full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2014/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 14	² 2	³ 5	⁴	⁵ 2
⁶ 3	⁷ 10	⁸ 8	⁹ 3	¹⁰ 4	¹¹	¹² 1
¹³ 6	¹⁴ 13	¹⁵ 1	¹⁶ 5	¹⁷ 3	¹⁸	¹⁹ 5
²⁰ 9	²¹ 2	²² 6	²³ 5	²⁴ 4	²⁵ 1	²⁶ 1
²⁷ 5	²⁸ 6	²⁹ 4	³⁰ 5	³¹ 2

Messages by day:

October 1 (14 messages)

[FD] FW: NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities (VMware Security Response Center <security@...are.com>)
[FD] Command-injection vulnerability in windows cmd scripts (Ben Perry <benperry244@...il.com>)
[FD] Epicor Enterprise vulnerabilities ("Fara Rustein fararustein@...usecurity.com" <fararustein@...usecurity.com>)
[FD] Multiple vulnerabilities in Refraction theme for WordPress ("MustLive" <mustlive@...security.com.ua>)
[FD] FreePBX (All Versions) RCE (Rob Thomas <rob.thomas@...moozecom.com>)
[FD] CVE-2014-2717 SCADA Privilege Escalation in Honeywell Falcon XLWEB (Martin Jartelius <mj@...post24.com>)
[FD] Multiple product vulnerabilities: all TP-Link "2-series" switches, all TP-Link VxWorks-based product (kvnjs <kvnjs@...eup.net>)
[FD] CVE-2014-6389 - Remote Command Execution in PHPCompta/NOALYSS (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] Blind SQLi vulnerability in Content Audit could allow a privileged attacker to exfiltrate password hashes (WordPress plugi… (dxw Security <security@....com>)
[FD] the other bash RCEs (CVE-2014-6277 and CVE-2014-6278) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] the other bash RCEs (CVE-2014-6277 and CVE-2014-6278) (Paul Vixie <paul@...barn.org>)
[FD] CVE-2014-5308 - Multiple SQL Injection Vulnerabilities in TestLink (Portcullis Advisories <advisories@...tcullis-security.com>)
Re: [FD] the other bash RCEs (CVE-2014-6277 and CVE-2014-6278) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] CVE-2014-5308 - Multiple SQL Injection Vulnerabilities in TestLink (Brandon Perry <bperry.volatile@...il.com>)

October 2 (2 messages)

[FD] CarolinaCon-11 call for papers/presenters (Vic Vandal <vvandal@...l.com>)
[FD] CVE-2014-3110 SCADA XSS and patch review of Honeywell Falcon XLWEB (Martin Jartelius <mj@...post24.com>)

October 3 (5 messages)

[FD] BulletProof Security Wordpress v50.8 - POST Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] HTTP Commander AJS v3.1.9 - Client Side Exception Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Bug Bounty Issue #70 France - Persistent (Escape Shopping) Mail Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CVE-2014-7277 Stored Server XSS in ZyXEL SBG-3300 Security Gateway (Mirko Casadei <mirko.casadei@...il.com>)
[FD] CVE-2014-7278 DoS in ZyXEL SBG-3300 Security Gateway (Mirko Casadei <mirko.casadei@...il.com>)

October 5 (2 messages)

[FD] CVE-2014-4313 Epicor Procurement SQL Injection ("Martins, Luciano (LATCO - Buenos Aires)" <lmartins@...oitte.com>)
Re: [FD] the other bash RCEs (CVE-2014-6277 and CVE-2014-6278) (Michael Bazzinotti <mbazzinotti@...il.com>)

October 6 (3 messages)

[FD] Paypal Inc Bug Bounty #30 - Filter Bypass & Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Bug Bounty #53 - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CA20141001-01: Security Notice for Bash Shellshock Vulnerability ("Williams, James K" <Ken.Williams@...com>)

October 7 (10 messages)

