full-disclosure mailing list - 2015/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 4	² 9	³ 8	⁴ 4	⁵ 3
⁶ 6	⁷ 6	⁸ 1	⁹	¹⁰ 14	¹¹ 2	¹²
¹³ 13	¹⁴ 5	¹⁵	¹⁶ 11	¹⁷ 9	¹⁸ 3	¹⁹ 1
²⁰ 1	²¹ 5	²² 4	²³ 2	²⁴	²⁵ 5	²⁶
²⁷ 3	²⁸ 5	²⁹	³⁰ 2	³¹

Messages by day:

July 1 (4 messages)

[FD] Pinterest Bug Bounty #1 - Persistent contact_name Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Magento Bug Bounty #14 - Persistent Description Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FCS Scanner v1.0 & v1.4 iOS - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Blueberry Express v5.9.x - SEH Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 2 (9 messages)

Re: [FD] Google Chrome Address Spoofing (Request For Comment) (David Leo <david.leo@...sen.co.uk>)
[FD] Exploit Code for ipTIME firmwares < 9.58 (root RCE against 127 router models) (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] iTunes 12.2 and QuickTime 7.7.7 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED an… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) ("Mike K Gorski" <mike@...ski.com>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Valentinas Bakaitis <v.bakaitis@...il.com>)
[FD] CVE-2015-3442 Authentication Bypass in Xpert.Line Version 3.0 (Alessandro Zala <Alessandro.Zala@...c.ch>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Big Whale <d0lph1n98@...oo.com>)
[FD] Microsoft Office - OLE Packager allows code execution in all Office versions, with macros disabled and high securi… (Kevin Beaumont <kevin.beaumont@...il.co…)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Mustafa Al-Bassam <mus@...albas.com>)

July 3 (8 messages)

Re: [FD] [oss-security] Re: Google Chrome Address Spoofing (Request For Comment) (anidear <anidear1@...il.com>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Daniel Wood <daniel.wood@...sp.org>)
[FD] Snorby 2.6.2 - Stored Cross-site Scripting Vulnerability (Federico Fazzi <federico.fazzi@...il.com>)
Re: [FD] Microsoft Office - OLE Packager allows code execution in all Office versions, with macros disabled and high s… (Kevin Beaumont <kevin.beaumont@...il.co…)
[FD] SQL Injection in easy2map wordpress plugin v1.24 ("Larry W. Cashdollar" <larry0@...com>)
Re: [FD] [##2255763##] ManageEngine Password Manager Pro 8.1 SQL Injection vulnerability (Password Manager Pro Support <passwordmanagerpro-support@...ageengin…)
[FD] ipTIME n104r3 vulnerable to CSRF and XSS attacks (Pierre Kim <pierre.kim.sec@...il.com>)
Re: [FD] Microsoft Office - OLE Packager allows code execution in all Office versions, with macros disabled and high s… ("Stefan Kanthak" <stefan.kanthak@...go.…)

July 4 (4 messages)

Re: [FD] Microsoft Office - OLE Packager allows code execution in all Office versions, with macros disabled and high s… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] WK UDID v1.0.1 iOS - Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Inc Magento Bug Bounty #16 - CSRF Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Google HTTP Live Headers v1.0.6 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 5 (3 messages)

Re: [FD] Google HTTP Live Headers v1.0.6 - Client Side Cross Site Scripting Web Vulnerability (Gynvael Coldwind <gynvael@...dwind.pl>)
[FD] Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass ("MustLive" <mustlive@...security.com.ua>)
[FD] Open redirect vulnerability in StageShow Wordpress plugin v5.0.8 (Nitin Venkatesh <venkatesh.nitin@...il.com>)

July 6 (6 messages)

