full-disclosure mailing list - 2014/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2014/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 3	² 1	³ 16	⁴ 3	⁵ 3	⁶ 1	⁷
⁸ 4	⁹ 11	¹⁰ 7	¹¹ 2	¹²	¹³	¹⁴
¹⁵ 4	¹⁶ 14	¹⁷ 3	¹⁸ 7	¹⁹ 15	²⁰	²¹
²² 13	²³ 4	²⁴ 1	²⁵ 9	²⁶	²⁷ 2	²⁸
²⁹ 8	³⁰ 1	³¹ 6

Messages by day:

December 1 (3 messages)

[FD] [RT-SA-2014-007] Remote Code Execution in TYPO3 Extension ke_dompdf (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2014-009] Information Disclosure in TYPO3 Extension ke_questionnaire (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2014-011] EntryPass N5200 Credentials Disclosure (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

December 2 (1 message)

[FD] [RT-SA-2014-012] Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management Components (RedTeam Pentesting GmbH <release@...tea…)

December 3 (16 messages)

[FD] CVE-2014-9016 and CVE-2014-9034. Wordpress and Drupal DOS (C0r3dump3d <coredump@...istici.org>)
[FD] Yii framework CmsInput extension improper XSS sanitation ("A. W." <a.l.g.m.wetzels@...il.com>)
[FD] hack4 is coming - hackercon in berlin - date: end of the year 2014 (dash <dash@...k4.org>)
[FD] less out of bounds read access - TFPA 002/2014 (Hanno Böck <hanno@...eck.de>)
Re: [FD] CVE-2014-8610 Android < 5.0 SMS resend vulnerability (Joshua Wright <jwright@...borg.com>)
[FD] [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[FD] XSS in WIX pages (Devsec Security Departament <security@...l.devsec.cl>)
[FD] CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4 (<Stephan.Rickauer@...sscom.com>)
[FD] CSRF and XSS vulnerabilities in D-Link DAP-1360 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] XSS (in 20 chars) in Microsoft IIS 7.5 error message (waysea <waysea@...aysea.net>)
Re: [FD] XSS (in 20 chars) in Microsoft IIS 7.5 error message (Mark Steward <marksteward@...il.com>)
Re: [FD] XSS (in 20 chars) in Microsoft IIS 7.5 error message (James Hooker <seidrhrafn@...glemail.com>)
Re: [FD] XSS (in 20 chars) in Microsoft IIS 7.5 error message (A Z <kryptos.gnostikos@...il.com>)
Re: [FD] [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[FD] BSidesHH 2014 ("Daniel Busch" <BSidesHH2014@....de>)
[FD] Positive Hack Days V — Call for Papers (Alexander Lashkov <ALashkov@...ecurity.com>)

December 4 (3 messages)

Re: [FD] XSS (in 20 chars) in Microsoft IIS 7.5 error message (Barry Dorrans <Barry.Dorrans@...rosoft.com>)
[FD] Offset2lib: bypassing full ASLR on 64bit Linux (Hector Marco <hecmargi@....es>)
[FD] SpoofedMe - Social Login Impersonation Attack (Or Peles <ORPELES@...ibm.com>)

December 5 (3 messages)

[FD] NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (VMware Security Response Center <security@...are.com>)
[FD] CVE-2014-5462 - Multiple Authenticated SQL Injections In OpenEMR (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] NASA Orion - Bypass, Persistent Issue & Embed Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

December 6 (1 message)

[FD] [SE-2014-02] Google App Engine Java security sandbox bypasses (project pending completion / action from Google) (Security Explorations <contact@...urity-e…)

December 8 (4 messages)

[FD] Sony: 22 Breaches and Counting (Jeffrey Walton <noloader@...il.com>)
[FD] Coinbase User Enumeration ("stephen@...ragesecurityguy.info" <stephen@...ragesecurityguy.info>)
Re: [FD] [oss-security] Offset2lib: bypassing full ASLR on 64bit Linux (Agostino Sarubbo <ago@...too.org>)
Re: [FD] [oss-security] Offset2lib: bypassing full ASLR on 64bit Linux (Shawn <citypw@...il.com>)

