full-disclosure mailing list - 2015/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 5	² 1	³	⁴	⁵ 11
⁶	⁷ 1	⁸ 5	⁹ 2	¹⁰ 4	¹¹ 1	¹²
¹³ 1	¹⁴ 4	¹⁵ 9	¹⁶ 5	¹⁷ 4	¹⁸	¹⁹
²⁰ 7	²¹ 12	²² 8	²³ 2	²⁴ 1	²⁵	²⁶ 3
²⁷ 10	²⁸ 7	²⁹ 3	³⁰ 9

Messages by day:

April 1 (5 messages)

[FD] Vulnerability in site leads to source code dump ("Johnny Five" <hax0r892374@...l.com>)
[FD] Remote file upload vulnerability in videowhisper-video-conference-integration wordpress plugin v4.91.8 ("Larry W. Cashdollar" <larry0@...com>)
[FD] Remote file upload vulnerability in wordpress plugin videowhisper-video-presentation v3.31.17 ("Larry W. Cashdollar" <larry0@...com>)
Re: [FD] [Tool] SPARTA 1.0 BETA (Antonio Quina <antonio.quina@...force.com>)
[FD] Ceragon FibeAir IP-10 SSH Private Key Exposure (CVE-2015-0936) (Tod Beardsley <todb@...asploit.com>)

April 2 (1 message)

[FD] NEW : VMSA-2015-0003 VMware product updates address critical information disclosure issue in JRE (VMware Security Response Center <security@...are.com>)

April 5 (11 messages)

[FD] Wordpress plugin Simple Ads Manager - SQL Injection ("ITAS Team" <itas.team@...s.vn>)
[FD] Multiple SQL Injection ("ITAS Team" <itas.team@...s.vn>)
[FD] Wordpress plugin Simple Ads Manager - Arbitrary File Upload ("ITAS Team" <itas.team@...s.vn>)
[FD] Wordpress plugin Simple Ads Manager - Information Disclosure ("ITAS Team" <itas.team@...s.vn>)
[FD] ECE Projects XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] 6kbbs v8.0 SQL Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] 6kbbs v8.0 Multiple CSRF (Cross-Site Request Forgery) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] 6kbbs v8.0 XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Proverbs Web Calendar 2.1.2 XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
Re: [FD] Remote file upload vulnerability in videowhisper-video-conference-integration wordpress plugin v4.91.8 ("Larry W. Cashdollar" <larry0@...com>)
[FD] phpSFP - Schedule Facebook Posts 1.5.6 Pre-auth SQL Injection (0-day) (Pichaya Morimoto <pichaya@...e.org>)

April 7 (1 message)

[FD] Reflected Cross-Site Scripting vulnerability in asdoc generated documentation ("Securify B.V." <lists@...urify.nl>)

April 8 (5 messages)

[FD] HotExBilling Manager – Cross-site scripting (XSS) vulnerability (Bhadresh Patel <Bhadresh.Patel@...pag.com>)
Re: [FD] [oss-security] Advisory: CVE-2014-9708: Appweb Web Server (Gsunde Orangen <gsunde.orangen@...il.com>)
[FD] New tool: smalisca - Static Code Analysis tool for Smali files (Levon Kayan <noptrix@...lsecurity.net>)
[FD] [CVE-2015-0779]: Novell ZenWorks Configuration Management remote code execution (Pedro Ribeiro <pedrib@...il.com>)
[FD] AST-2015-003: TLS Certificate Common name NULL byte exploit ("Asterisk Security Team" <security@...erisk.org>)

April 9 (2 messages)

[FD] SEC Consult SA-20150409-0 :: Multiple XSS & XSRF vulnerabilities in Comalatech Comala Workflows (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Network Solutions Webmail - A tale about chained web vulnerabilities (Cristiano Maruti <cmaruti@...il.com>)

April 10 (4 messages)

[FD] [Tool] nsec3map v0.3 - DNSSEC Zone Enumerator (An Onion <nsec3map@...c.org>)
[FD] SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035) (SEC Consult Vulnerability Lab <research@s…)
[FD] Fusion Engage v1.0.5 (WordPress Plugin) Local File Disclosure (Why Know <l33twax@...oo.com>)
[FD] Hidden backdoor API to root privileges in Apple OS X (Jeffrey Walton <noloader@...il.com>)

April 11 (1 message)

[FD] OrangeHRM Blind SQL Injection & XSS Vulnerabilities (Rehan Ahmed <knight_rehan@...mail.com>)

April 13 (1 message)

