full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 4	² 1
³ 2	⁴	⁵ 4	⁶ 2	⁷ 8	⁸ 1	⁹
¹⁰ 1	¹¹	¹² 22	¹³ 11	¹⁴ 2	¹⁵	¹⁶ 1
¹⁷ 3	¹⁸ 7	¹⁹	²⁰ 6	²¹	²²	²³
²⁴ 5	²⁵	²⁶	²⁷	²⁸ 8	²⁹	³⁰ 1
³¹ 2

Messages by day:

August 1 (4 messages)

[FD] PhotoPost PHP 4.8c Cookie Based Stored XSS (Cross-site Scripting) Web Application 0-Day Bug (Jing Wang <justqdjing@...il.com>)
[FD] Symantec Endpoint Protection (Markus Wulftange <markus.wulftange@...e-white.com>)
Re: [FD] Symantec Endpoint Protection (Brandon Perry <bperry.volatile@...il.com>)
[FD] Vulnerability in VirtueMart for Joomla ("MustLive" <mustlive@...security.com.ua>)

August 2 (1 message)

[FD] CODEBLUE.JP - Security Conference in Tokyo Calling for Papers by Sep.10 (Kana Shinoda <kana@...eblue.jp>)

August 3 (2 messages)

[FD] New BlackArch Linux ISOs (version 2015.07.31) (Black Arch <blackarchlinux@...il.com>)
Re: [FD] Symantec Endpoint Protection (Markus Wulftange <markus.wulftange@...e-white.com>)

August 5 (4 messages)

[FD] Mozilla extensions: a security nightmare ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] SEC Consult SA-20150805-0 :: Websense Content Gateway Stack Buffer Overflow in handle_debug_network (SEC Consult Vulnerability Lab <research@...-consult.c…)
Re: [FD] Mozilla extensions: a security nightmare (Mario Vilas <mvilas@...il.com>)
[FD] Comment form CSRF in WordPress 4.2.2 allows admin impersonation via comments (dxw Security <security@....com>)

August 6 (2 messages)

[FD] Security Advisory - "Cross-VM ASL INtrospection (CAIN)" (antonio <antonio@...resi.net>)
[FD] Vulnerable MSVC++ runtime distributed with LibreOffice 5.0.0 for Windows ("Stefan Kanthak" <stefan.kanthak@...go.de>)

August 7 (8 messages)

Re: [FD] Security Advisory - "Cross-VM ASL INtrospection (CAIN)" (Артур Истомин <art.istom@...dex.ru>)
[FD] SCADA with antenna (SCADA StrangeLove <scadastrangelove@...il.com>)
[FD] Ferrari - PHP CGI Argument Injection (RCE) Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Device Inspector v1.5 iOS - Command Inject Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Use After Free Vulnerability in unserialize() with SPL ArrayObject (Taoguang Chen <taoguangchen@...il.com>)
[FD] Use After Free Vulnerability in unserialize() with SplDoublyLinkedList (Taoguang Chen <taoguangchen@...il.com>)
[FD] Use After Free Vulnerability in unserialize() with SplObjectStorage (Taoguang Chen <taoguangchen@...il.com>)
Re: [FD] Mozilla extensions: a security nightmare (Dave Horsfall <dave@...sfall.org>)

August 8 (1 message)

[FD] Pineapple autopwn script 2.3.0 or lower versions. (Electric Mind <mailto@...security.su>)

August 10 (1 message)

[FD] T Mobile Business - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 12 (22 messages)

[FD] CVE-2015-5699 - Cumulus Linux's Switch Configuration Tools Backend, clcmd_server, Vulnerable to Local Privilege Esc… (Gregory Pickett <gpickett71@...oo.com>)
[FD] Thomson Reuters FATCA - Local File Inclusion (Etnies <kuba25101990@...il.com>)
[FD] Thomson Reuters FATCA - Arbitrary File Upload (Etnies <kuba25101990@...il.com>)
[FD] php 7 use after free bug ("牛保龙" <niubl@...wnsec.com>)
Re: [FD] Mozilla extensions: a security nightmare ("Thomas D." <whistl0r@...il.com>)
[FD] BigTree CMS 4.2.3 Multiple Cross-Site-Scripting Vulnerabilities (Curesec Research Team <crt@...esec.com>)
[FD] BigTree CMS 4.2.3 Multiple Sql Injections (Curesec Research Team <crt@...esec.com>)
[FD] CodoForum 3.3.1 Multiple Cross Site Scriptings (Curesec Research Team <crt@...esec.com>)
[FD] CodoForum 3.3.1 Multiple SQL Injections (Curesec Research Team <crt@...esec.com>)
[FD] Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack other users (WordPress plugin) (dxw Security <security@....com>)
[FD] Blind SQL Injection in WP Symposium allows unauthenticated attackers to access sensitive data (WordPress plugin) (dxw Security <security@....com>)
[FD] Reflected XSS in iframe allows unauthenticated users to do almost anything an admin can (WordPress plugin) (dxw Security <security@....com>)
[FD] Stored XSS in iframe allows less privileged users to do almost anything an admin can (WordPress plugin) (dxw Security <security@....com>)
[FD] bizidea Design CMS 2015Q3 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [Onapsis Security Advisory 2015-011] SAP Mobile Platform DataVault Predictable encryption passwords for Configurat… (Onapsis Research Labs <research@...psis…)
[FD] [Onapsis Security Advisory 2015-010] SAP Mobile Platform DataVault Keystream Recovery (Onapsis Research Labs <research@...psis.com>)
[FD] [Onapsis Security Advisory 2015-012] SAP Mobile Platform DataVault Predictable Encryption Password for Secure Stor… (Onapsis Research Labs <research@...psis…)
[FD] Open source tool for applying Google Chrome security updates (David Leo <david.leo@...sen.co.uk>)
[FD] BFS-SA-2015-001: Internet Explorer CTreeNode::GetCascadedLang Use-After-Free Vulnerability (Blue Frost Security Research Lab <research@...efrostsecurity.d…)
Re: [FD] Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack other users (WordPress plugin) (dxw Security <security@....com>)
[FD] The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically secure (Word… (dxw Security <security@....com>)
Re: [FD] The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically s… (Scott Arciszewski <scott@...iszewski.me…)