December 9 (11 messages)

[FD] Humhub SQL injection and multiple persistent XSS vulnerabilities ("A. W." <a.l.g.m.wetzels@...il.com>)
[FD] Interesting Backdoor ("Alfred Baroti" <marianalfred@...il.com>)
[FD] NEW VMSA-2014-0013 - VMware vCloud Automation Center product updates address a critical remote privilege escalatio… (VMware Security Response Center <securi…)
[FD] CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-8489 Ping Identity Corporation "PingFederate 6.10.1 SP Endpoints" Dest Redirect Privilege Escalation Security Vu… (Jing Wang <justqdjing@...il.com>)
[FD] ESPN espn.go.com Login & Register Page XSS and Dest Redirect Privilege Escalation Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Keurig 2.0 Genuine K-Cup Spoofing Vulnerability (Kenneth Buckler <kenneth.buckler@...il.com>)
[FD] Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities (Simo Ben youssef <simo@...xploit.com>)
[FD] Call for Presenters - B-Sides Vancouver 2015 - March 16-17, 2015 in Vancouver, Canada (Colin Keigher <colin@...gher.ca>)
Re: [FD] Interesting Backdoor (Brandon Vincent <Brandon.Vincent@....edu>)
Re: [FD] Interesting Backdoor (Ed Tredgett <edtredgett@...icallysecure.com>)

December 10 (7 messages)

[FD] Releasing PuttyRider - for penetration testers (Adrian Furtuna <adif2k8@...il.com>)
[FD] Multiple vulnerabilities in InfiniteWP Admin Panel (Walter Hop <security@...m.lifeforms.nl>)
[FD] NEW VMSA-2014-0014 - AirWatch by VMware product update addresses information disclosure vulnerabilities (VMware Security Response Center <security@...are.…)
[FD] CVE-2014-8608 - Null Pointer Dereference In K7 Computing Multiple Products [K7Sentry.sys] (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-8956 - Privilege Escalation In K7 Computing Multiple Products [K7Sentry.sys] (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-7136 - Privilege Escalation In K7 Computing Multiple Products [K7FWFilt.sys] (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] AST-2014-019: Remote Crash Vulnerability in WebSocket Server ("Asterisk Security Team" <security@...erisk.org>)

December 11 (2 messages)

[FD] BMC TrackIt! Unauthenticated Arbitrary Local System User Password Change (Brandon Perry <bperry.volatile@...il.com>)
[FD] RedCloth contains unfixed XSS vulnerability for 9 years (Kousuke Ebihara <kousuke@...k.org>)

December 15 (4 messages)

[FD] Humhub insecure password validation and reset design ("A. W." <a.l.g.m.wetzels@...il.com>)
[FD] Docker 1.3.3 - Security Advisory [11 Dec 2014] (Eric Windisch <eric.windisch@...ker.com>)
[FD] Rooted CON 2014 talks (dubbed into english) are now online (omarbv@...eup.net)
[FD] Defense in depth -- the Microsoft way (part 23): two quotes or not to quote... ("Stefan Kanthak" <stefan.kanthak@...go.de>)

December 16 (14 messages)

[FD] CA20141215-01: Security Notice for CA LISA Release Automation ("Williams, Ken" <Ken.Williams@...com>)
[FD] fulldisclosure：你的文件 (庄容如 <svufcojd@...fes.com>)
[FD] CVE-2014-5437: Arris TG862G - Cross-site Request Forgery (CSRF) (Seth Art <sethsec@...il.com>)
[FD] CVE-2014-5438: Arris TG862G - Cross-site Scripting (XSS) (Seth Art <sethsec@...il.com>)
[FD] [SE-2014-02] Google App Engine Java security sandbox bypasses (status update) (Security Explorations <contact@...urity-explorations.com>)
[FD] [Onapsis Security Advisory 2014-034] SAP Business Objects Search Token Privilege Escalation via CORBA (Onapsis Research Labs <research@...psis.com>)
[FD] iUSB v1.2 iOS - Arbitrary Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] iWifi for Chat v1.1 iOS - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Fuzzylime v3.03b CMS - CS Cross Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Elefant CMS v1.3.9 - Persistent Name Update Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Konakart v7.3.0.1 CMS - CS Cross Site Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] RelateIQ Bug Bounty #1 - Persistent Signup Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface (Mazin Ahmed <mazen150@...mail.com>)
[FD] BOF(s) +SSRF in Honewell EPKS (SCADA StrangeLove <scadastrangelove@...il.com>)

