Response Center <security@…)

September 12 (4 messages)

[FD] Fwd: Security Access (Pedrov Jovovic <pedrov.jovovic@...il.com>)
[FD] Rooted SSH/SFTP Daemon Default Login Credentials ("Larry W. Cashdollar" <larry0@...com>)
Re: [FD] Fwd: Security Access (Fernando Mercês <nandu88@...il.com>)
Re: [FD] Fwd: Security Access (Fernando Mercês <nandu88@...il.com>)

September 15 (6 messages)

[FD] Briefcase 4.0 iOS - Code Execution & File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ALCASAR <= 2.8.1 Remote Root Code Execution Vulnerability (john doe <ef523@...dex.com>)
Re: [FD] Fwd: Security Access (Артур Истомин <art.istom@...dex.ru>)
[FD] SingleClick Connect (Rob Fuller <mubix@...m362.com>)
[FD] Wordfence v5.2.3 (Wordpress Security Plugin) - Multiple Vulnerabilities ("Voxel@...ht" <voxelnight@...atioustendencies.com>)
[FD] libre office listening on port 1599 (Kemble Wagner <oobe.trouble@...il.com>)

September 16 (7 messages)

[FD] USB&WiFi Flash Drive v1.3 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] libre office listening on port 1599 (Brandon Vincent <Brandon.Vincent@....edu>)
Re: [FD] Wordfence v5.2.3 (Wordpress Security Plugin) - Multiple Vulnerabilities (Mark Maunder <mark@...dfence.com>)
[FD] Vulnerabilities in In-Portal CMS ("MustLive" <mustlive@...security.com.ua>)
[FD] [Quantum Leap Advisory] #QLA140808 Cart Engine 3.0 Multiple vulnerabilities - SQL Injection, XSS Reflected, Open R… (Pietro Minniti <p.minniti@...ntumleap.i…)
[FD] Laravel 2.1 Hash::make() bcrypt truncation (Pichaya Morimoto <pichaya@...e.org>)
[FD] [CORE-2014-0006] - Delphi and C++ Builder VCL library Heap Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)

September 17 (7 messages)

[FD] CSRF/XSS vulnerablity in Login Widget With Shortcode allows unauthenticated attackers to do anything an admin can do (Wor… (dxw Security <security@....com>)
[FD] Reflected XSS in WooCommerce – excelling eCommerce allows attackers ability to do almost anything an admin user can do (W… (dxw Security <security@....com>)
[FD] Vulnerability in WP-Ban allows visitors to bypass the IP blacklist in some configurations (WordPress plugin) (dxw Security <security@....com>)
Re: [FD] Laravel 2.1 Hash::make() bcrypt truncation (beloumi <beloumi@...eup.net>)
[FD] Multiple SQL Injection Vulnerabilities in ClassApps SelectSurvey.net (BillV-Lists <lists@...hol.net>)
[FD] ccnet-server remote DoS (assert) seafile-server 3.1.5 (nop nop <r3t5et@...il.com>)
[FD] DoS seafile-server 3.1.5 ( ccnet-server - assert) (nop nop <r3t5et@...il.com>)

September 18 (6 messages)

[FD] CVE ID Syntax Change - Deadline Approaching ("Christey, Steven M." <coley@...re.org>)
[FD] Oracle Corporation MyOracle - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] AST-2014-009: Remote crash based on malformed SIP subscription requests ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2014-010: Remote crash when handling out of call message in certain dialplan configurations ("Asterisk Security Team" <security@...erisk.org>)
[FD] Apple iOS / OSX Foundation NSXMLParser XML eXternal Entity (XXE) Flaw (VSR Advisories <advisories@...curity.com>)
[FD] Reflected XSS Attacks vulnerabilities in WatchGuard XTM 11.8.3 (CVE-2014-6413) (William Costa <william.costa@...il.com>)

September 19 (2 messages)

[FD] M/Monit - Account hijacking via CSRF ("Dolev Farhi" <dolevf@...oo.com>)
Re: [FD] Fwd: Security Access (gold flake <ptinstructor@...il.com>)

