full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 3	² 3	³
⁴ 6	⁵ 3	⁶ 6	⁷ 4	⁸ 12	⁹ 6	¹⁰ 2
¹¹ 2	¹² 1	¹³ 6	¹⁴ 7	¹⁵ 4	¹⁶	¹⁷ 2
¹⁸ 7	¹⁹ 9	²⁰ 12	²¹	²² 8	²³	²⁴ 2
²⁵ 6	²⁶	²⁷ 11	²⁸ 2	²⁹ 1	³⁰	³¹ 10

Messages by day:

May 1 (3 messages)

Re: [FD] Mysterious CVE-2008-568 (Solaris) (Cédric Picard <cpicard@...nmailbox.org>)
Re: [FD] IKE Aggressive Mode Downgrade Attack? (Lee <ler762@...il.com>)
Re: [FD] #WorldPenguinDay or this cant be right, can it? (Tavis Ormandy <taviso@...xchg8b.com>)

May 2 (3 messages)

Re: [FD] #WorldPenguinDay or this cant be right, can it? (PIN <zero@...c.co>)
Re: [FD] #WorldPenguinDay or this cant be right, can it? (Tavis Ormandy <taviso@...xchg8b.com>)
Re: [FD] #WorldPenguinDay or this cant be right, can it? (PIN <zero@...c.co>)

May 4 (6 messages)

[FD] HUAWEI MobiConnect 23.9.17.216 - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cisco (Newsroom) - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Grindr v2.1.1 iOS Bounty #1 - (Session) Auth Bypass Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Grindr v2.1.1 iOS - (eMail) Session Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Grindr 2.1.1 iOS Bug Bounty #2 - Denial of Service Software Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PhotoWebsite v3.1 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

May 5 (3 messages)

[FD] vPhoto-Album v4.2 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Fortinet FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL (Pedro Ribeiro <pedrib@...il.com>)

May 6 (6 messages)

[FD] F5 ASM JSON Profile Bypass (Peter Lapp <lappsec@...il.com>)
[FD] Oracle Business Intelligence Mobile HD v11.x iOS - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PDF Converter & Editor 2.1 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] TORNADO Computer Trading CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Alienvault OSSIM/USM Multiple Vulnerabilities (Peter Lapp <lappsec@...il.com>)
[FD] [SE-2014-02] Some additional GAE Java security sandbox bypasses (Security Explorations <contact@...urity-explorations.com>)

May 7 (4 messages)

[FD] pydio vulnerabilities (Just A Fake <robottomonitorbugtraq@...il.com>)
[FD] Album Streamer v2.0 iOS - Directory Traversal Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Yahoo eMarketing Bug Bounty #31 - Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Grindr v2.1.1 iOS & Account System - Breach Attack Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

May 8 (12 messages)

[FD] Pimcore v3.0.5 CMS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SAP vulnerabilities highlighted in many reports such as HP Cyber Risk Report 2015 (Darya Maenkova <d.maenkova@...scan.com>)
[FD] Yet Another Related Posts Plugin (YARPP) 4.2.4 CSRF -> XSS -> RCE (Evex ola <evexola@...il.com>)
[FD] Docker 1.6.1 - Security Advisory [150507] (Eric Windisch <ewindisch@...ker.com>)
Re: [FD] AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5% (Hector Marco-Gisbert <hecmargi@....es>)
Re: [FD] pydio vulnerabilities (Julius Kivimäki <julius.kivimaki@...il.com>)
[FD] MT.VERNON MEDIA Web-Design v1.12 Multiple XSS (Cross-site Scripting) Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] MT.VERNON MEDIA Web-Design v1.12 Multiple SQL Injection Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] MT.VERNON MEDIA Web-Design v1.12 HTML Injection Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Artnana Webboard version 1.4 XSS (Cross-site Scripting) Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Feed2JS v1.7 XSS (Cross-site Scripting) Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
Re: [FD] Alienvault OSSIM/USM Multiple Vulnerabilities (Peter Lapp <lappsec@...il.com>)

May 9 (6 messages)

[FD] Capstone disassembly framework 3.0.3 is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] DAVOSET v.1.2.4 ("MustLive" <mustlive@...security.com.ua>)
[FD] CVE-2014-3440 - Symantec Critical System Protection RCE (Balint Varga-Perke <vpbalint@...entsignal.hu>)
[FD] Wordpress Twenty Fifteen Theme - DOM XSS Vulnerability - CVE-2015-3429 (Onur Yilmaz <onur@...sparker.com>)
[FD] Wordpress Roomcloud plugin v1.1(rev @1115307) XSS vulnerability (Nitin Venkatesh <venkatesh.nitin@...il.com>)
[FD] 0day Mailbird XSS ? ("Alfred Baroti" <marianalfred@...il.com>)

May 10 (2 messages)

[FD] Sqlbuddy Path Traversal Vulnerability (John Page <hyp3rlinx@...il.com>)
[FD] Broken, Abandoned, and Forgotten Code (Zach C <uid000@...il.com>)

May 11 (2 messages)

[FD] G-Homa WLan Power Plug Multiple Problems (honeypot <honeypot@...he.org>)
[FD] Call for Papers: RAID 2015 (Skander Iversen <skander.iversen@...il.com>)