[FD] Nessus Web UI 2.3.3: Stored XSS (The Security Factory <release@...securityfactory.be>)
[FD] Adobe Acrobat XI on Uniguest Secured Advantage 7 privacy issue at Marriott et al ("Constantine A. Murenin" <mureninc@...il.com>)
[FD] CVE-2014-4502 (Updated) : Invalid Handling of Length Parameter in Stratum mining.notify Message Leads to Heap Over… (Mick Ayzenberg <mick@...avusecurity.com…)
[FD] CVE-2014-6251 : Stack Overflow in CPUMiner When Submitting Upstream Work (Mick Ayzenberg <mick@...avusecurity.com>)
[FD] Yahoo! hacked on October 5, 2014... (Jonathan Hall <jhall@...uresouth.us>)
Re: [FD] Yahoo! hacked on October 5, 2014... (Pål Nilsen <paal.nilsen@...il.com>)
[FD] BlackArch Linux: New ISOs released (Black Arch <blackarchlinux@...il.com>)
[FD] Exploit for CVE-2014-5207 (Andrew Lutomirski <luto@....edu>)
[FD] [CERT VU#121036 / Multiple CVEs] RCE, domain admin creds leakage and more in BMC Track-It! (Pedro Ribeiro <pedrib@...il.com>)
[FD] OpenSSH <=6.6 SFTP misconfiguration exploit for 64bit Linux (Jann Horn <jann@...jh.net>)

October 8 (8 messages)

[FD] [Onapsis Security Advisory 2014-028] SAP HANA Web-based Development Workbench Code Injection (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-027] SAP HANA Multiple Reflected Cross Site Scripting Vulnerabilities (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-033] SAP Business Warehouse Missing Authorization Check (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-031] SAP Business Objects Information Disclosure via CORBA (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-030] SAP Business Objects Denial of Service via CORBA (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-029] SAP Business Objects Information Disclosure (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2014-032] SAP BusinessObjects Persistent Cross Site Scripting (Onapsis Research Labs <research@...psis.com>)
Re: [FD] Yahoo! hacked on October 5, 2014... (illwill <illwill@...mob.org>)

October 9 (3 messages)

[FD] TWiki Security Alert CVE-2014-7236: Remote Perl code execution with query string to debug TWiki plugins (Peter Thoeny <peter09@...eny.org>)
[FD] TWiki Security Alert CVE-2014-7237: Apache configuration file upload on TWiki on Windows server (Peter Thoeny <peter09@...eny.org>)
Re: [FD] TWiki Security Alert CVE-2014-7236: Remote Perl code execution with query string to debug TWiki plugins (Michael Stroucken <mxs@....edu>)

October 10 (4 messages)

[FD] CSNC-2014-004 neuroML - Multiple Vulnerabilities ("Alexandre Herzog" <alexandre.herzog@...c.ch>)
[FD] SAP Security Note 1908562 - Port scanning in BusinessObjects Explorer ("Alexandre Herzog" <alexandre.herzog@...c.ch>)
[FD] SAP Security Note 1908647 - Cross Site Flashing in BusinessObjects Explorer ("Alexandre Herzog" <alexandre.herzog@...c.ch>)
[FD] SAP Security Note 1908531 - XXE in BusinessObjects Explorer ("Alexandre Herzog" <alexandre.herzog@...c.ch>)

October 12 (1 message)

[FD] CSP Bypass on Android prior to 4.4 (E Boogie <evanjjohns@...il.com>)

October 13 (6 messages)

[FD] PayPal Inc BB #85 MB iOS 4.6 - Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CVE-2014-3671: DNS Reverse Lookup as a vector for the Bash vulnerability (CVE-2014-6271 et.al.) (Dirk-Willem van Gulik <dirkx@...weaving.org>)
Re: [FD] CSP Bypass on Android prior to 4.4 (E Boogie <evanjjohns@...il.com>)
[FD] CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth) ("oststrom \(public\)" <pub@...strom.com>)
[FD] CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API (post-auth) ("oststrom \(public\)" <pub@...strom.com>)
[FD] CVE-2014-2023 - Tapatalk for vBulletin 4.x - multiple blind sql injection (pre-auth) ("oststrom \(public\)" <pub@...strom.com>)

October 14 (13 messages)