September 22 (4 messages)

[FD] Glype proxy cookie jar path traversal allows code execution ("Securify B.V." <lists@...urify.nl>)
[FD] Glype proxy privacy settings can be disabled via CSRF ("Securify B.V." <lists@...urify.nl>)
[FD] Glype proxy privacy settings can be disabled via CSRF ("Securify B.V." <lists@...urify.nl>)
[FD] Glype proxy local address filter bypass ("Securify B.V." <lists@...urify.nl>)

September 23 (5 messages)

[FD] [KIS-2014-09] X2Engine <= 4.1.7 (SiteController.php) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2014-10] X2Engine <= 4.1.7 (FileUploadsFilter.php) Unrestricted File Upload Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] CVE-2014-6603 suricata 2.0.3 Out-of-bounds access in SSH parser (Steffen Bauch <mail@...ffenbauch.de>)
[FD] TP-LINK WDR4300 - Stored XSS & DoS (Oz Elisyan <ozelisyan@...il.com>)
[FD] Strength and Weakness of Methods to Confirm SSH Host Key (John Leo <johnleo@...ckssh.com>)

September 25 (17 messages)

Re: [FD] Strength and Weakness of Methods to Confirm SSH Host Key (Gunnar Wolf <gwolf@...lf.org>)
Re: [FD] Strength and Weakness of Methods to Confirm SSH Host Key (Paul Vixie <paul@...barn.org>)
[FD] LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow (advisories <advisories@...xperts.de>)
[FD] Critical bash vulnerability CVE-2014-6271 (Philip Cheong <philip.cheong@...stx.se>)
[FD] [TOOL] Hakabana release (Mehdi Talbi <talbimehdi@...il.com>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Paul Vixie <paul@...barn.org>)
[FD] MSA-2014-02: Typo3 Extension dmmjobcontrol Multiple Vulnerabilities (typo3-ext-sa-2014-012) (Advisories <advisories@...waisecurity.de>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Tony Arcieri <bascule@...il.com>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Yvan Janssens <ik@...nj.me>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Evan Teitelman <teitelmanevan@...il.com>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 ("Godin, Erik" <Erik.Godin@....com>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 ("g@...7.io" <g@...7.io>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Tim <tim-security@...tinelchicken.org>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Paul Vixie <paul@...barn.org>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Paul Vixie <paul@...barn.org>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Seth Arnold <seth.arnold@...onical.com>)

September 26 (7 messages)

Re: [FD] Critical bash vulnerability CVE-2014-6271 (Paul Vixie <paul@...barn.org>)
[FD] GS Foto Uebertraeger v3.0 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Oracle Corporation MyOracle - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SmarterTools Smarter Track 6-10 - Information Disclosure Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Paypal Inc Bug Bounty #16 - Persistent Mail Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Paypal Inc Bug Bounty #32 - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (slightly OT logo discussion) ("Ben Lincoln (F7EFC8C9 - FD)" <F7EFC8C9@...eaththewaves.net>)

September 27 (6 messages)

[FD] uni-konstanz.de subdomain, arbitrary file download (b4mbi@...e-mail.net)
Re: [FD] Critical bash vulnerability CVE-2014-6271 (Matt Hazinski <mhazinsk@...edu>)
[FD] XSS Reflected vulnerabilities and CSRF in Exinda WAN Optimization Suite (CVE-2014-7157, CVE-2014-7158) (William Costa <william.costa@...il.com>)
[FD] Openfiler DoS via CSRF (CVE-2014-7190) (Dolev Farhi <dolevf@...oo.com>)
[FD] [The ManageOwnage Series, part V]: RCE / file upload / arbitrary file deletion in OpManager, Social IT and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[FD] WPScan Vulnerability Database (Ryan Dewhurst <ryandewhurst@...il.com>)

September 30 (3 messages)

[FD] All In One Wordpress Firewall 3.8.3 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Bug Bounty #59 - Persistent Mail Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Bug Bounty #71 PPM - Persistent Filter Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

116 messages