May 12 (1 message)

[FD] Two invalid read errors / heap overflows in SQLite (TFPA 006/2015) (Hanno Böck <hanno@...eck.de>)

May 13 (6 messages)

[FD] SEC Consult SA-20150513-0 :: Multiple critical vulnerabilities in WSO2 Identity Server (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Web India Solutions CMS 2015 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Concrete5 Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-2250 (Onur Yilmaz <onur@...sparker.com>)
[FD] Multiple Vulnerabilities in Openlitespeed <= 1.3.10 - CVE-b045-73d a.k.a. Analbleed. (Anal Bleed <analbleedlabs@...il.com>)
[FD] New release of,STONIX OS hardening tool (Roy Nielsen <amrset@....com>)

May 14 (7 messages)

Re: [FD] Concrete5 Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-2250 (Scott Arciszewski <scott@...iszewski.me>)
[FD] SEC Consult SA-20150514-0 :: Multiple vulnerabilities in Loxone Smart Home (part 2) (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Hue 3.7.1 Local Privilege Escalation (Julian Horoszkiewicz <ewilded@...il.com>)
[FD] Ambari Server 1.7.0 Local Privilege Escalation (Julian Horoszkiewicz <ewilded@...il.com>)
[FD] Read heap overflow / invalid memory access in Wireshark (Hanno Böck <hanno@...eck.de>)
[FD] How to detect a promiscuous interface by using WMIC (Eiji James Yoshida <ptrs-ejy@...iij4u.or.jp>)
[FD] Broken, Abandoned, and Forgotten Code, Part 4 (Zach C <uid000@...il.com>)

May 15 (4 messages)

[FD] [SE-2014-02] Unconfirmed / unpatched vulnerabilities in Google App Engine (Security Explorations <contact@...urity-explorations.com>)
[FD] XML Injection, AoF and BF vulnerabilities in Hikvision DS-2CD2012-I ("MustLive" <mustlive@...security.com.ua>)
[FD] CSRF & XSS vulnerabilities in Encrypted Contact Form Wordpress Plugin v1.0.4 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
[FD] Chinease attack on USIS using SAP vulnerability – Detailed review and comments (Darya Maenkova <d.maenkova@...scan.com>)

May 17 (2 messages)

[FD] Soundcloud XSS (Cross-Site Scripting) Security Vulnerability (Researcher Triponoid <researchertriponoid@...il.com>)
[FD] ftpmap 0.5 Release Announcement (Hypsurus <hypsurus@...l.ru>)

May 18 (7 messages)

[FD] Facebook #26 - Filter Bypass & Exception Handling Redirect Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CRUCMS Crucial Networking - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wireless Photo Transfer v3.0 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] iClassSchedule 1.6 iOS & Android - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] OYO File Manager 1.1 iOS&Android - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] KL-001-2015-002 : Piriform CCleaner Wiped Filename Recovery (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] [Samba 3.0.37] EnumPrinters memory corruption (Gabriele Avosani <g.avosani@...il.com>)

May 19 (9 messages)

[FD] SEC Consult SA-20150519-0 :: Critical buffer overflow vulnerability in KCodes NetUSB (VU#177092, CVE-2015-3036) (SEC Consult Vulnerability Lab <research@s…)
[FD] SQLi in FeedWordPress WordPress plugin (Adrián M. F. <adrimf85@...il.com>)
[FD] Milw0rm Clone Script v1.0 - (time based) SQLi (john smith <aftern00n1338@...oo.in>)
[FD] Clickheat 1.13+ Unauthenticated RCE ("Calum Hutton" <c.e.hutton@....com>)
[FD] Xamarin for Android <5.1 DLL Hijack Vulnerability (ValdikSS <iam@...dikss.org.ru>)
Re: [FD] KL-001-2015-002 : Piriform CCleaner Wiped Filename Recovery (Jean-François Gingras <jean.francois.gingras@...il.com>)
[FD] Multiple Vulnerabilities in ZTE AC 3633R USB Modem (vishnu raju <rajuvishnu52@...il.com>)
[FD] 0-day Denial of Service in IPsec-Tools (Javantea <jvoss@...sci.com>)
[FD] XML Injection, AoF and BF vulnerabilities in Hikvision DS-7108HWI-SH ("MustLive" <mustlive@...security.com.ua>)

May 20 (12 messages)

Re: [FD] 0-day Denial of Service in IPsec-Tools (christos@...las.com (Christos Zoulas))
Re: [FD] Xamarin for Android <5.1 DLL Hijack Vulnerability (Tim <strazz@...il.com>)
Re: [FD] Xamarin for Android <5.1 DLL Hijack Vulnerability (ValdikSS <iam@...dikss.org.ru>)
Re: [FD] Xamarin for Android <5.1 DLL Hijack Vulnerability (Tim <strazz@...il.com>)
Re: [FD] Xamarin for Android <5.1 DLL Hijack Vulnerability (ValdikSS <iam@...dikss.org.ru>)
[FD] HiDisk 2.4 iOS - (currentFolderPath) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WISE-FTP Software v8.0.2 - DLL Hijacking Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Staff FTP v3.04 Software - DLL Hijacking Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Eisbär SCADA (All Versions - iOS, Android & W8) - Persistent UI Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] hardwear.io - Hardware Security Conference Call for Papers (Hardwear Team <hw@...dwear.io>)
[FD] CVE ID assignment - eZPublish vulnerability (us3r777 <us3r777@...0.so>)
[FD] CVE for Apple's ECDHE-ECDSA SecureTransport bug? (Jeffrey Walton <noloader@...il.com>)