December 17 (3 messages)

[FD] Bird Feeder v1.2.3 WP Plugin - CSRF & XSS Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Morfy CMS v1.05 - Command Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Jease CMS v2.11 - Persistent UI Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

December 18 (7 messages)

[FD] iTwitter v0.04 WP Plugin - XSS & CSRF Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] E-Journal CMS (ID) - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Facebook Bug Bounty #16 (Studio) - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Apple iOS v8.x - Message Context & Privacy Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SEC Consult SA-20141218-0 :: Multiple critical vulnerabilities in VDG Security SENSE (formerly DIVA) (SEC Consult Vulnerability Lab <research@...-consult.…)
[FD] SEC Consult SA-20141218-1 :: OS command execution vulnerability in GParted (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20141218-2 :: Multiple high risk vulnerabilities in NetIQ Access Manager (SEC Consult Vulnerability Lab <research@...-consult.com>)

December 19 (15 messages)

[FD] Dictionary/brute-force attack against "kerberized" IIS service accounts without triggering account lockout ("Ben Lincoln (F7EFC8C9 - FD)" <F7EFC8C9@...eat…)
[FD] The FBI Used the Web's Favorite Hacking Tool to Unmask Tor Users | WIRED ("Ivan .Heca" <ivanhec@...il.com>)
[FD] TWiki Security Alert CVE-2014-9325: XSS Vulnerability with QUERYSTRING and QUERYPARAMSTRING Variables (Peter Thoeny <peter09@...eny.org>)
[FD] TWiki Security Alert CVE-2014-9367: XSS Vulnerability with Scope and Other URL Parameters of WebSearch (Peter Thoeny <peter09@...eny.org>)
[FD] CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (Cross-Site Scripting) Security Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-8490 TennisConnect COMPONENTS System XSS (Cross-Site Scripting) Security Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] BF and XSS vulnerabilities in D-Link DCS-2103 ("MustLive" <mustlive@...security.com.ua>)
[FD] [REVIVE-SA-2014-002] Revive Adserver 3.0.6 and 3.1.0 fix multiple vulnerabilities (Matteo Beccati <php@...cati.com>)
[FD] The Misfortune Cookie Vulnerability (Shahar Tal <shahartal@...ckpoint.com>)
[FD] Yahoo Yahoo.com Yahoo.co.jp Open Redirect Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
Re: [FD] The Misfortune Cookie Vulnerability (Michal Zalewski <lcamtuf@...edump.cx>)
[FD] SEC Consult SA-20141219-0 :: XSS & Memory Disclosure vulnerabilities in NetIQ eDirectory NDS iMonitor (SEC Consult Vulnerability Lab <research@...-consult…)
[FD] iBackup v10.0.0.45 - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Mobilis 3g MobiConnect 3G++ ZDServer v1.0.1.2 - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Facebook BB #18 - IDOR Issue & Privacy Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

December 22 (13 messages)