[FD] Safari iOS/OS X/Windows cookie access vulnerability (Jouko Pynnonen <jouko@....fi>)

April 14 (4 messages)

[FD] several issues in SQLite (+ catching up on several other bugs) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] several issues in SQLite (+ catching up on several other bugs) (Paul Vixie <paul@...barn.org>)
[FD] whitepaper: Identifier based XSSI attacks (Takeshi Terada <mbsdtest01@...il.com>)
[FD] Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...xchg8b.com>)

April 15 (9 messages)

[FD] Opoint Media Intelligence Unvalidated Redirects and Forwards (URL Redirection) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] NetCat CMS 3.12 Multiple Directory Traversal Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] NetCat CMS 3.12 HTML Injection Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Webs ID Reflected XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Comsenz SupeSite CMS 7.0 Stored XSS (Cross-site Scripting) Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Arbitary Code Execution in Apache Spark Cluster (Akhil Das <akhil@...moidanalytics.com>)
[FD] [Tool/API] desenmascara.me - Fingerprinting and assessing the web security awareness of websites (Emilio Casbas <ecasbasj@...oo.es>)
[FD] Huawei SEQ Analyst - XML External Entity Injection (XXE) (Uğur Cihan KOÇ <u.cihan.koc@...il.com>)
[FD] Huawei SEQ Analyst - Multiple Reflected Cross Site Scripting (XSS) (Uğur Cihan KOÇ <u.cihan.koc@...il.com>)

April 16 (5 messages)

[FD] CSRF and stored XSS in WordPress Content Slide allow an attacker to have full admin privileges (WordPress plugin) (dxw Security <security@....com>)
[FD] Reflected XSS in Citizen Space allows attackers to view sensitive information of the attacker’s choosing (WordPress plugi… (dxw Security <security@....com>)
[FD] Open Litespeed Use After Free Vulnerability (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
Re: [FD] several issues in SQLite (+ catching up on several other bugs) (Hanno Böck <hanno@...eck.de>)
[FD] SQL Injection, XSS and FPD vulnerabilities Nodes Studio CMS ("MustLive" <mustlive@...security.com.ua>)

April 17 (4 messages)

[FD] CVE-2014-5370 - Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2014-7954 MTP path traversal vulnerability in Android (Imre RAD <imre.rad@...rch-lab.hu>)
[FD] CVE-2014-7951 adb backup archive path traversal file overwrite (Imre RAD <imre.rad@...rch-lab.hu>)
[FD] CVE-2014-7953 Android backup agent code execution (Imre RAD <imre.rad@...rch-lab.hu>)

April 20 (7 messages)

Re: [FD] several issues in SQLite (+ catching up on several other bugs) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] several issues in SQLite (+ catching up on several other bugs) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] several issues in SQLite (+ catching up on several other bugs) (jungle Boogie <jungleboogie0@...il.com>)
Re: [FD] several issues in SQLite (+ catching up on several other bugs) (jungle Boogie <jungleboogie0@...il.com>)
[FD] Laravel - PHP Object Injection - 4.1, 4.2, 5.0, master (Scott Arciszewski <scott@...agonie.com>)
Re: [FD] several issues in SQLite (+ catching up on several other bugs) (Jeffrey Walton <noloader@...il.com>)
Re: [FD] several issues in SQLite (+ catching up on several other bugs) (Jeffrey Walton <noloader@...il.com>)

April 21 (12 messages)

Re: [FD] several issues in SQLite (+ catching up on several other bugs) (Reed Loden <reed@...dloden.com>)
[FD] Photo Manager Pro 4.4.0 iOS - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Mobile Drive HD v1.8 - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Photo Manager Pro v4.4.0 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wifi Drive Pro v1.2 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Inc Xcom #4 - (Item Preview) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Inc Xcom #6 - Persistent POST Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Inc Xcom #7 - (Policy) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Bug Bounty #113 - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Linux ASLR mmap weakness: Reducing entropy by half (Hector Marco-Gisbert <hecmargi@....es>)
[FD] AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5% (Hector Marco-Gisbert <hecmargi@....es>)

April 22 (8 messages)

[FD] Netgear WNR2000v4 Multiple Vulnerabilities (endeavor <endeavor@...nbowsandpwnies.com>)
[FD] Google Analytics by Yoast stored XSS #2 (Jouko Pynnonen <jouko@....fi>)
Re: [FD] Photo Manager Pro 4.4.0 iOS - Code Execution Vulnerability (Mario Vilas <mvilas@...il.com>)
[FD] Apple iOS 8.0 - 8.0.2 - Controls Re Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] iPassword Manager v2.6 iOS - Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Android 0-day vulnerability - Drive by download (ma sh <m4.shes@...oo.com>)
[FD] HomeAdvisor Bug Bounty #1 - Filter Bypass & Client Side Exception Handling Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CVE-2015-0984 SCADA - Gaining remote shell on Honeywell Falcon XLWEB (Martin Jartelius <mj@...post24.com>)

