full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2015/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹	²	³ 4	⁴ 1	⁵	⁶
⁷	⁸ 1	⁹ 40	¹⁰ 1	¹¹ 4	¹² 3	¹³ 8
¹⁴	¹⁵	¹⁶ 14	¹⁷ 1	¹⁸ 5	¹⁹ 1	²⁰
²¹ 6	²² 11	²³ 14	²⁴ 5	²⁵	²⁶	²⁷ 3
²⁸ 1	²⁹	³⁰ 4	³¹ 2

Messages by day:

December 3 (4 messages)

[FD] [CFP] BSides San Francisco - February 2016 (BSides SF <info@...dessf.com>)
[FD] BF and CE vulnerabilities in ASUS RT-G32 ("MustLive" <mustlive@...security.com.ua>)
[FD] Huawei Wimax routers vulnerable to multiple threats (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Multiple vulnerabilities in Huutopörssi's website (huutoporssi.fi) (Wub TheCaptain <wubthecaptain@...il.com>)

December 4 (1 message)

[FD] KL-001-2015-006 : Linksys EA6100 Wireless Router Authentication Bypass (KoreLogic Disclosures <disclosures@...elogic.com>)

December 8 (1 message)

[FD] MacOS/iPhone/Apple Watch/Apple TV libc File System Buffer Overflow ("[CXSEC]" <submit@...ec.org>)

December 9 (40 messages)

[FD] [CORE-2015-0014] - Microsoft Windows Media Center link file incorrectly resolved reference (CORE Advisories Team <advisories@...esecurity.com>)
[FD] Symfony CMS 2.6.3 – Multiple Cross-Site Scripting Vulnerability (Sachin Wagh <wsachin092@...il.com>)
[FD] [CVE-2015-8369] Cacti SQL injection in graph.php (changzhao.mao <changzhao.mao@...ppsecurity.com.cn>)
[FD] Announcing NorthSec 2016 CFP + Reg - Montreal, May 19-22 (Pierre-David Oriol <conference@...c.io>)
[FD] ntop-ng <= 2.0.151021 - Privilege Escalation (Dolev Farhi <D.Farhi@...com>)
[FD] SQLMap Code Execute (Vex Woo <hap.ddup@...il.com>)
[FD] 4images 1.7.12: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] 4images 1.7.11: SQL Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] 4images 1.7.11: Path Traversal ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] 4images 1.7.11: Code Execution Exploit ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] 4images 1.7.11: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] CodoForum 3.4: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] phpwcms 1.7.9: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] phpwcms 1.7.9: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Geeklog 2.1.0: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Geeklog 2.1.0: Code Execution Exploit ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Geeklog 2.1.0: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] redaxscript 2.5.0: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] redaxscript 2.5.0: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] appRain 4.0.3: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] appRain 4.0.3: Path Traversal ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] appRain 4.0.3: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] appRain 4.0.3: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Defense in depth -- the Microsoft way (part 37): MMC.exe and DrvInst.exe load and execute ".dll" with elevated res… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 6): SumatraPDF-*-installer.exe allows remote code execution with … ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 8): vlc-*.exe allows remote code execution with escalation of pri… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 2): NSIS allows remote code execution with escalation of privileg… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 5): JRSoft InnoSetup ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Executable installers are vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation of privi… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 9): Chrome's setup.exe allows arbitrary code execution and escala… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] [CVE-2015-7706] SECURE DATA SPACE API Multiple Non-Persistent Cross-Site Scripting Vulnerabilities ("Vogt, Thomas" <Thomas.Vogt@...unet.com>)
[FD] LG Nortel ADSL modems - Multiple vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] APPLE-SA-2015-12-08-1 iOS 9.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-12-08-4 watchOS 2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-12-08-5 Safari 9.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-12-08-6 Xcode 7.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-12-08-3 OS X El Capitan 10.11.2 and Security Update 2015-008 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2015-12-08-2 tvOS 9.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] GoAutoDial CE 3.3 Multiple SQL injections, Command Injection (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] [CVE-2014-3260] Crypto implementation flaws in Pacom GMS System (XPD Advisories Team <security-alert@....se>)