[FD] 127 ipTIME router models vulnerable to an unauthenticated RCE by sending a crafted DHCP request (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] [CORE-2015-0012] - AirLive Multiple Products OS Command Injection (CORE Advisories Team <advisories@...esecurity.com>)
[FD] WideImage Demo Code Cross Site Scripting (XSS) (47 <a_47@...oud.com>)
[FD] Auditing folders ACLs with Powershell (Darío B <darizotas@...il.com>)
[FD] Orchard CMS - Persistent XSS vulnerability (Paris Zoumpouloglou <pariszoump@...il.com>)
[FD] WideImage Demo Code Cross Site Scripting (XSS) (<sikkandar.lynx@...il.com>)

July 7 (6 messages)

[FD] Grandstream VoIP phone: SSH key backdoor and multiple vulnerabilities leading to RCE as root (David Jorm <david.jorm@...il.com>)
[FD] Google Chrome Address Spoofing - Google's Opinion (David Leo <david.leo@...sen.co.uk>)
[FD] Fake links in Skype (Jaanus <jaanus.kaap@...il.com>)
[FD] Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 ("Larry W. Cashdollar" <larry0@...com>)
[FD] Remote file download in Wordpress Plugin mdc-youtube-downloader v2.1.0 ("Larry W. Cashdollar" <larry0@...com>)
[FD] [CFP] Hackito Ergo Sum 2015 (tAd <tadml@...0.org>)

July 8 (1 message)

[FD] [CORE-2015-0011] - AirLink101 SkyIPCam1620W OS Command Injection (CORE Advisories Team <advisories@...esecurity.com>)

July 10 (14 messages)

[FD] NEW VMSA-2015-0005 : VMware Workstation, Player and Horizon View Client for Windows updates address a host privil… (VMware Security Response Center <securi…)
[FD] CVE-2015-1438 – Panda Security Multiple Products Arbitrary Code Execution (Kyriakos Economou <arfproject@...mail.com>)
[FD] J2Store 3.1.6 unauthenticated SQL injections (Brandon Perry <bperry.volatile@...il.com>)
[FD] SOPlanning - Simple Online Planning Tool multiple vulnerabilities ("Dau, Huy-Ngoc (FR - Paris)" <HDau@...oitte.fr>)
[FD] Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution ("Dau, Huy-Ngoc (FR - Paris)" <HDau@...oitte.fr>)
Re: [FD] Fake links in Skype (Joshua Rogers <honey@...ernot.info>)
[FD] CVE-2014-7952, Android ADB backup APK injection vulnerability (Imre RAD <imre.rad@...rch-lab.hu>)
[FD] Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 ("Larry W. Cashdollar" <larry0@...com>)
[FD] SQL Injection in easy2map-photos wordpress plugin v1.09 ("Larry W. Cashdollar" <larry0@...com>)
[FD] CFP: Passwords 2015, Dec 7-9, Cambridge, UK (Per Thorsheim <per@...rsheim.net>)
[FD] Local File Include vulnerability in GD bbPress Attachments allows attackers to include arbitrary PHP files (WordPress plug… (dxw Security <security@....com>)
[FD] Reflected XSS in GD bbPress Attachments allows an attacker to do almost anything an admin can (WordPress plugin) (dxw Security <security@....com>)
[FD] Cross-Site Request Forgery, Cross-Site Scripting and SQL Injection in CP Contact Form with Paypal Wordpress Plugi… (Nitin Venkatesh <venkatesh.nitin@...il.…)
[FD] Western Digital Arkeia "ARKFS_EXEC_CMD" <= v11.0.12 Remote Code Execution (xistence <xistence@...0.nl>)

July 11 (2 messages)

[FD] Broken, Abandoned, and Forgotten Code, Part 10 (Zach C <uid000@...il.com>)
Re: [FD] Grandstream VoIP phone: SSH key backdoor and multiple vulnerabilities leading to RCE as root (David Jorm (Seamus Caveney <Seamus@...ivesolutionsmi.com…)

July 13 (13 messages)

