full-disclosure mailing list - 2015/06

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹	² 8	³ 1	⁴ 3	⁵ 3	⁶	⁷
⁸	⁹ 7	¹⁰ 7	¹¹ 10	¹² 1	¹³ 1	¹⁴ 2
¹⁵ 3	¹⁶	¹⁷ 2	¹⁸	¹⁹ 8	²⁰ 2	²¹ 2
²² 1	²³ 15	²⁴ 1	²⁵ 4	²⁶ 4	²⁷	²⁸ 1
²⁹ 18	³⁰ 8

Messages by day:

June 2 (8 messages)

[FD] [CFP] SOURCE Dublin, Sept 5-8, Trinity College (Genevieve Southwick <gksouthwick@...irrelherderproductions.com>)
[FD] Freebox OS Web interface 3.0.2 XSS, CSRF (DAU Huy Ngoc <huyngocbk@...il.com>)
[FD] Call for Papers for 3rd Balkan Computer Congress – BalCCon2k15 (Milos Krasojevic <milobit@...ons.org>)
[FD] t2'15: Call for Papers 2015 (Helsinki / Finland) ("Tomi Tuominen" <tomi.tuominen@...fi>)
[FD] WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] Safari Address Spoofing (How We Got It) (David Leo <david.leo@...sen.co.uk>)
Re: [FD] Safari Address Spoofing (How We Got It) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [FD] Safari Address Spoofing (How We Got It) (Jeffrey Walton <noloader@...il.com>)

June 3 (1 message)

[FD] [Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc) (Pedro Ribeiro <pedrib@...il.com>)

June 4 (3 messages)

[FD] [CVE-2015-1234] Tanium all versions arbitrary file overwrite (reek35@...l2tor.com)
[FD] [CVE-2015-4051]: Beckhoff IPC diagnostics < 1.8 : Authentication bypass (The Security Factory <release@...securityfactory.be>)
[FD] Broken, Abandoned, and Forgotten Code, Part 7 (Zach C <uid000@...il.com>)

June 5 (3 messages)

[FD] 1 Click Audio Converter v2.3.6 - Activex Buffer Overflow (Vulnerability Lab <research@...nerability-lab.com>)
[FD] 1 Click Audio Converter v2.3.6 - Activex Buffer Overflow (Vulnerability Lab <research@...nerability-lab.com>)
[FD] 1 Click Extract Audio v2.3.6 - Activex Buffer Overflow (Vulnerability Lab <research@...nerability-lab.com>)

June 9 (7 messages)

[FD] NEW VMSA-2015-0004 - VMware Workstation, Fusion and Horizon View Client updates address critical security issues (VMware Security Response Center <securi…)
[FD] [call for paper] SIGIR workshop: privacy-preserving information retrieval (Hongkai Wu <hw271@...rgetown.edu>)
Re: [FD] [CVE-2015-1234] Tanium all versions arbitrary file overwrite (Justin Burke <jburke@...ium.com>)
[FD] Xloner v3.1.2 wordpress plugin authenticated command execution and XSS ("Larry W. Cashdollar" <larry0@...com>)
[FD] [CVE-2015-4342]SQL Injection and Location header injection from cdef id ("xin.wang" <xin.wang@...ppsecurity.com.cn>)
[FD] Broken, Abandoned, and Forgotten Code, Intermission (Zach C <uid000@...il.com>)
[FD] Fwd: Potentially critical buffer overflow in TinySRP (Douglas Held <risk@...glasheld.net>)

June 10 (7 messages)

[FD] [RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session ID (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2015-004] Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] Heroku Bug Bounty #2 - (API) Re Auth Session Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] This POODLE Bites: Exploiting The SSL 3.0 Fallback (Bruno Luiz <brunolcr@...oo.com.br>)
[FD] Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
[FD] Authentication Bypass in Pandora FMS (Manuel Mancera <mmancera@...ecure.com>)
[FD] 2 vulns 1 line in RNCryptor (PHP) + Call to Action (Scott Arciszewski <scott@...agonie.com>)

June 11 (10 messages)

