full-disclosure mailing list - 2015/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 1	² 2	³ 1	⁴
⁵ 3	⁶ 5	⁷ 3	⁸ 3	⁹ 1	¹⁰ 3	¹¹
¹² 20	¹³ 15	¹⁴ 5	¹⁵ 1	¹⁶ 5	¹⁷	¹⁸ 5
¹⁹ 2	²⁰ 5	²¹ 11	²² 11	²³	²⁴	²⁵ 1
²⁶ 4	²⁷ 2	²⁸ 9	²⁹ 11	³⁰ 5	³¹

Messages by day:

January 1 (1 message)

[FD] 31C3 releases: SmartGrid & USB modems (SCADA StrangeLove <scadastrangelove@...il.com>)

January 2 (2 messages)

[FD] Windows 8 Privilege Escalation (Allen <multimode1876@...il.com>)
[FD] [The ManageOwnage Series, part X]: 0-day administrator account creation in Desktop Central (Pedro Ribeiro <pedrib@...il.com>)

January 3 (1 message)

[FD] Defense in depth -- the Microsoft way (part 26): "Set Program Access and Computer Defaults" hides applications lik… ("Stefan Kanthak" <stefan.kanthak@...go.…)

January 5 (3 messages)

[FD] Mantis BugTracker 1.2.17 - Multiple security vulnerabilities. ("Popovici, Alejo (LATCO - Buenos Aires)" <apopovici@...OITTE.com>)
[FD] [The ManageOwnage Series, part XI]: Remote code execution in ServiceDesk, Asset Explorer, Support Center and IT360 (Pedro Ribeiro <pedrib@...il.com>)
Re: [FD] [The ManageOwnage Series, part X]: 0-day administrator account creation in Desktop Central (Pedro Ribeiro <pedrib@...il.com>)

January 6 (5 messages)

[FD] ZTE Datacard MF19 0V1.0.0B PCW - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure (Brandon Perry <bperry.volatile@...il.com>)
[FD] SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Reflecting XSS vulnerability in CMS Sefrengo v.1.6.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Reflecting XSS vulnerability in CMS Kajona v. 4.6 (Steffen Rösemann <steffen.roesemann1986@...il.com>)

January 7 (3 messages)

Re: [FD] [The ManageOwnage Series, part XI]: Remote code execution in ServiceDesk, Asset Explorer, Support Center and IT360 (Pedro Ribeiro <pedrib@...il.com>)
[FD] Call for papers - BSides Ljubljana - March 12th, 2015 in Ljubljana, Slovenia (Andraz Sraka <a@...bix.org>)
[FD] CVE-2014-9510 - TP-Link TL-WR840N Configuration Import Cross-Site Request Forgery (CSRF) (Sean Wright <swright@...ureworks.com>)

January 8 (3 messages)

[FD] Recon 2015 Call For Papers - June 19 - 21, 2015 - Montreal, Canada (cfp2015@...on.cx)
[FD] Multiple persistent XSS vulnerabilites in CMS BEdita v. 3.4.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Good for Enterprise Android HTML Injection (CVE-2014-4925) (Cláudio André <ca@...egrity.pt>)

January 9 (1 message)

[FD] Reflecting XSS vulnerability in CMS e107 v. 1.0.4 (Steffen Rösemann <steffen.roesemann1986@...il.com>)

January 10 (3 messages)

[FD] [Tool] SPARTA 1.0 BETA (Antonio Quina <antonio.quina@...force.com>)
[FD] CVE-2014-9560 Softbb.net SoftBB SQL Injection Security Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-9561 Softbb.net SoftBB XSS (Cross-Site Scripting) Security Vulnerability (Jing Wang <justqdjing@...il.com>)

January 12 (20 messages)

[FD] Facebook Old Generated URLs Still Vulnerable to Open Redirect Attacks & A New Open Redirect Security Vulnerability (Jing Wang <justqdjing@...il.com>)
[FD] Amazon Covert Redirect Based on Kindle Daily Post, Omnivoracious, Car Lust & kindlepost.com omnivoracious.com carlustblo… (Jing Wang <justqdjing@...il.com>)
[FD] Reflecting XSS vulnerability in CMS Croogo v.2.2.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Reflecting XSS vulnerability in CMS PHPKit WCMS v. 1.6.6 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Wordpress plugin Pods <= 2.4.3 XSS and CSRF vulnerabilities (Pietro Oliva <pietroliva@...il.com>)
[FD] Heroku API Bug Bounty #1 - Persistent Invitation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ZTE Datacard PCW(Telecom MF180) - Multiple Software Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Heroku API Deep Dive Bug Bounty #3 - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Blitz CMS Community - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [RT-SA-2014-015] Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] CVE-2014-8870: Arbitrary Redirect in Tapatalk Plugin for WoltLab Burning Board 4.0 (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] Corel Software DLL Hijacking (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Corel Software DLL Hijacking (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Corel Software DLL Hijacking ("CORE Security Technologies Advisories-team (jrv)" <advisories-publication@...esecurity.com>)
[FD] Wordpress Photo Gallery 1.2.7 unauthenticated SQL injection (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure (Brandon Perry <bperry.volatile@...il.com>)
[FD] XSS Vulnerability in Fork CMS 3.8.3 ("ITAS Team" <itas.team@...s.vn>)
[FD] Snom SIP phones denial of service through HTTP ("kapejod@...glemail.com" <kapejod@...il.com>)
[FD] Stored XSS Vulnerability in F5 BIG-IP Application Security Manager (Peter Lapp <lappsec@...il.com>)
[FD] Lizard Stresser rekt (Robert Cavanaugh <sleuth1337@...il.com>)