[FD] CVE-2015-4425 - Directory Traversal/Configuration Update In Pimcore CMS (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2015-4426 - SQL Injection In Pimcore CMS (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2015-3621 - Privilege Escalation In SAP ECC (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2015-3449 - Weak File Permissions In SAP Afaria XeService.exe (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] CVE-2015-1438 - Arbitrary Code Execution [PSKMAD.sys] In Panda Security - Multiple Products (Portcullis Advisories <advisories@...tcullis-security.com>)
[FD] Vulnerability in Apache Tomcat (Juan Martinez <gus70938@...il.com>)
[FD] [CVE-2015-2862/2863 / CERT VU#919604] Kaseya VSA arbitrary file download / open redirect (Pedro Ribeiro <pedrib@...il.com>)
[FD] Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 ("Larry W. Cashdollar" <larry0@...com>)
[FD] Remote file download vulnerability in Wordpress Plugin image-export v1.1 ("Larry W. Cashdollar" <larry0@...com>)
[FD] Reflected XSS Attacks vulnerabilities in PFSense Version 2.2.2 (CVE-2015-4029) (William Costa <william.costa@...il.com>)
[FD] Reflected XSS in The Events Calendar: Eventbrite Tickets allows unauthenticated users to do almost anything an admin can … (dxw Security <security@....com>)
[FD] Stored XSS in Plotly allows less privileged users to insert arbitrary JavaScript into posts (WordPress plugin) (dxw Security <security@....com>)
Re: [FD] Grandstream VoIP phone: SSH key backdoor and multiple vulnerabilities leading to RCE as root (David Jorm (Jeffrey Walton <noloader@...il.com>)

July 14 (5 messages)

Re: [FD] Vulnerability in Apache Tomcat (Mark Thomas <markt@...che.org>)
[FD] Admin-only local file inclusion and arbitrary code execution in Subscribe to Comments 2.1.2 (WordPress plugin) (dxw Security <security@....com>)
[FD] CSRF and arbitrary file deletion in BuddyPress Activity Plus 1.5 (WordPress plugin) (dxw Security <security@....com>)
[FD] Arbitrary File Download in WP Attachment Export Wordpress Plugin v0.2.3 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
Re: [FD] Vulnerability in Apache Tomcat (ZhangTianqi <pnigos@...e.com>)

July 16 (11 messages)

[FD] Capstone disassembly engine 3.0.4 is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] SAP Security Notes July 2015 (Darya Maenkova <d.maenkova@...scan.com>)
[FD] 15 TOTOLINK router models vulnerable to multiple RCEs (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] 4 TOTOLINK router models vulnerable to CSRF and XSS attacks (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Backdoor credentials found in 4 TOTOLINK router models (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Backdoor and RCE found in 8 TOTOLINK router models (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] SEC Consult SA-20150716-0 :: Permanent Cross-Site Scripting in Oracle Application Express (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] New CVE's to be released the 17th of June. (Kasper Westphal Bertelsen <kb@...post24.com>)
Re: [FD] 15 TOTOLINK router models vulnerable to multiple RCEs (Joshua Wright <jwright@...borg.com>)
[FD] double free's in glibc (and tcmalloc/jemalloc) (PIN <zero@...c.co>)
[FD] Broken, Abandoned, and Forgotten Code, Part 11 (Zach C <uid000@...il.com>)

July 17 (9 messages)

[FD] UDID+ v2.5 iOS - Mail Command Inject Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FoxyCart Bug Bounty #1 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] AirDroid ID - Client Side JSONP Callback Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] 1503A - Chrome - ui::AXTree::Unserialize use-after-free (Berend-Jan Wever <berendjanwever@...il.com>)
[FD] UDID+ v2.5 iOS - Mail Command Inject Vulnerability (Douglas Held <dougheld@...il.com>)
[FD] Remote file upload vulnerability in mailcwp v1.99 wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: [FD] Remote file upload vulnerability in mailcwp v1.99 wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
[FD] OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) (king cope <isowarez.isowarez.isowarez@...glemail.com>)
[FD] weblogin software cross site request (Juan Martinez <gus70938@...il.com>)

July 18 (3 messages)

