full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 6
² 8	³ 5	⁴ 2	⁵ 2	⁶	⁷	⁸ 10
⁹	¹⁰ 1	¹¹ 5	¹² 8	¹³ 11	¹⁴ 3	¹⁵
¹⁶ 1	¹⁷ 1	¹⁸ 12	¹⁹	²⁰	²¹ 13	²² 1
²³ 1	²⁴ 1	²⁵ 5	²⁶ 3	²⁷ 1	²⁸ 1

Messages by day:

February 1 (6 messages)

[FD] Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
[FD] CVE-2014-9559 SnipSnap XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384 (Onur Yilmaz <onur@...sparker.com>)
[FD] Defense in depth -- the Microsoft way (part 27): the command line you get differs from the command line I use to c… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] SQL injection vulnerabilities in zerocms <= v.1.3.3 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] iTunes 12.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathnam… ("Stefan Kanthak" <stefan.kanthak@...go.…)

February 2 (8 messages)

[FD] CVE-2014-5360 Landesk Management Suite XSS (Cross-Site Scripting) Security Vulnerability (Alex Haynes <alex_haynes@...look.com>)
[FD] Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities (ITAS TEAM <itas.team@...s.vn>)
[FD] CVE-2014-9562 OptimalSite Content Management System (CMS) XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] About Group (about.com) All Topics (At least 99.88% links) Vulnerable to XSS & Iframe Injection Security Attacks, About.… (Jing Wang <justqdjing@...il.com>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (Joey Fowler <joey@...blr.com>)
Re: [FD] iTunes 12.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pat… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] iTunes 12.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pat… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] [Call For Papers] BSides Knoxville, TN - May 15th 2015 (Adam Caudill <adam@...mcaudill.com>)

February 3 (5 messages)

[FD] Maldrone for drones. (Rahul Sasi <fb1h2s@...il.com>)
[FD] My Little Forum Multiple XSS Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] MSA-2015-02: Hewlett-Packard UCMDB - JMX-Console Authentication Bypass (Advisories <advisories@...waisecurity.de>)
[FD] Capstone disassembly engine 3.0.1 released! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] SQL injection vulnerability in Pragyan CMS v.3.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)

February 4 (2 messages)

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched ("Ben Lincoln (F7EFC8C9 - FD)" <F7EFC8C9@...eaththewaves.net>)

February 5 (2 messages)

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (Zaakiy Siddiqui <zaakiy@...con.com.au>)
[FD] CFP: Extended submission deadline:: ISSRMET2015 Dubai (Hazel Ann <hazel.sdiwc@...il.com>)

February 8 (10 messages)

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched ("Dimitris Strevinas" <d.strevinas@...ela.com>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
[FD] Very Important Info About "Major Internet Explorer Vulnerability - NOT Patched" (David Leo <david.leo@...sen.co.uk>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (David Leo <david.leo@...sen.co.uk>)
[FD] LG On Screen Phone authentication bypass (CVE-2014-8757) (Imre Rad <imre.rad@...rch-lab.hu>)
[FD] Responder Windows Version (laurent gaffie <laurent.gaffie@...il.com>)
[FD] Multiple CSRF vulnerabilities in eFront v. 3.6.15.2 (CE) (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched ("Barkley, Peter" <peter.barkley@....com>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (Justin Steven <justin@...tinsteven.com>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched ("Ben Lincoln (F7EFC8C9 - FD)" <F7EFC8C9@...eaththewaves.net>)

February 10 (1 message)

[FD] [RT-SA-2014-013] Cross-Site Scripting in IBM Endpoint Manager Relay Diagnostics Page (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

February 11 (5 messages)

[FD] Barracuda Cloud Series - Filter Bypass Vulnerability (ID 731) (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Facebook Bug Bounty #23 - Session ID & CSRF Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] BlinkSale Bug Bounty #1 - Encode & Validation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Pandora FMS v5.1 SP1 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] T-Mobile Internet Manager - DLL Hijacking (mfc71enu.dll) (Vulnerability Lab <research@...nerability-lab.com>)