January 13 (15 messages)

Re: [FD] Snom SIP phones denial of service through HTTP (Martin Schuhmacher <broetchen25@....net>)
[FD] [Corrected] Stored XSS Vulnerability in F5 BIG-IP Application Security Manager (Peter Lapp <lappsec@...il.com>)
Re: [FD] Lizard Stresser rekt (Julius Kivimäki <julius.kivimaki@...il.com>)
Re: [FD] McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure (Tim <tim-security@...tinelchicken.org>)
[FD] SQL Injection Vulnerability in Microweber 0.95 ("ITAS Team" <itas.team@...s.vn>)
[FD] MS14-080 CVE-2014-6365 Technical Details Without "Nonsense" (Diéyǔ <dieyu@...yu.org>)
[FD] Reflecting XSS vulnerability in filemanager of CMS b2evolution v. 5.2.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: [FD] Snom SIP phones denial of service through HTTP (Max Mühlbronner <mm@...om.com>)
Re: [FD] Snom SIP phones denial of service through HTTP ("kapejod@...glemail.com" <kapejod@...il.com>)
[FD] SEC Consult SA-20150113-0 :: Multiple critical vulnerabilities in all snom desktop IP phones (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower (SEC Consult Vulnerability Lab <research@...-consult.com…)
[FD] SEC Consult SA-20150113-2 :: Cross-Site Request Forgery in XBMC / Kodi (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Foxit MobilePDF v4.4.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Sitefinity Enterprise v7.2.53 - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ZTE Datacard PCW(Telecom MF180) - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 14 (5 messages)

Re: [FD] SEC Consult SA-20150113-0 :: Multiple critical vulnerabilities in all snom desktop IP phones ("kapejod@...glemail.com" <kapejod@...il.com>)
[FD] Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection (Luke Walker <luke@...ckduck.nu>)
[FD] Reflected XSS in Flash files of TechSmith Camtasia 8 & 7 (Soroush Dalili <sd.bugreport@...il.com>)
Re: [FD] Snom SIP phones denial of service through HTTP (Martin Schuhmacher <broetchen25@....net>)
[FD] MS14-080 CVE-2014-6365 Code (Diéyǔ <dieyu@...yu.org>)

January 15 (1 message)

[FD] Alienvault OSSIM/USM Command Execution Vulnerability (Peter Lapp <lappsec@...il.com>)

January 16 (5 messages)

[FD] CatBot v0.4.2 (PHP) - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] VeryPhoto v3.0 iOS - Command Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] File Pro Mini v5.2 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Facebook Bug Bounty #19 - Filter Bypass Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 18 (5 messages)

[FD] Pandora FMS v5.1 SP1 - Persistent SNMP Editor Vulnerability ("admin@...lution-sec.com" <admin@...lution-sec.com>)
[FD] McAfee Advanced Threat Defense - Sandbox Fingerprinting & Bypass (David Coomber <davidcoomber.infosec@...il.com>)
[FD] Reflecting XSS vulnerability in administrative backend of CMS Websitebaker v. 2.8.3 SP3 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] N-central Remote Support Manager Multiple Vulnerabilities (Thomas Hibbert <Thomas.Hibbert@...urity-assessment.com>)
[FD] VLC Media Player 2.1.5 Memory Corruption Vulnerabilities (CVE-2014-9597, CVE-2014-9597) (Veysel hataş <vhatas@...il.com>)

January 19 (2 messages)

[FD] SPSControl v1.2 iOS - (.spc) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Banana Dance Wiki CMS b2.x - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 20 (5 messages)

[FD] MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities (Advisories <advisories@...waisecurity.de>)
[FD] Barracuda Load Balancer ADC VM multiple vulnerabilities (Cristiano Maruti <cmaruti@...il.com>)
[FD] Hack In Paris 2015 Call For Papers / Call For Trainings (Damien Cauquil <d.cauquil@...dream.com>)
[FD] vorbis-tools issues (Paris Zoumpouloglou <pariszoump@...il.com>)
[FD] WebGUI 7.10.29 stable version Cross site scripting vulnerability (SECUPENT Research Center <research@...upent.com>)

January 21 (11 messages)