[FD] [KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2015-02] Concrete5 <= 5.7.3.1 Multiple Reflected Cross-Site Scripting Vulnerabilities (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] Apache vulnerability program faulting module ntdll.dll (Bruno Luiz <brunolcr@...oo.com.br>)
[FD] SAP Security Notes June 2015 (Darya Maenkova <d.maenkova@...scan.com>)
[FD] 6kbbs v8.0 Weak Encryption Cryptography Security Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] FC2 & Rakuten Online Websites Multiple XSS (Cross-site Scripting) and Open Redirect Cyber Vulnerabilities (Jing Wang <justqdjing@...il.com>)
[FD] Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 ("Larry W. Cashdollar" <larry0@...com>)
[FD] D-Link DSP-W110 - multiple vulnerabilities (Peter Adkins <peter.adkins@...nelpicnic.net>)
[FD] XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 ) (Stas Volfus <stasvolfus@...il.com>)

June 12 (1 message)

[FD] The token order of OpVectorTimesScalar and OpMatrixTimesScalar which generated in glslangValidator isn't consistant … (Aras Pranckevicius <aras@...ty3d.com>)

June 13 (1 message)

[FD] Yoast Wordpress SEO Plugin <= 2.1.1 Stored, Authenticated XSS ("sec@...entropy.us" <sec@...entropy.us>)

June 14 (2 messages)

[FD] OpenBSD "sys_execve()" Executable Header Parsing Denial of Service Vulnerability (Bruno Luiz <brunolcr@...oo.com.br>)
[FD] E-Detective Lawful Interception System - multiple security vulnerabilities (Mustafa Al-Bassam <mus@...albas.com>)

June 15 (3 messages)

[FD] [RT-SA-2015-002] SQL Injection in TYPO3 Extension Akronymmanager (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] Cross-Site Request Forgery Vulnerability in Users to CSV Wordpress Plugin v1.4.5 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
[FD] eBay Security Assessment (cosmin0maier@...il.com)

June 17 (2 messages)

Re: [FD] Announcing NorthSec 2015 - Montreal, May 21-24 (Pierre-d <ouaibe@...il.com>)
[FD] [CVE-2015-4553]Dedecms variable coverage leads to getshell (zise.shi <zise.shi@...ppsecurity.com.cn>)

June 19 (8 messages)

[FD] CVE-2015-4453 - Authentication bypass in OpenEMR (Brian Hysell <bdhysell@...il.com>)
[FD] SpiderOak.com - Disclousure of sensitive information (Cosmin Maier <cosmin0maier@...il.com>)
[FD] Broken, Abandoned, and Forgotten Code, Part 8 (Zach C <uid000@...il.com>)
[FD] ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Magento Bug Bounty #17 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Magento Bug Bounty #10 - Persistent Filename Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Magento Bug Bounty #12 - Cross Site Request Forgery Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

June 20 (2 messages)

[FD] IBM Domino Web Server Cross-site Scripting Vulnerability (CVE-2015-1981) ("MustLive" <mustlive@...security.com.ua>)
[FD] Cross-Site Request Forgery in Google Analyticator Wordpress Plugin v6.4.9.3 before rev @1183563 (Nitin Venkatesh <venkatesh.nitin@...il.com>)

June 21 (2 messages)

[FD] Tutanota Encrypted Email service - Malleable Ciphertext (AES-CBC with no MAC) (Scott Arciszewski <scott@...agonie.com>)
[FD] [Survey] Help shape the future of IDSs (Antonio Augusto Santos <aaugusto.santos@...il.com>)

June 22 (1 message)

[FD] ManageEngine Asset Explorer v6.1 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

June 23 (15 messages)

[FD] ERPSCAN Research Advisory [ERPSCAN-15-003] SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-004] SAP NetWeaver Portal XMLValidationComponent - XXE (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-005] SAP Mobile Platform - XXE (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-006] SAP NetWeaver Portal ReportXmlViewer - XXE (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-007] SAP Management Console ReadProfile Parameters - Information disclosure (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-008] SAP Afaria 7 XcListener - DoS in the module XeClient.Dll (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-009] SAP Afaria 7 XcListener - Missing authorization check (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-010] SYBASE SQL Anywhere 12 and 16 - DoS (Darya Maenkova <d.maenkova@...scan.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-011] SAP Mobile Platform 3.0 - XXE (Darya Maenkova <d.maenkova@...scan.com>)
[FD] CVE-2015-4413 - Wordpress “Nextend Facebook Connect” Cross Site Scripting (Liran Segal <lirans@...sec.com>)
[FD] CVE-2015-4557 - Wordpress “Nextend Twitter Connect” & “Nextend Google Connect” Cross Site Scripting (Liran Segal <lirans@...sec.com>)
[FD] New version: smalisca - Static Code Analysis tool for Smali files (Levon Kayan <noptrix@...lsecurity.net>)
[FD] Minds.com - Several Issues (Scott Arciszewski <scott@...agonie.com>)
[FD] XSS vulnerability in manage engine. (Suraj Krishnaswami <suraj.krishnaswami@...il.com>)
[FD] Haka v0.3.0 release (Mehdi Talbi <talbimehdi@...il.com>)