[FD] OWASP OWTF 1.0 "Lionheart" released! (Abraham Aranguren <abraham.aranguren@...sp.org>)
Re: [FD] CSP Bypass on Android prior to 4.4 (E Boogie <evanjjohns@...il.com>)
[FD] Rooted CON 2015 - Call For Papers (omarbv <omarbv@...eup.net>)
Re: [FD] CVE-2014-3671: DNS Reverse Lookup as a vector for the Bash vulnerability (CVE-2014-6271 et.al.) (Dirk-Willem van Gulik <dirkx@...weaving.org>)
Re: [FD] CVE-2014-3671: DNS Reverse Lookup as a vector for the Bash vulnerability (CVE-2014-6271 et.al.) (Florian Weimer <fw@...eb.enyo.de>)
Re: [FD] CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth) (Henri Salo <henri@...v.fi>)
Re: [FD] CVE-2014-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth) ("oststrom \(public\)" <pub@...strom.com>)
[FD] Fwd: Re: CSP Bypass on Android prior to 4.4 (Vitor Ventura <ventura.vitor@...il.com>)
[FD] two browser mem disclosure bugs (CVE-2014-1580 and CVE-something-or-other) (Michal Zalewski <lcamtuf@...edump.cx>)
[FD] [SE-2014-01] Breaking Oracle Database through Java exploits (details) (Security Explorations <contact@...urity-explorations.com>)
[FD] PayPal Inc BB #98 MOS - Persistent Settings Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Indeed Job Search 2.5 iOS API - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Paypal Inc MultiOrderShipping API - Filter Bypass & Persistent XML Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

October 15 (1 message)

[FD] SEC Consult SA-20141015-0 :: Potential Cross-Site Scripting in ADF Faces (SEC Consult Vulnerability Lab <research@...-consult.com>)

October 16 (5 messages)

[FD] CVE-2014-2230 - OpenX Open Redirect Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] New York Times nytimes.com Page Design XSS Vulnerability (Almost all Article Pages Before 2013 are Affected) (Jing Wang <justqdjing@...il.com>)
[FD] Bypassing blacklists based on IPy (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
[FD] Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability (Stefan Horst <stefan.horst@...tioneins.de>)
[FD] [CORE-2014-0007] -SAP Netweaver Enqueue Server Trace Pattern Denial of Service Vulnerability (CORE Advisories Team <advisories@...esecurity.com>)

October 17 (3 messages)

[FD] XSS vulnerabilities in Megapolis.Portal Manager ("MustLive" <mustlive@...security.com.ua>)
[FD] Multiple unauthenticated SQL injections and unauthenticated remote command injection in Centreon <= 2.5.2 and Centreon Enterprise … (yoloswag@...gedinbox.com)
[FD] Fonality trixbox CE remote root exploit (Simo Ben youssef <simo@...xploit.com>)

October 19 (5 messages)

[FD] Cyanogenmod MITM: proven, despite cyanogenmod's public denail (Lord Tuskington <l.tuskington@...il.com>)
[FD] Cyanogenmod: multiple flaws in dependencies, including RCE (Lord Tuskington <l.tuskington@...il.com>)
[FD] CVE request: remote code execution in Android CTS (Lord Tuskington <l.tuskington@...il.com>)
Re: [FD] Cyanogenmod: multiple flaws in dependencies, including RCE (Артур Истомин <art.istom@...dex.ru>)
Re: [FD] CVE request: remote code execution in Android CTS (Lord Tuskington <l.tuskington@...il.com>)

October 20 (9 messages)

Re: [FD] Cyanogenmod MITM: proven, despite cyanogenmod's public denail (Lord Tuskington <l.tuskington@...il.com>)
Re: [FD] [oss-security] CVE request: remote code execution in Android CTS (Nick Kralevich <nnk@...gle.com>)
Re: [FD] Cyanogenmod MITM: proven, despite cyanogenmod's public denail (Jeffrey Walton <noloader@...il.com>)
Re: [FD] [oss-security] CVE request: remote code execution in Android CTS (Grond <grond66@...il.com>)
Re: [FD] [oss-security] CVE request: remote code execution in Android CTS (David Daynard <nardholio@...il.com>)
Re: [FD] CVE request: remote code execution in Android CTS (Jann Horn <jann@...jh.net>)
[FD] CVE-2014-7292 Newtelligence dasBlog Open Redirect Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] Mozilla mozilla.org Two Sub-Domains ( Cross Reference) XSS Vulnerability ( All URLs Under the Two Domains) (Jing Wang <justqdjing@...il.com>)
[FD] AST-2014-011: Asterisk Susceptibility to POODLE Vulnerability ("Asterisk Security Team" <security@...erisk.org>)

October 21 (2 messages)

[FD] Files Document & PDF 2.0.2 iOS - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FileBug v1.5.1 iOS - Path Traversal Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