May 22 (8 messages)

[FD] [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability (CORE Advisories Team <advisories@...esecurity.com>)
[FD] SAP Security Notes May 2015 (Darya Maenkova <d.maenkova@...scan.com>)
[FD] Hacktivity 2015 CFP (Ferenc Spala <ferenc.spala@...ktivity.com>)
[FD] 0day Mailbird XSS (Henri Salo <henri@...v.fi>)
[FD] Hue 3.7.1 Local Privilege Escalation (Henri Salo <henri@...v.fi>)
[FD] Multiple Vulnerabilities in Openlitespeed <= 1.3.10 - CVE-b045-73d a.k.a. Analbleed. (Henri Salo <henri@...v.fi>)
[FD] call for paper(information retrieval, privacy) (Hongkai Wu <hw271@...rgetown.edu>)
[FD] Broken, Abandoned, and Forgotten Code, Part 5 (Zach C <uid000@...il.com>)

May 24 (2 messages)

[FD] Gcon Tech Solutions v1.0 XSS (Cross-site Scripting) Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Gcon Tech Solutions v1.0 SQL Injection Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)

May 25 (6 messages)

[FD] SITEFACT CMS XSS (Cross-site Scripting) Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] phpwind v8.7 XSS (Cross-site Scripting) Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Command injection vulnerability in Synology Photo Station ("Securify B.V." <lists@...urify.nl>)
[FD] Reflected Cross-Site Scripting in Synology DiskStation Manager ("Securify B.V." <lists@...urify.nl>)
[FD] Synology Photo Station multiple Cross-Site Scripting vulnerabilities ("Securify B.V." <lists@...urify.nl>)

May 27 (11 messages)

[FD] CVE-2015-4062, CVE-2015-4063: Multiple vulnerabilities in WordPress plugin "NewStatPress" (Adrián M. F. <adrimf85@...il.com>)
[FD] CVE-2015-4064, CVE-2015-4065: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages" (Adrián M. F. <adrimf85@...il.com>)
[FD] CVE-2015-4066: SQLi vulnerabilities in WordPress plugin "GigPress" (Adrián M. F. <adrimf85@...il.com>)
[FD] ClearPass Policy Manager Stored XSS (Cristiano Maruti <cmaruti@...il.com>)
[FD] Thycotic Password Manager Secret Server iOS Application - MITM SSL Certificate Vulnerability (David Coomber <davidcoomber.infosec@...il.com>)
[FD] RootedCON 2015 videos published (omarbv@...eup.net)
[FD] hwclock(8) SUID privilege escalation (up201407890@...nos.dcc.fc.up.pt)
[FD] [Onapsis Security Advisory 2015-007] SAP HANA Log Injection Vulnerability (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-006] SAP HANA Information Disclosure via SQL IMPORT FROM statement (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-006] SAP HANA Information Disclosure via SQL IMPORT FROM statement (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-007] SAP HANA Log Injection Vulnerability (Onapsis Research Labs <research@...psis.com>)

May 28 (2 messages)

[FD] New release: UFONet v0.5b "Invasion" (psy <epsylon@...eup.net>)
[FD] Sophos WAF (WebServer Protection) does not analyze JSON data (Glaudson Ocampos <glaudson@...uritylabs.com.br>)

May 29 (1 message)

[FD] Flash: Local SWF files can leak arbitrary local files to the internet (Jann Horn <jann@...jh.net>)

May 31 (10 messages)

[FD] Safari Address Spoofing (How We Got It) (David Leo <david.leo@...sen.co.uk>)
[FD] The Empire Strikes Back Apple how your Mac firmware security is completely broken ("fG" <fulldisclosure@....as>)
[FD] [SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices (Gergely Eberhardt <gergely.eberhardt@...rch-lab.hu>)
[FD] CVE-2015-3935 HTML Injection in Dolibarr ("NaxoneZ ." <naxonez@...il.com>)
[FD] More than 60 undisclosed vulnerabilities affect 22 SOHO routers (Jose Antonio Rodriguez Garcia <psycojugon@...il.com>)
[FD] Logical Flaw in Google's OAuth (vishnu raju <rajuvishnu52@...il.com>)
[FD] Broken, Abandoned, and Forgotten Code, Part 6 (Zach C <uid000@...il.com>)
[FD] XSS vulnerability in IBM Domino ("MustLive" <mustlive@...security.com.ua>)
[FD] XML Injection vulnerability in multiple Hikvision IP cameras and DVR ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] Safari Address Spoofing (How We Got It) (Michal Zalewski <lcamtuf@...edump.cx>)

135 messages