June 24 (1 message)

[FD] ROP 101 Blog (Craig Young <vuln-report@...ur3.us>)

June 25 (4 messages)

[FD] Securing SAP Systems from XSS vulnerabilities Part 2: Defense for SAP NetWeaver ABAP (Darya Maenkova <d.maenkova@...scan.com>)
[FD] CVE-2015-3443 XSS in Thycotic Secret Server version 8.6.000000 to 8.8.000004 (Marco Delai <Marco.Delai@...c.ch>)
[FD] Recomendation: Flaw in K9 Web Protection 4.4.268 (ICSS Security <ctrlaltdelete@...look.pt>)
[FD] SBA Research Vulnerability Disclosure - Multiple Critical Vulnerabilities in Koha ILS (Raschin Ghanad-Tavakoli <RGhanad-Tavakoli@...-research.org>)

June 26 (4 messages)

[FD] SEC Consult SA-20150626-0 :: Critical vulnerabilities in Polycom RealPresence Resource Manager (RPRM) allow survei… (SEC Consult Vulnerability Lab <research…)
[FD] Remote file download vulnerability in download-zip-attachments v1.0 ("Larry W. Cashdollar" <larry0@...com>)
[FD] Arbitrary File download in wordpress plugin wp-instance-rename v1.0 ("Larry W. Cashdollar" <larry0@...com>)
[FD] Response to Decision Group press release about security vulnerabilities in E-Detective Lawful Interception System (Mustafa Al-Bassam <mus@...albas.com>)

June 28 (1 message)

Re: [FD] Response to Decision Group press release about security vulnerabilities in E-Detective Lawful Interception System (Luke Walker <luke@...ckduck.nu>)

June 29 (18 messages)

[FD] WedgeOS Multiple Vulnerabilities (Daniel Jensen <daniel.jensen@...urity-assessment.com>)
[FD] Watchguard XCS Multiple Vulnerabilities (Daniel Jensen <daniel.jensen@...urity-assessment.com>)
[FD] Courier mail server: Write heap overflow in mailbot tool and out of bounds heap read in imap folder parser (Hanno Böck <hanno@...eck.de>)
[FD] CollabNet Subversion Edge Hook Script Privilege Escalation (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge Password Hash Leak (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge downloadHook local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge show local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge tail local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge insecure password change (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge missing brute force protection (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge autocomplete on (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge missing clickjacking protection (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge weak password policy (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge missing XSRF protection (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge weak password storage mechanism (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge missing single login restriction (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] CollabNet Subversion Edge index local file inclusion (Oliver-Tobias Ripka <otr@...kcay.de>)
[FD] XXE Injection in NetIQ Access ("MustLive" <mustlive@...security.com.ua>)

June 30 (8 messages)

[FD] ManageEngine Password Manager Pro 8.1 SQL Injection vulnerability (Blazej Adamczyk <blazej.adamczyk@...il.com>)
[FD] CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP (Fernando Muñoz <fernando@...l-life.com>)
[FD] Siemens, Climatix BACnet/IP communication module, Vulnerabilities (Fran <jfrancisco.bolivar@...il.com>)
[FD] Broken, Abandoned, and Forgotten Code, Part 9 (Zach C <uid000@...il.com>)
[FD] Google Chrome Address Spoofing (Request For Comment) (David Leo <david.leo@...sen.co.uk>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Big Whale <d0lph1n98@...oo.com>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Roney Gomes <roney477@...il.com>)
[FD] DAVOSET v.1.2.5 ("MustLive" <mustlive@...security.com.ua>)

112 messages

Powered by blists - more mailing lists