[FD] Arbitrary File Upload in articleFR CMS 3.0.5 ("Tien Tran Dinh" <tien.d.tran@...s.vn>)
[FD] SQL injection vulnerability in articleFR CMS 3.0.5 ("Tien Tran Dinh" <tien.d.tran@...s.vn>)
[FD] Remote Desktop v0.9.4 Android - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] LizardSquad DDoS Stresser - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] iExplorer 3.6.3 - DLL Hijacking Exploit itunesmobiledevice.dll (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PhotoSync v1.1.3 Android - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [RT-SA-2014-010] AVM FRITZ!Box Firmware Signature Bypass (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards. ("J. Tozo" <juniorbsd@...il.com>)
[FD] full name disclosure information leak in google drive (kevin mcsheehan <kevin@...heehan.com>)
Re: [FD] full name disclosure information leak in google drive (Daniel Miller <bonsaiviking@...il.com>)
Re: [FD] full name disclosure information leak in google drive (kevin mcsheehan <kevin@...heehan.com>)

January 22 (11 messages)

[FD] SEC Consult SA-20150122-0 :: Multiple critical vulnerabilities in Symantec Data Center Security: Server Advanced (… (SEC Consult Vulnerability Lab <research…)
[FD] Program-O v2.4.6 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PhotoSync 1.1.3 Android - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] USAA mobile app gives away personal data; fix released (David Longenecker <david@...ngeneckers.com>)
Re: [FD] full name disclosure information leak in google drive (forgottenpassword <forgottenpassword@...eup.net>)
[FD] CVE-2014-9558 SmartCMS Multiple SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-9557 SmartCMS Multiple XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Alibaba Taobao, AliExpress, Tmall, Online Electronic Shopping Website XSS & Open Redirect Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha (Steffen Rösemann <steffen.roesemann198…)
[FD] IT Hot Topics 2015 Call for Papers (Squirrel Herder Productions <squirrelherderproductions@...il.com>)
[FD] XSS vulnerability in articleFR CMS 3.0.5 ("Tien Tran Dinh" <tien.d.tran@...s.vn>)

January 25 (1 message)

[FD] SWFupload 2.5.0 - Cross Frame Scripting (XFS) Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 26 (4 messages)

[FD] Mangallam CMS - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [CORE-2015-0002] - Android WiFi-Direct Denial of Service (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Barracuda Networks Cloud Series - Filter Bypass Vulnerability ("bkm@...lution-sec.com" <bkm@...lution-sec.com>)
[FD] [Call For Papers] Security BSides San Francisco April 2015 (BSidesLV <bsideslv@...il.com>)

January 27 (2 messages)

[FD] [CORE-2015-0003] - FreeBSD Kernel Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
[FD] NEW VMSA-2015-0001 - VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address resolve security… (VMware Security Response Center <securi…)

January 28 (9 messages)

[FD] [AMPLIA-ARA100614] OS X Gatekeeper Bypass Vulnerability (Amplia Security Advisories <advisories@...liasecurity.com>)
[FD] CVE-2015-1042 - Mantis BugTracker 1.2.19 - URL Redirection to Untrusted Site ('Open Redirect') ("Popovici, Alejo (LATCO - Buenos Aires)" <apopovici@...OIT…)
[FD] Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Qualys Security Advisory <qsa@...lys.com>)
[FD] Reflecting XSS vulnerabilities in CMS Saurus v. 4.7 (CE) (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Wordpress Geo Mashup plugin <= 1.8.2 XSS vulnerability (Paolo Perego <paolo@...oredcode.com>)
[FD] [The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360) (Pedro Ribeiro <pedrib@...il.com>)
Re: [FD] Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Timo Goosen <timogoosen@...guard.tg>)
[FD] AST-2015-001: File descriptor leak when incompatible codecs are offered ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2015-002: Mitigation for libcURL HTTP request injection vulnerability ("Asterisk Security Team" <security@...erisk.org>)

January 29 (11 messages)

[FD] Vulnerabilities in HP LaserJet ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards. ("Paul B. Henson" <henson@....org>)
[FD] KL-001-2015-001 : Windows 2003 tcpip.sys Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] AirWatch Multiple Direct Object References (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] Cisco Meraki Systems Manager Multiple Vulnerabilities (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] Fortinet FortiAuthenticator Multiple Vulnerabilities (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] Fortinet FortiClient Multiple Vulnerabilities (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] Fortinet FortiOS Multiple Vulnerabilities (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] Kaseya BYOD Gateway Multiple Vulnerabilities (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] Kaseya Browser Android Path Traversal (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] NEW VMSA-2015-0002 VMware vSphere Data Protection product update addresses a certificate validation vulnerability (VMware Security Response Center <securi…)

January 30 (5 messages)

[FD] Symantec Encryption Management Server < 3.2.0 MP6 - Remote Command Injection (Paul Craig <lists@...tagepoint.sg>)
[FD] Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385 (Onur Yilmaz <onur@...sparker.com>)
[FD] Facebook Malware that infected more than 110K and still on the rise (Mohammad Reza Faghani <faghani@...hani.info>)
[FD] Registration open for Rooted CON 2015 (omarbv <omarbv@...eup.net>)
[FD] Unrevealed Secrets of MAL-Drone (jack ana <meeta10x@...uxmail.org>)

134 messages

Powered by blists - more mailing lists