full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2014/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 2	²
³ 2	⁴	⁵ 2	⁶ 9	⁷ 3	⁸	⁹ 3
¹⁰	¹¹	¹² 6	¹³	¹⁴ 11	¹⁵	¹⁶
¹⁷ 9	¹⁸ 4	¹⁹ 9	²⁰ 5	²¹ 9	²²	²³ 1
²⁴	²⁵	²⁶ 12	²⁷ 10	²⁸	²⁹ 6	³⁰

Messages by day:

November 1 (2 messages)

Re: [FD] GoAgent vulnerabilities: CA cert with known private key, TLS MITM (David Fifield <david@...software.com>)
[FD] Three out of bounds access issues in ImageMagick (CVE-2014-8354, CVE-2014-8355, CVE-2014-8562) (Hanno Böck <hanno@...eck.de>)

November 3 (2 messages)

[FD] CVE-2014-5387 - Multiple Authenticated SQL Injections in EllisLab ExpressionEngine Core (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CNIL CookieViz XSS + SQL injection leading to user pwnage (iliketurtles@...gedinbox.com)

November 5 (2 messages)

[FD] KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] Vulnerabilities in D-Link DAP-1360 ("MustLive" <mustlive@...security.com.ua>)

November 6 (9 messages)

[FD] Cisco RV Series multiple vulnerabilities ("Securify B.V." <lists@...urify.nl>)
[FD] SEC Consult SA-20141106-0 :: XXE & XSS & Arbitrary File Write vulnerabilities in Symantec Endpoint Protection (SEC Consult Vulnerability Lab <research@sec…)
[FD] XCloner Wordpress/Joomla! backup Plugin v3.1.1 (Wordpress) v3.5.1 (Joomla!) Vulnerabilities ("Larry W. Cashdollar" <larry0@...com>)
[FD] CVE-2014-8557 - JExperts Tecnologia - Channel Software Cross Site Scripting Issues (Luciano Pedreira <lpedreira@...il.com>)
[FD] CVE-2014-8558 - JExperts Tecnologia - Channel Software Escalation Access Issues (Luciano Pedreira <lpedreira@...il.com>)
[FD] DAVOSET v.1.2.2 ("MustLive" <mustlive@...security.com.ua>)
[FD] [The ManageOwnage Series, part VI]: 0day database info and superuser credential disclosure in EventLog Analyser (Pedro Ribeiro <pedrib@...il.com>)
[FD] Wordpress bulletproof-security <=.51 multiple vulnerabilities (Pietro Oliva <pietroliva@...il.com>)
[FD] Insecure management of login credentials in PicsArt Photo Studio for Android [STIC-2014-0426] (Programa STIC <stic@...dacionsadosky.org.ar>)

November 7 (3 messages)

[FD] SeasonApps iTransfer 1.1 - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] BookFresh - Persistent Clients Invite Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc BugBounty #107 MultiOrder Shipping (API) - Persistent History Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

November 9 (3 messages)

[FD] [The ManageOwnage Series, part VII]: Super admin privesc + password DB dump in Password Manager Pro (Pedro Ribeiro <pedrib@...il.com>)
[FD] IL and CSRF vulnerabilities in D-Link DAP-1360 ("MustLive" <mustlive@...security.com.ua>)
[FD] IP.Board <= 3.4.7 SQL Injection (secthrowaway@...e-mail.net)

November 12 (6 messages)

[FD] [The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[FD] PayPal Inc Bug Bounty #88 - Filter Bypass & Arbitrary Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Piwigo <= v2.6.0 - Blind SQL Injection (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] Lantronix xPrintServer Code execution and CSRF vulnerability (Jim Bauwens <jimbauwens@...il.com>)
[FD] [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC) (ESNC Security <secure@...c.de>)
[FD] Missing SSL certificate validation in MercadoLibre app for Android [STIC-2014-0211] (Programa STIC <stic@...dacionsadosky.org.ar>)

November 14 (11 messages)