February 12 (8 messages)

[FD] Radexscript CMS 2.2.0 - SQL Injection vulnerability ("ITAS Team" <itas.team@...s.vn>)
Re: [FD] Suspicious URL:Re: Major Internet Explorer Vulnerability - NOT Patched (Christoph Gruber <list@...u.at>)
[FD] MooPlayer 1.3.0 'm3u' SEH Buffer Overflow POC (Samandeep Singh <samandeep.singh@...consulting.com>)
[FD] CVE-2014-6412 - WordPress (all versions) lacks CSPRNG (Scott Arciszewski <scott@...iszewski.me>)
Re: [FD] Facebook Bug Bounty #23 - Session ID & CSRF Vulnerability (Scott Arciszewski <scott@...iszewski.me>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched ("Sijmen Ruwhof" <sijmen@...undity.com>)
[FD] [ANN] MSKB 3004375 available for Windows 2000 and later too (but NOT from Mcirosoft) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Shakacon 2015 Last Call for Papers (July 6-9 2015, Honolulu, Hawaii) (Jonathan Brossard <endrazine@...il.com>)

February 13 (11 messages)

[FD] eTouch SamePage v4.4.0.0.239 multiple vulnerabilities (Brandon Perry <bperry.volatile@...il.com>)
[FD] CVE-2014-8753 Cit-e-Net Multiple XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-9469 vBulletin XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Followup on CVE-2014-6412 (Scott Arciszewski <kobrasrealm@...il.com>)
Re: [FD] CVE-2014-6412 - WordPress (all versions) lacks CSPRNG (Paul McMillan <paul@...illan.ws>)
[FD] Vanilla forum Stored XSS on any private message / thread post (W S <w@...ox.ru>)
[FD] NetGear WNDR Authentication Bypass / Information Disclosure (Peter Adkins <peter.adkins@...nelpicnic.net>)
[FD] Reflecting XSS vulnerabitlies, unrestricted file upload and underlaying CSRF in Landsknecht Adminsystems CMS v. 4… (Steffen Rösemann <steffen.roesemann198…)
Re: [FD] Facebook Bug Bounty #23 - Session ID & CSRF Vulnerability (Alfie John <alfiej@...tmail.fm>)
Re: [FD] Major Internet Explorer Vulnerability - NOT Patched (Dan Ballance <tzewang.dorje@...il.com>)
Re: [FD] Facebook Bug Bounty #23 - Session ID & CSRF Vulnerability (Julius Kivimäki <julius.kivimaki@...il.com>)

February 14 (3 messages)

[FD] CVE-2015-1574 - Google Email App 4.2.2 remote denial of service (Hector Marco <hecmargi@....es>)
[FD] CVE-2015-1593 - Linux ASLR integer overflow: Reducing stack entropy by four (Hector Marco <hecmargi@....es>)
[FD] HumHub .htaccess file upload vulnerability and remote code execution ("A. W." <a.l.g.m.wetzels@...il.com>)

February 16 (1 message)

[FD] Siemens SIMATIC TIA Portal (Step 7/WinCC) fixes (SCADA StrangeLove <scadastrangelove@...il.com>)

February 17 (1 message)

[FD] Ebay Inc Magento Bug Bounty #5 - Persistent Validation & Mail Encoding Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

February 18 (12 messages)

[FD] [RT-SA-2014-016] Directory Traversal and Arbitrary File Disclosure in hybris Commerce Software Suite (RedTeam Pentesting GmbH <release@...team-pentesting.…)
[FD] Agora Marketplace CSRF to Steal Bitcoins (agorahooawayyfoe.onion) (agoraagoraagora@...hmail.com)
[FD] Bug in TradeWinds (Juan Martinez <gus70938@...il.com>)
[FD] DLGuard Multiple XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] DLGuard Full Path Disclosure (Information Leakage) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] DLGuard SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] CVE-2014-9468 InstantASP InstantForum.NET Multiple XSS (Cross-Site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Crushftp 7.2.0 - Multiple CSRF & XSS Vulnerabilities (Rehan Ahmed <knight_rehan@...mail.com>)
[FD] [CVE-REQUEST] Multiple vulnerabilities on GLPI (Stiehl <pstiehl@...si.com>)
[FD] PHP Code Execution in jui_filter_rules Parsing Library (Timo Schmid <tschmid@...w.de>)
[FD] Reflecting XSS- and SQL injection-vulnerabilities in the administrative backend of Piwigo <= v. 2.7.3 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Reflected File Download in AOL Search Website (Ricardo Iramar dos Santos <riramar@...il.com>)