April 23 (2 messages)

[FD] Magento Unauthenticated RCE (Shahar Tal <shahartal@...ckpoint.com>)
[FD] Socrata Bug Bounty #1 - Persistent Encoding Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

April 24 (1 message)

[FD] [ALICLOUDSEC-VUL2015-001]Android wpa_supplicant WLAN Direct remote buffer overflow (朱东海 <donghai_zhu@...nhunt.com>)

April 26 (3 messages)

[FD] Surveillance system used for censorship in Europe - Censorship attack combines packet injection and Heartbleed (Doug <doug@...dcrypto.com>)
[FD] WordPress 4.2 stored XSS (Jouko Pynnonen <jouko@....fi>)
[FD] #WorldPenguinDay or this cant be right, can it? (PIN <zero@...c.co>)

April 27 (10 messages)

[FD] XSS and CSRF vulnerabilities in ASUS RT-G32 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] WordPress 4.2 stored XSS (Scott Arciszewski <scott@...iszewski.me>)
[FD] [CORE-2015-0008] - InFocus IN3128HD Projector Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
Re: [FD] WordPress 4.2 stored XSS (Hanno Böck <hanno@...eck.de>)
Re: [FD] WordPress 4.2 stored XSS (Anthony Ferrara <ircmaxell@...il.com>)
Re: [FD] WordPress 4.2 stored XSS (Fyodor <fyodor@...p.org>)
Re: [FD] WordPress 4.2 stored XSS (Scott Arciszewski <scott@...iszewski.me>)
Re: [FD] WordPress 4.2 stored XSS (Winni Neessen <winni@...ecure.so>)
Re: [FD] WordPress 4.2 stored XSS (Ryan Dewhurst <ryandewhurst@...il.com>)
Re: [FD] WordPress 4.2 stored XSS (Scott Arciszewski <scott@...iszewski.me>)

April 28 (7 messages)

[FD] [Additional vectors] Multiple vulnerabilities in Untangle NGFW 9-11 ("Calum Hutton" <c.e.hutton@....com>)
[FD] SonicWall SonicOS 7.5.0.12 & 6.x - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Bug Bounty #114 - JDWP Remote Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wing FTP Server Admin 4.4.5 CSRF & XSS Vulnerabilties (John Page <apparitionsec@...il.com>)
Re: [FD] WordPress 4.2 stored XSS (C0r3dump3d <coredump@...istici.org>)
[FD] Stored XSS in ebay messages (Jaanus <jaanus.kaap@...il.com>)
[FD] libarchive - Out of bounds read using malformed cpio archive (Paris Zoumpouloglou <pariszoump@...il.com>)

April 29 (3 messages)

[FD] CVE-ID 2015-1188: Swisscom DSL Router Centro Grande (ADB) (<csirt@...sscom.com>)
[FD] Type Confusion Infoleak Vulnerability in unserialize() with SoapFault (Taoguang Chen <taoguangchen@...il.com>)
[FD] Type Confusion Infoleak and Heap Overflow Vulnerability in unserialize() with exception (Taoguang Chen <taoguangchen@...il.com>)

April 30 (9 messages)

[FD] TestDisk 6.14 Check_OS2MB Stack Buffer Overflow (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] SevDesk v1.1 iOS - Persistent Dashboard Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Mysterious CVE-2008-568 (Solaris) (Mark Felder <feld@...d.me>)
[FD] Heap overflow / invalid read in Libtasn1 before 4.5 (TFPA 005/2015) (Hanno Böck <hanno@...eck.de>)
[FD] IKE Aggressive Mode Downgrade Attack? (Melchior Limacher <mli@...tect7.com>)
[FD] OS X 0day - works on latest verz (魏诺德 <sel83817@...os.com>)
Re: [FD] #WorldPenguinDay or this cant be right, can it? (PIN <zero@...c.co>)
Re: [FD] Mysterious CVE-2008-568 (Solaris) (Ian Neal <ineal@....edu>)
Re: [FD] Mysterious CVE-2008-568 (Solaris) (Michal Zalewski <lcamtuf@...edump.cx>)

115 messages

Powered by blists - more mailing lists