August 13 (11 messages)

[FD] Update: Backdoor and RCE found in 8 TOTOLINK router models (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Zend Framework <= 2.4.2 XML eXternal Entity Injection (XXE) on PHP FPM (Dawid Golunski <golunski.dawid@...il.com>)
[FD] Cisco Unified Communications Manager Multiple Vulnerabilities (VP2015-001) (Vantage Point Security <lists@...tagepoint.sg>)
[FD] SAP Security Notes August 2015 (ERPScan inc <erpscan.online@...il.com>)
[FD] NetRipper - Smart traffic sniffing for penetration testers (Poyo VL <poyo_vl@...oo.com>)
[FD] APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-08-13-3 iOS 8.4.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-08-13-4 OS X Server v4.1.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] BFS-SA-2015-002: OpenSSH PAM Privilege Separation Vulnerabilities (Blue Frost Security Research Lab <research@...efrostsecurity.de>)
[FD] [CVE-2015-5617]Enorth Webpublisher CMS SQL Injection from delete_pending_news.jsp cbNewsid (xin.wang <xin.wang@...ppsecurity.com.cn>)

August 14 (2 messages)

[FD] ERPSCAN Research Advisory [ERPSCAN-15-012] SAP Afaria 7 XComms – Buffer Overflow (ERPScan inc <erpscan.online@...il.com>)
[FD] Sandbox bypass through Google Admin WebView (Vahagn Vardanyan <vvvaagn@...il.com>)

August 16 (1 message)

[FD] vBulletin x.x.x rce "0day" (Joshua Rogers <honey@...ernot.info>)

August 17 (3 messages)

[FD] Oracle CSO numbers, security hygiene and fixes at the same time (Security Explorations <contact@...urity-explorations.com>)
[FD] Insufficient certificate validation in EMC Secure Remote Services Virtual Edition ("Securify B.V." <lists@...urify.nl>)
[FD] Weak authentication in EMC Secure Remote Services Virtual Edition Web Portal ("Securify B.V." <lists@...urify.nl>)

August 18 (7 messages)

[FD] [ERPSCAN-15-013] SAP NetWeaver AS Java CIM UPLOAD – XXE (ERPScan inc <erpscan.online@...il.com>)
Re: [FD] The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically secure (… (dxw Security <security@....com>)
[FD] Severe weakness in checkout provider Borderfree allows users to easily control the prices they pay on ecommerce websites (John Smith <yiyozif@...il.com>)
[FD] Phorum 5.2.19 - Reflected XSS and Open Redirect ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Bolt 2.2.4 - Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] ModX Revolution 2.3.5 - Reflected XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] UNIT4TETA TETA WEB - Authorization Bypass vulnerability (Lukasz Miedzinski <lukasz.miedzinski@...il.com>)

August 20 (6 messages)

[FD] Microsoft HTA (HTML Application) - Remote Code Execution Vulnerability (MS14-064) (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PDF Shaper v3.5 - (MSF) Remote Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ChiefPDF Software v2.x - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WebSolutions India Design CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] UBNT Bug Bounty #1 - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] UBNT Bug Bounty #3 - Persistent Filename Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 24 (5 messages)

Re: [FD] ModX Revolution 2.3.5 - Reflected XSS - Fixed Versions Released ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] UNIT4TETA TETA WEB - Session Fixation (Lukasz Miedzinski <lukasz.miedzinski@...il.com>)
[FD] Blind boolean SQL injection vulnerability in ResourceSpace CMS (William Reyor <opticfiber@...il.com>)
Re: [FD] CORE-2009-01515 - WordPress Privileges Unchecked in admin.php and Multiple Information (paul.szabo@...ney.edu.au)
[FD] Google Analyticator Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-6328 (Onur Yilmaz <onur@...sparker.com>)

August 28 (8 messages)

[FD] nullcon se7en CFP is open (nullcon <nullcon@...lcon.net>)
[FD] AnchorCMS - PHP Object Injection (CVE-2015-5687) and More (Scott Arciszewski <scott@...agonie.com>)
[FD] CSRF/XSS vulnerability in Private Only could allow an attacker to do almost anything an admin user can (WordPress plugin) (dxw Security <security@....com>)
[FD] Publicly exploitable XSS in WordPress plugin Navis Documentcloud (WordPress plugin) (dxw Security <security@....com>)
[FD] Dogma India dogmaindia CMS - Auth Bypass Session Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] LinuxOptic CMS 2009 - Auth Bypass Session Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Bug Bounty #119 - Stored Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Photo Transfer (2) v1.0 iOS - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 30 (1 message)

Re: [FD] AnchorCMS - PHP Object Injection (CVE-2015-5687) and More (Scott Arciszewski <scott@...agonie.com>)

August 31 (2 messages)

[FD] KnowledgeTree OSS 3.0.3b Reflected XSS (Cross-site Scripting) Web Application 0-Day Security Bug (Jing Wang <justqdjing@...il.com>)
[FD] Winmail Server 4.2 Reflected XSS (Cross-site Scripting) Web Application 0-Day Security Bug (Jing Wang <justqdjing@...il.com>)

91 messages