full-disclosure mailing list - 2015/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹	² 11	³	⁴
⁵ 18	⁶	⁷	⁸ 17	⁹ 4	¹⁰ 4	¹¹
¹²	¹³	¹⁴ 11	¹⁵ 10	¹⁶ 1	¹⁷ 3	¹⁸
¹⁹ 4	²⁰	²¹ 11	²² 1	²³	²⁴	²⁵
²⁶	²⁷ 8	²⁸	²⁹ 2	³⁰ 10	³¹

Messages by day:

October 2 (11 messages)

[FD] Tool: Race condition chaser on windows (Alexander Georgiev <alexander.georgiev@...oo.de>)
[FD] CVE-2015-2342 VMware vCenter Remote Code Execution (David Stubley <david.stubley@...ements.co.uk>)
[FD] Telegram - Multiple Vulnerabilities (Eduardo Alves <edudx1@...il.com>)
Re: [FD] WinRAR SFX v5.21 - Remote Code Execution Vulnerability (Gynvael Coldwind <gynvael@...dwind.pl>)
[FD] Shell Injection in Pygments FontManager._get_nix_font_path (Javantea <jvoss@...sci.com>)
[FD] Vulnerabilities in Callisto 821+R3 ADSL Router ("MustLive" <mustlive@...security.com.ua>)
[FD] Mac OS X local root (rsh/libmalloc) (Philip Pettersson <philip.pettersson@...il.com>)
[FD] APPLE-SA-2015-09-30-01 iOS 9.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-09-30-2 Safari 9 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-09-30-3 OS X El Capitan 10.11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] WinRar Expired Notification - OLE Remote Command Execution (<rio.sherri@...ogen.al>)

October 5 (18 messages)

[FD] Komento Joomla! component Persistent XSS (David Sopas <davidsopas@...il.com>)
[FD] Charter Spectrum Business HTTP MITM (Mark Felder <feld@...d.me>)
[FD] Sicherheitslücke - Liferay Portal Enterprise Edition (Tim Schughart <info@...sec-networks.com>)
[FD] ManageEngine ServiceDesk Plus <= 9.1 build 9110 - Path Traversal (xistence <xistence@...0.nl>)
[FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome (Haifei Li <haifei-non-reply@...look.com>)
[FD] Qualys Security Advisory - OpenSMTPD Audit Report (Qualys Security Advisory <qsa@...lys.com>)
[FD] CVE-2015-6237 - Tripwire IP360 VnE Remote Administrative API Authentication Bypass/Privilege Acquisition Vulnerability (Specto <specto@...todela.com>)
Re: [FD] Telegram - Multiple Vulnerabilities (Uni Sec <unisecure@...look.com>)
[FD] Apple Safari URI spoofing (CVE-2015-5764) (Antonio Sanso <asanso@...be.com>)
[FD] WinRar Settings Import Command Execution (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] Persistent XSS - Liferay Portal Enterprise Edition (Tim Schughart <t.schughart@...sec-networks.com>)
Re: [FD] WinRAR SFX v5.21 - Remote Code Execution Vulnerability (Hernan Moller <hernan@...el4.com>)
[FD] Blind SQL Injection in admin panel PHP-Fusion <= v7.02.07 (Manuel Garcia Cardenas <advidsec@...il.com>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome (Lee <curtlee2002@...il.com>)
[FD] u-design wordpress theme DOM XSS (Kenan Gms <gmskenan@...il.com>)
[FD] DDos Attack To Drop The Internet (Jeffrey Roberts <jeffrey.l.roberts@...il.com>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] WinRAR SFX v5.21 - Remote Code Execution Vulnerability ("Stefan Kanthak" <stefan.kanthak@...go.de>)

October 8 (17 messages)