Re: [FD] The Misfortune Cookie Vulnerability (Gynvael Coldwind <gynvael@...dwind.pl>)
Re: [FD] iBackup v10.0.0.45 - Privilege Escalation Vulnerability ("LayerSEC Ltd" <info@...ersec.com>)
[FD] Graylog2-Web LDAP Injection - CVE-2014-9217 ("J. Tozo" <juniorbsd@...il.com>)
[FD] CVE-2014-9330: Libtiff integer overflow in bmp2tiff (Project Zero Labs <labs@...jectzero.gr>)
[FD] VP-2014-004 SysAid Server Arbitrary File Disclosure (Vantage Point Security <lists@...tagepoint.sg>)
[FD] BBC about Ukrainian Cyber Forces ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] The Misfortune Cookie Vulnerability (Sandro Gauci <sandro@...blesecurity.com>)
Re: [FD] The Misfortune Cookie Vulnerability (Shahar Tal <shahartal@...ckpoint.com>)
Re: [FD] The Misfortune Cookie Vulnerability (Shahar Tal <shahartal@...ckpoint.com>)
[FD] Defense in depth -- the Microsoft way (part 24): applications built with SDKs may be vulnerable ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] CVE-2014-9330: Libtiff integer overflow in bmp2tiff (Michal Zalewski <lcamtuf@...edump.cx>)
[FD] Vulnerabilities in Samsung SyncThru Web Service ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] CVE-2014-9330: Libtiff integer overflow in bmp2tiff (Paris Zoumpouloglou <pariszoump@...il.com>)

December 23 (4 messages)

[FD] ObSecure 360 unauthenticated SQL injection (Patrick Webster <patrick@...hack.com>)
[FD] Stored XSS Vulnerability in CMS Serendipity v.2.0-rc1 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] CALL FOR PAPERS - NUIT DU HACK - 20/21 JUNE 2015 (freeman <freeman@...kerzvoice.net>)
Re: [FD] The Misfortune Cookie Vulnerability (Jon Hart <jhart@...ofed.org>)

December 24 (1 message)

[FD] Reflecting XSS Vulnerability in CMS Contenido 4.9.x-4.9.5 (Steffen Rösemann <steffen.roesemann1986@...il.com>)

December 25 (9 messages)

[FD] Facebook Bug Bounty #17 - Migrate Privacy Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Mobilis MobiConnect 3G ZDServer 1.x - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ZTE Ucell 3G Modem App - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Pimcore v3.0 & v2.3.0 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PHPLIST v3.0.6 & v3.0.10 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Lazarus Guestbook v1.22 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

December 27 (2 messages)

[FD] Defense in depth -- the Microsoft way (part 25): no secure connections to MSDN, TechNet, ... ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Wordpress Frontend Uploader Cross Site Scripting(XSS) (SECUPENT Research Center <research@...upent.com>)

December 29 (8 messages)

[FD] XSS and CSRF vulnerabilities in CMS Pylot ("MustLive" <mustlive@...security.com.ua>)
[FD] CSRF vulnerability in CMS e107 v.2 alpha2 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] CVE-2014-7293 Ex Libris Patron Directory Services (PDS) XSS (Cross-Site Scripting) Security Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] /usr/bin/a2p buffer overflow (up201407890@...nos.dcc.fc.up.pt)
[FD] CVE-2014-7294 Ex Libris Patron Directory Services (PDS) Open Redirect Security Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] CNN cnn.com Travel XSS and ADS Open Redirect Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Reminder and Extension CanSecWest CFP deadline tomorrow, December 30th. ("Dragos Ruiu" <dr@....net>)
[FD] nullcon HackIM Challenge 9-11 Jan 2015 (nullcon <nullcon@...lcon.net>)

December 30 (1 message)

[FD] Multiple SQL Injections and Reflecting XSS in Absolut Engine v. 1.73 CMS (Steffen Rösemann <steffen.roesemann1986@...il.com>)

December 31 (6 messages)

[FD] [KIS-2014-14] Osclass <= 3.4.2 (Search::setJsonAlert) SQL Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2014-15] Osclass <= 3.4.2 (ajax.php) Local File Inclusion Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2014-16] Osclass <= 3.4.2 (contact.php) Unrestricted File Upload Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2014-17] GetSimple CMS <= 3.3.4 (api.php) XML External Entity Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2014-18] Mantis Bug Tracker <= 1.2.17 (ImportXml.php) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2014-19] Symantec Web Gateway <= 5.2.1 (restore.php) OS Command Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

138 messages

Powered by blists - more mailing lists