[FD] CFP: AIPR2015 China - Artificial Intelligence and Pattern Recognition (Hazel Ann <hazel.sdiwc@...il.com>)
[FD] Google DoubleClick.net(Advertising) System URL Redirection Vulnerabilities Can be Used by Spammers (Jing Wang <justqdjing@...il.com>)
[FD] Bypass Google Open Redirect Filter Based on Googleads.g.doubleclick.net (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-7290 Atlas Systems Aeon XSS (Cross-Site Scripting) Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] Prey Anti-Theft for Android missing SSL certificate validation [STIC-2014-0731] (Programa STIC <stic@...dacionsadosky.org.ar>)
[FD] CVE-2014-8681 Blind SQL Injection in Gogs label search (Timo Schmid <tschmid@...w.de>)
[FD] CVE-2014-8682 Multiple Unauthenticated SQL Injections in Gogs (Timo Schmid <tschmid@...w.de>)
[FD] CVE-2014-8683 XSS in Gogs Markdown Renderer (Timo Schmid <tschmid@...w.de>)
[FD] XSS Reflected in Page visualization agents in Pandora FMS v5.1SP1 - Revisión PC141031 (CVE-2014-8629) (William Costa <william.costa@...il.com>)
[FD] xdg-open RCE (joernchen <joernchen@...noelit.de>)
Re: [FD] Bypass Google Open Redirect Filter Based on Googleads.g.doubleclick.net (Nick Semenkovich <nick@...enkovich.com>)

November 17 (9 messages)

[FD] Reflected XSS in Nibbleblog <= v4.0.1 (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] XOOPS <= 2.5.6 - Blind SQL Injection (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] 81% of Tor users can be de-anonymised by analysing router information, research indicates ("Ivan .Heca" <ivanhec@...il.com>)
Re: [FD] xdg-open RCE (Brandon Perry <bperry.volatile@...il.com>)
[FD] Vulnerabilities in D-Link DCS-2103 ("MustLive" <mustlive@...security.com.ua>)
[FD] Proticaret E-Commerce Script v3.0 SQL Injection (Onur Alanbel <onur.a@...dowslive.com>)
[FD] WebsiteBaker <=2.8.3 - Multiple Vulnerabilities (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] Zoph <= 0.9.1 - Multiple Vulnerabilities (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] CVE-2014-8493 - ZTE ZXHN H108L Authentication Bypass (Project Zero Labs <labs@...jectzero.gr>)

November 18 (4 messages)

[FD] CVE-2014-8767 tcpdump denial of service in verbose mode using malformed OLSR payload (Steffen Bauch <mail@...ffenbauch.de>)
[FD] CVE-2014-8768 tcpdump denial of service in verbose mode using malformed Geonet payload (Steffen Bauch <mail@...ffenbauch.de>)
[FD] CVE-2014-8769 tcpdump unreliable output using malformed AOVD payload (Steffen Bauch <mail@...ffenbauch.de>)
[FD] PHPFox XSS AdminCP (Wesley Henrique <wesleyhenrique@...il.com>)

November 19 (9 messages)

[FD] CVE-2014-7911: Android <5.0 Privilege Escalation using ObjectInputStream (Jann Horn <jann@...jh.net>)
[FD] CVE-2014-2382 - Arbitrary Code Execution In Faronics Deep Freeze Standard and Enterprise (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] Bootkit via SMS (SCADA StrangeLove <scadastrangelove@...il.com>)
[FD] CVE-2014-8600 - Insufficient Input Validation By IO Slaves In KDE e.V. KDE (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-2630 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH in Compaq/Hewlett Packard Gla… (Portcullis Advisories <advisories@...tc…)
[FD] CVE-2014-7137 - Multiple SQL Injections in Dolibarr ERP & CRM (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] [CORE-2014-0008] - Advantech AdamView Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)
[FD] [CORE-2014-0009] - Advantech EKI-6340 Command Injection (CORE Advisories Team <advisories@...esecurity.com>)
[FD] [CORE-2014-0010] - Advantech WebAccess Stack-based Buffer Overflow (CORE Advisories Team <advisories@...esecurity.com>)

November 20 (5 messages)

[FD] Capstone disassembly engine 3.0 released! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] CVE-2014-8349 LIFERAY Portal Stored XSS ("Garcia, Ariel (LATCO - Buenos Aires)" <arigarcia@...OITTE.com>)
[FD] WordPress 3 persistent script injection (Jouko Pynnonen <jouko@....fi>)
[FD] DAVOSET v.1.2.3 ("MustLive" <mustlive@...security.com.ua>)
[FD] Beginners error: "Google update" runs rogue programs %USERPROFILE%\Local.exe, %USERPROFILE%\Local Settings\Applic… ("Stefan Kanthak" <stefan.kanthak@...go.…)

November 21 (9 messages)