[FD] Authentication Bypass in Netgear Router Firmware N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img (Alexandre Herzog <Alexandre.Herzog@...c.ch>)
Re: [FD] Authentication Bypass in Netgear Router Firmware N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img (Joe G <joseph.giron13@...il.com>)
Re: [FD] Authentication Bypass in Netgear Router Firmware N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img (Alexandre Herzog <Alexandre.Herzog@...c.ch>)
[FD] [REVIVE-SA-2015-001] Revive Adserver - Multiple vulnerabilities (Matteo Beccati <matteo@...cati.com>)
[FD] CSRF vulnerabilities in Callisto 821+R3 ADSL Router ("MustLive" <mustlive@...security.com.ua>)
[FD] TestLink Security Advisory - SQL Injection Vulnerability - CVE-2015-7390 (Onur Yilmaz <onur@...sparker.com>)
[FD] TestLink Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-7391 (Onur Yilmaz <onur@...sparker.com>)
[FD] CVE-2015-2652 – Unauthenticated File Upload in Oracle E-business Suite. (Sandeep Kamble <sandeep@...urelayer7.net>)
[FD] Drupal 8.0.0-beta14 Vendor Script Vulnerable to XSS (Sandeep Kamble <sandeep@...urelayer7.net>)
Re: [FD] WinRAR SFX v5.21 - Remote Code Execution Vulnerability (Shawn McMahon <syberghost@...il.com>)
[FD] A comprehensive study of Huawei 3G routers - XSS, CSRF, DoS, unauthenticated firmware update, RCE (Pierre Kim <pierre.kim.sec@...il.com>)
Re: [FD] DDos Attack To Drop The Internet (Phil Ashby <Phil.Ashby@...plc.com>)
Re: [FD] DDos Attack To Drop The Internet (James Hodgkinson <yaleman@...etek.net>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] [RT-SA-2015-006] Buffalo LinkStation Authentication Bypass (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] Veeam Backup & Replication Local Privilege Escalation Vulnerability (ascii <ascii@....it>)
[FD] Broken, Abandoned, and Forgotten Code, Part 13 (Zach C <uid000@...il.com>)

October 9 (4 messages)

[FD] WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Bug Bounty #119 - URL Redirect Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] W150D Wireless N 150 ADSL2 Modem Router - Cross Site Request Forgery Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FreeYouTubeToMP3 Converter 4.0.1 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

October 10 (4 messages)

[FD] Exploit NetUSB CVE-2015-3036 (Adrián Ruiz <adrian@...ianruiz.net>)
[FD] DirectAdmin (1.44.3) CSRF Vulnerability (Necmettin COŞKUN <h@...r.io>)
[FD] Writing Cisco IOS Rootkits (Luca <luca@...d32.com>)
Re: [FD] WinRAR SFX v5.21 - Remote Code Execution Vulnerability ("Stefan Kanthak" <stefan.kanthak@...go.de>)

October 14 (11 messages)

[FD] JScript 5.7 (MSIE 8) RegExpBase::FBadHeader regular expression use-after-free (Berend-Jan Wever <berendjanwever@...il.com>)
[FD] Buffer overflow in tiny-AES128-C (Pascal Cuoq <cuoq@...st-in-soft.com>)
[FD] Vantage Point Security Advisory 2015-003 (Lyon Yang <lists@...tagepoint.sg>)
[FD] Vantage Point Security Advisory 2015-002 (Lyon Yang <lists@...tagepoint.sg>)
[FD] IntelliSec Advisory - Multiple Vulnerabilities in Kerio Control Firewall (research@...ellisec.at)
[FD] Full Path Disclosure vulnerability in JM Twitter Cards reveals the location of the WordPress installation on the server (… (dxw Security <security@....com>)
[FD] Mozilla extensions: a security nightmare (part 2) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome (<lists@...ossecurity.com>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome (Lee <curtlee2002@...il.com>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome (Curtis Lee Bolin <CurtisLeeBolin@...il.com>)

October 15 (10 messages)

[FD] PayPal Inc Bug Bounty #117 - Session Fixation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Freemake Video Downloader 3.7.1 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Unicorn CPU Emulator Framework is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] hackercon berlin: hack4 the year is 2015 (dash <dash@...k4.org>)
[FD] netis RealTek wireless router / ADSL modem Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] PROLiNK H5004NK ADSL Wireless Modem Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] UISGCON11 CFP (Andrey Loginov <login@...ezhasecurity.com>)
[FD] CakePHP Xml class SSRF Vulnerability (Takeshi Terada <mbsdtest01@...il.com>)
[FD] APPLE-SA-2015-10-15-1 Keynote 6.6, Pages 5.6, Numbers 3.6, and iWork for iOS 2.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Re: [FD] Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome (Shawn McMahon <syberghost@...il.com>)

October 16 (1 message)