February 21 (13 messages)

[FD] WooCommerce WordPress plugin 2.2.10 Reflected XSS (Eric Flokstra <e.flokstra@...ec.nl>)
[FD] Easy Social Icons WordPress plugin v1.2.2 Persistent XSS and CSRF (Eric Flokstra <e.flokstra@...ec.nl>)
[FD] New version of Hyperion PE runtime encrypter (Levon Kayan <noptrix@...lsecurity.net>)
[FD] VLC for Android beta crash (Paweł <pantrombka@...il.com>)
[FD] Samsung iPolis XnsSdkDeviceIpInstaller.ocx ActiveX Remote Code Execution Vulnerabilities (Praveen D <praveend.hac@...il.com>)
[FD] Defense in depth -- the Microsoft way (part 28): yes, we can (create even empty, but properly quoted pathnames) ("Stefan Kanthak" <stefan.kanthak@...go.de…)
[FD] iTunes 12.1.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathn… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Multiple stored XSS-vulnerabilities in MyBB v. 1.8.3 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Multiple SQLi-, stored/reflected XSS- and CSRF-vulnerabilities in phpBugTracker v. 1.6.0 (Steffen Rösemann <steffen.roesemann1986@...il.com>)
[FD] Use After Free Vulnerability in unserialize() with DateTime* [CVE-2015-0273] (Taoguang Chen <taoguangchen@...il.com>)
[FD] Type Confusion Infoleak Vulnerability in unserialize() with DateTimeZone (Taoguang Chen <taoguangchen@...il.com>)
[FD] xaviershay-dm-rails v0.10.3.8 mysql credential exposure ("Larry W. Cashdollar" <larry0@...com>)
[FD] Defense in depth -- the Microsoft way (part 29): contradicting, ambiguous, incomplete documentation ("Stefan Kanthak" <stefan.kanthak@...go.de>)

February 22 (1 message)

[FD] Fwd: Apple OS X: Don't trust, and don't prompt to trust certificates (Douglas Held <risk@...glasheld.net>)

February 23 (1 message)

[FD] ECommerce-Shopping Cart Zeuscart v. 4: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities (Steffen Rösemann <steffen.roesemann1986@…)

February 24 (1 message)

[FD] WESP SDK multiple Remote Code Execution Vulnerabilities (Praveen D <praveend.hac@...il.com>)

February 25 (5 messages)

[FD] [Onapsis Security Advisory 2015-001] Multiple Reflected Cross Site Scripting Vulnerabilities in SAP HANA Web-based… (Onapsis Research Labs <research@...psis…)
[FD] [Onapsis Security Advisory 2015-002] SAP Business Objects Unauthorized File Repository Server Read via CORBA (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-003] SAP Business Objects Unauthorized File Repository Server Write via CORBA (Onapsis Research Labs <research@...psis.com…)
[FD] [Onapsis Security Advisory 2015-005] SAP Business Objects Unauthorized Audit Information Access via CORBA (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-004] SAP Business Objects Unauthorized Audit Information Delete via CORBA (Onapsis Research Labs <research@...psis.com>)

February 26 (3 messages)

[FD] DSS TFTP 1.0 Server - Path Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Data Source: Scopus CMS - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wireless File Transfer Pro Android - Multiple CSRF Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

February 27 (1 message)

[FD] SEC Consult SA-20150227-0 :: Multiple vulnerabilities in Loxone Smart Home (SEC Consult Vulnerability Lab <research@...-consult.com>)

February 28 (1 message)

[FD] Swiss File Knife v1.7.4 HTTP - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

101 messages