October 22 (6 messages)

[FD] iFunBox Free v1.1 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] File Manager v4.2.10 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Mulesoft ESB Authenticated Privilege Escalation (Brandon Perry <bperry.volatile@...il.com>)
[FD] Vulnerabilities in WordPress Database Manager v2.7.1 ("Larry W. Cashdollar" <larry0@...com>)
Re: [FD] [oss-security] CVE request: remote code execution in Android CTS (Mario Vilas <mvilas@...il.com>)
[FD] Incredible PBX remote command execution exploit (Simo Ben youssef <simo@...xploit.com>)

October 23 (5 messages)

[FD] Dell SonicWall GMS v7.2.x - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] File Manager v4.2.10 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CVE-2014-7180 - ElectricCommander Local Privilege Escalation (Sean Wright <swright@...ureworks.com>)
[FD] [KIS-2014-11] TestLink <= 1.9.12 (execSetResults.php) PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2014-12] TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness (Egidio Romano <research@...mainsecurity.com>)

October 24 (4 messages)

Re: [FD] Mulesoft ESB Authenticated Privilege Escalation (Barak Engel <barak@...esoft.com>)
[FD] Still beginner's errors (and outdated 3rd party components) in QuickTime 7.7.6 and iTunes 12.0.1 ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] iTunes 12.0.1 for Windows: still COMPLETELY outdated and VULNERABLE 3rd party libraries ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] NoSuchCon 2014 - Schedule (NoSuchCon <cfp@...uchcon.org>)

October 25 (1 message)

[FD] Yourls XSS Stored (Alvaro Diaz <alvarodiazher@...il.com>)

October 26 (1 message)

[FD] vulnerabilities in libbfd (CVE-2014-beats-me) (Michal Zalewski <lcamtuf@...edump.cx>)

October 27 (5 messages)

[FD] iFileExplorer v6.51 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WebDisk+ v2.1 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Apple iOS v8.0.2 - Silent Contact Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Folder Plus v2.5.1 iOS - Persistent Item Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Google Youtube - Filter Bypass & Persistent Vulnerability [9-5942000004564] (PoC Video Demonstration) (Vulnerability Lab <research@...nerability-lab.com>)

October 28 (6 messages)

[FD] CVE-2014-4974 - Kernel Memory Leak in ESET Multiple Windows Products (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-7176 - Authenticated Blind SQL Injection in Enalean Tuleap (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-7177 - External XML Entity Injection in Enalean Tuleap (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-7178 - Remote Command Execution in Enalean Tuleap (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-2718: ASUS wireless router updates are vulnerable to a MITM attack (David Longenecker <dnlongen@...il.com>)
[FD] DAVOSET v.1.2.1 ("MustLive" <mustlive@...security.com.ua>)

October 29 (4 messages)

[FD] Go Home WP-API, You're Drunk... (Scott Arciszewski <scott@...iszewski.me>)
[FD] SEC Consult SA-20141029-0 :: Multiple critical vulnerabilities in Vizensoft Admin Panel (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20141029-1 :: Persistent cross site scripting in Confluence RefinedWiki Original Theme (SEC Consult Vulnerability Lab <research@...-consult…)
[FD] MS08-067 strikes again. Now ATM (SCADA StrangeLove <scadastrangelove@...il.com>)

October 30 (5 messages)

[FD] CVE-2014-6032 - XML External Entity Injection in F5 Networks Big-IP (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-6033 - XML External Entity Injection in F5 Networks Big-IP (Portcullis Advisories <advisories@...tcullis-security.com>)
Re: [FD] CVE-2014-6032 - XML External Entity Injection in F5 Networks Big-IP (Jeff Costlow <j.costlow@...com>)
Re: [FD] Go Home WP-API, You're Drunk... (Nahuel Grisolía <nahuel.grisolia@...il.com>)
Re: [FD] Go Home WP-API, You're Drunk... (Scott Arciszewski <scott@...iszewski.me>)

October 31 (2 messages)

[FD] SEC Consult SA-20141031-0 :: XML External Entity Injection (XXE) and Reflected XSS in Scalix Web Access (SEC Consult Vulnerability Lab <research@...-consu…)
[FD] [SE-2014-01] Missing patches / inaccurate information regarding Oracle Oct CPU (Security Explorations <contact@...urity-explorations.com>)

135 messages