[FD] Qualys Security Advisory - LibreSSL (CVE-2015-5333 and CVE-2015-5334) (Qualys Security Advisory <qsa@...lys.com>)

October 17 (3 messages)

[FD] Events Made Easy WordPress plugin CSRF + Persistent XSS (David Sopas <davidsopas@...il.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-017] SAP NetWeaver J2EE DAS service - Unauthorized Access (ERPScan inc <erpscan.online@...il.com>)
[FD] CarolinaCon-12 - March 2016 - Call for Speakers/Papers/Presenters/Demos (Vic Vandal <vvandal@...l.com>)

October 19 (4 messages)

[FD] Western Digital - My Passport / My Book self-encrypting external hard drive series - Multiple vulnerabilities (alendal@....hush.com)
[FD] Seagate Central NAS vulnerabilities (Eric Windisch <eric@...disch.us>)
Re: [FD] WinRAR SFX v5.21 - Remote Code Execution Vulnerability (Fernando Mercês <nandu88@...il.com>)
[FD] Firefox FindMyDevice Critical ClickJacking Security Vulnerability ("Mohamed A. Baset" <symbian2010@...il.com>)

October 21 (11 messages)

[FD] [SE-2014-02] Google App Engine Java security sandbox bypasses (Issue 42) (Security Explorations <contact@...urity-explorations.com>)
[FD] APPLE-SA-2015-10-21-1 iOS 9.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-10-21-2 watchOS 2.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-10-21-3 Safari 9.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-10-21-4 OS X El Capitan 10.11.1 and Security Update 2015-007 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-10-21-5 iTunes 12.3.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-10-21-6 Mac EFI Security Update 2015-002 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-10-21-7 Xcode 7.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-10-21-8 OS X Server 5.0.15 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] SiteWIX - (edit_photo2.php id) SQL Injection Exploit (ZoRLu Bugrahan <zorlu@...w00rm.com>)
[FD] Simple PHP static code analysis for security researchers (Marcin Probola <marcin.probola@...il.com>)

October 22 (1 message)

[FD] SEC Consult SA-20151022-0 :: Lime Survey Multiple Critical Vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)

October 27 (8 messages)

[FD] Back to the future NTP attacks new attack vector (Jerome Athias <athiasjerome@...il.com>)
[FD] Back to the future EMV attacks (Jerome Athias <athiasjerome@...il.com>)
[FD] [ERPSCAN-15-025] Oracle E-Business Suite Database user enumeration Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-15-026] Oracle E-Business Suite - SQL injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-15-027] Oracle E-Business Suite - Cross Site Scripting Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] AoF and CSRF vulnerabilities in D-Link DCS-2103 ("MustLive" <mustlive@...security.com.ua>)
[FD] Timing attack vulnerability in most Zeus server-sides (rotem kerner <nullfield@...il.com>)
[FD] RootedCON 2016 CFP (omarbv <omarbv@...eup.net>)

October 29 (2 messages)

[FD] CVE-2015-7724 - Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD f… (Portcullis Advisories <advisories@...tc…)
[FD] CVE-2015-7723 - Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD f… (Portcullis Advisories <advisories@...tc…)

October 30 (10 messages)

[FD] eBay Magento <= 1.9.2.1 XML eXternal Entity Injection (XXE) on PHP FPM (Dawid Golunski <dawid@...alhackers.com>)
[FD] Pligg CMS 2.0.2: Code Execution & CSRF (Curesec Research Team (CRT) <crt@...esec.com>)
[FD] Pligg CMS 2.0.2: Directory Traversal (Curesec Research Team (CRT) <crt@...esec.com>)
[FD] Pligg CMS 2.0.2: Multiple SQL Injections (Curesec Research Team (CRT) <crt@...esec.com>)
[FD] [ERPSCAN-15-028] Oracle E-Business Suite - XXE injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] KeeFarce - A KeePass 2.x database extraction tool (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] [ERPSCAN-15-029] Oracle E-Business Suite - XXE injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-15-030] Oracle E-Business Suite - XXE injection Vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] Xen VM Escape (Alan Hikerell <hikerell@...il.com>)
[FD] Arbitrary code execution resp. escalation of privilege with Mozilla's SETUP.EXE ("Stefan Kanthak" <stefan.kanthak@...go.de>)

115 messages

Powered by blists - more mailing lists