[FD] AST-2014-012: Mixed IP address families in access control lists may permit unwanted traffic. ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2014-013: PJSIP ACLs are not loaded on startup ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2014-014: High call load may result in hung channels in ConfBridge. ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2014-015: Remote Crash Vulnerability in PJSIP channel driver ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2014-016: Remote Crash Vulnerability in PJSIP channel driver ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2014-017: <font size="3" style="font-size: 12pt">Permission escalation through ConfBridge actions/dialplan fu… ("Asterisk Security Team" <security@...e…)
[FD] AST-2014-018: AMI permission escalation through DB dialplan function ("Asterisk Security Team" <security@...erisk.org>)
[FD] Supr Shopsystem - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FluxBB <= 1.5.6 SQL Injection (secthrowaway@...e-mail.net)

November 23 (1 message)

[FD] on Linux, 'less' can probably get you owned (Michal Zalewski <lcamtuf@...edump.cx>)

November 26 (12 messages)

[FD] Exploit for stealing backups on WP sites with WP-DB-Backup v2.2.4 plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: [FD] FluxBB <= 1.5.6 SQL Injection (secthrowaway@...e-mail.net)
[FD] DataSoft Nova Anti-reconnaissance System 13.10.0 || Stored XSS (static rez <staticrez7@...il.com>)
[FD] Slider Revolution/Showbiz Pro shell upload exploit (Simo Ben youssef <simo@...xploit.com>)
[FD] Defense in depth -- the Microsoft way (part 21): errors/inconsistencies in Windows registry data may lead to buff… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Defense in depth -- the Microsoft way (part 20): Microsoft Update may fail to offer current security updates ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] MyBB <= 1.8.2 unset_globals() Function Bypass and Remote Code Execution Vulnerability (Taoguang Chen <taoguangchen@...il.com>)
[FD] phpBB <= 3.1.1 deregister_globals() Function Bypass (Taoguang Chen <taoguangchen@...il.com>)
[FD] CVE-2014-8609 Android Settings application privilege leakage vulnerability ("Wang,Tao(Scloud)" <wangtao12@...du.com>)
[FD] device42 DCIM authenticated remote root via appliance manager (Brandon Perry <bperry.volatile@...il.com>)
[FD] CVE-2014-8610 Android < 5.0 SMS resend vulnerability ("Wang,Tao(Scloud)" <wangtao12@...du.com>)
[FD] CVE-2014-8507 Android < 5.0 SQL injection vulnerability in WAPPushManager ("Wang,Tao(Scloud)" <wangtao12@...du.com>)

November 27 (10 messages)

[FD] FileVista < v6.0.8.0 Insecure zip file handling (DS MailingList <ds.mailinglist.x@...il.com>)
[FD] CVE-2014-5439 - Root shell on Sniffit [with exploit] (Hector Marco <hecmargi@....es>)
[FD] The Weather Channel weather.com Almost All Links Vulnerable to XSS Attacks (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-7291 Springshare LibCal XSS (Cross-Site Scripting) Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation (Jing Wang <justqdjing@...il.com>)
[FD] All Links in Two Topics of Indiatimes (indiatimes.com) Are Vulnerable to XSS (cross site scripting) Attacks (Jing Wang <justqdjing@...il.com>)
[FD] Agafi/ROP v1.0 released ! ("Nicolas A. Economou" <neconomou@...esecurity.com>)
Re: [FD] Defense in depth -- the Microsoft way (part 20): Microsoft Update may fail to offer current security updates (Susan Bradley <sbradcpa@...bell.net>)
Re: [FD] Slider Revolution/Showbiz Pro shell upload exploit (Ryan Dewhurst <ryandewhurst@...il.com>)
Re: [FD] Slider Revolution/Showbiz Pro shell upload exploit (Simo Ben youssef <simo@...xploit.com>)

November 29 (6 messages)

[FD] XSS (in 20 chars) in Microsoft IIS 7.5 error message (A Z <kryptos.gnostikos@...il.com>)
Re: [FD] Slider Revolution/Showbiz Pro shell upload exploit (Lukasz Biegaj <l.biegaj@...shock.pl>)
[FD] [Tool] Responder v2.1.3 (laurent gaffie <laurent.gaffie@...il.com>)
[FD] CSRF and XSS vulnerabilities in D-Link DAP-1360 ("MustLive" <mustlive@...security.com.ua>)
[FD] [KIS-2014-13] Tuleap <= 7.6-4 (register.php) PHP Object Injection Vulnerability (Egidio Romano <n0b0d13s@...il.com>)
[FD] Defense in depth -- the Microsoft way (part 22): no DEP in Windows' filesystem (and ASLR barely used) ("Stefan Kanthak" <stefan.kanthak@...go.de>)

103 messages