Re: [FD] OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) (devel@...soft.ltd.uk)
Re: [FD] weblogin software cross site request (jericho <jericho@...rition.org>)
[FD] Information Exposure Vulnerability in WordPress Mobile Pack Wordpress Plugin v2.1.2 and below (Nitin Venkatesh <venkatesh.nitin@...il.com>)

July 19 (1 message)

Re: [FD] OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) (Reed Loden <reed@...dloden.com>)

July 20 (1 message)

[FD] Airdroid iOS, Android & Win 3.1.3 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 21 (5 messages)

[FD] Ashley Madison Hacked (Brian Offenheim <brian.offenheim@...look.com>)
Re: [FD] OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) (Dirk-Willem van Gulik <dirkx@...weaving.org>)
[FD] Joomla! plugin Helpdesk Pro < 1.4.0 (Simon Rawet <sr@...post24.com>)
[FD] CVE Request -Post Authentication SQLi Vulnerability fixed in Cacti ("Shi,Tong" <shitong@...du.com>)
[FD] Cross-Site Request Forgery Vulnerability in Portfolio Plugin Wordpress Plugin v1.0 (Nitin Venkatesh <venkatesh.nitin@...il.com>)

July 22 (4 messages)

[FD] RainbowCrack Plugin for Oracle hashes (<=10g) (bob secse <bob.security.fr@...il.com>)
[FD] Why Full Disclosure is the solution ? An example with RIPE (Pierre Kim <pierre.kim.sec@...il.com>)
Re: [FD] CVE Request -Post Authentication SQLi Vulnerability fixed in Cacti (Henri Salo <henri@...v.fi>)
Re: [FD] Ashley Madison Hacked (Dave Horsfall <dave@...sfall.org>)

July 23 (2 messages)

[FD] ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Qualys Security Advisory <qsa@...lys.com>)

July 25 (5 messages)

[FD] Integer overflow in .NET Framework System.DirectoryServices.Protocols.Utility class ("Securify B.V." <lists@...urify.nl>)
[FD] CVE Requested: Reflected Cross-Site Scripting (XSS) in QNAP TS-x09 Turbo NAS (Mark Cross <mark@...ozobo.com>)
[FD] Open Redirect Vulnerability in Music Store Wordpress Plugin v1.0.14 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
[FD] Cross-Site Request Forgery & SQL Injection Vulnerabilities in Unite Gallery Lite Wordpress Plugin v1.4.6 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
[FD] CVE Requested: Reflected Cross-Site Scripting (XSS) in QNAP TS-x09 Turbo NAS (Mark Cross <mark@...ozobo.com>)

July 27 (3 messages)

Re: [FD] 127 ipTIME router models vulnerable to an unauthenticated RCE by sending a crafted DHCP request (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Multiple critical security vulnerabilities (including a backdoor!) in PHP File Manager ("Sijmen Ruwhof" <sijmen@...undity.com>)
[FD] Apple iTunes & AppStore - Filter Bypass & Persistent Invoice Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 28 (5 messages)

[FD] Another Snorby 2.6.2 - Stored Cross-site Scripting Vulnerability (Federico Fazzi <federico.fazzi@...il.com>)
[FD] Multiple unresolved vulnerabilities in Basware Banking/Maksuliikenne (Samuel Lavitt - CVE-2015-0942 <CVE-2015-0942@...cipice.fi>)
[FD] SEC Consult SA-20150728-0 :: McAfee Application Control Multiple Vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] CSRF and XSS vulnerabilities in D-Link DCS-2103 ("MustLive" <mustlive@...security.com.ua>)
[FD] Reflected XSS in Flickr Justified Gallery could allows unauthenticated attackers to do almost anything an admin can do (W… (dxw Security <security@....com>)

July 30 (2 messages)

[FD] Assessing The Computer Network Operation (CNO) Capabilities of the Islamic Republic of Iran - Report (Dancho Danchev <dancho.danchev@...il.com>)
[FD] Fwd: CVE_for_Vulnerability_theholidaycalendar (Luciano Pedreira <lpedreira@...il.com>)

126 messages

Powered by blists - more mailing lists