December 10 (1 message)

[FD] SEC Consult SA-20151210-0 :: Skybox Platform Multiple Vulnerabilities (SEC Consult Vulnerability Lab <research@...-consult.com>)

December 11 (4 messages)

[FD] BFS-SA-2015-003: Internet Explorer CObjectElement Use-After-Free Vulnerability (Blue Frost Security Research Lab <research@...efrostsecurity.de>)
[FD] CLOUD4WI SPLASH PORTAL REFLECTED XSS VULNERABILITY – CVE-2015-4699 ("agotouning@...ero.it" <agotouning@...ero.it>)
[FD] Polycom VVX-Series Business Media Phones Path Traversal Vulnerability (Jake Reynolds <jake@...thsecurity.com>)
[FD] APPLE-SA-2015-12-11-1 iTunes 12.3.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)

December 12 (3 messages)

[FD] COM+ Services DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
[FD] Event Viewer Snapin multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)
[FD] Windows Authentication UI DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)

December 13 (8 messages)

[FD] XSS Vulnerability in Synnefo Client for Synnefo IMS 2015 - CVE-2015-8247 (Aravind <altoarun@...il.com>)
[FD] SilverStripe CMS & Framework v3.2.0 – Cross-Site Scripting Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] OcPortal CMS 9.0.20 – Cross-Site Scripting Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] OcPortal CMS 9.0.21 – Cross-site Request Forgery (CSRF) Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] Bedita 3.6.0 – Cross-Site Scripting Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] Symphony 2.6.3 – Multiple Persistent Cross-Site Scripting Vulnerabilities (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] DAVOSET v.1.2.7 ("MustLive" <mustlive@...security.com.ua>)
[FD] [CVE-2015-8377] Cacti graphs_new.php SQL Injection Vulnerability ("xiaotian.wang@...ppsecurity.com.cn"<xiaotian.wang@...ppsecurity.com.cn>)

December 16 (14 messages)

[FD] Shutdown UX DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
[FD] Shockwave Flash Object DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
[FD] OLE DB Provider for Oracle multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)
[FD] [CFP] Speak About Your Cyberwar at PHDays VI (Alexander Lashkov <ALashkov@...ecurity.com>)
[FD] [ERPSCAN-15-021] SAP NetWeaver 7.4 - SQL Injection vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] ERPSCAN Research Advisory [ERPSCAN-15-022] SAP NetWeaver 7.4 - XSS (ERPScan inc <erpscan.online@...il.com>)
[FD] #BadWinmail: The "Enterprise Killer" Attack Vector in Microsoft Outlook (Haifei Li <haifei-non-reply@...look.com>)
[FD] Back to 28: Grub2 Authentication Bypass 0-Day [CVE-2015-8370] (Hector Marco-Gisbert <hecmargi@....es>)
[FD] libnsgif: stack overflow (CVE-2015-7505) and out-of-bounds read (CVE-2015-7506) (Hans Jerry Illikainen <hji@...topia.com>)
[FD] libnsbmp: heap overflow (CVE-2015-7508) and out-of-bounds read (CVE-2015-7507) (Hans Jerry Illikainen <hji@...topia.com>)
[FD] Two bytes change and you have a zero day (Hossein Lotfi <hossein.lotfi.all@...il.com>)
[FD] User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (halfdog <me@...fdog.net>)
[FD] Executable installers are vulnerable^WEVIL (case 10): McAfee Security Scan Plus, WebAdvisor and CloudAV (Beta) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Executable installers are vulnerable^WEVIL (case 11): Nmap <7.01 and Nmap-WinPcap <4.13 ("Stefan Kanthak" <stefan.kanthak@...go.de>)

December 17 (1 message)

Re: [FD] Executable installers are vulnerable^WEVIL (case 11): Nmap <7.01 and Nmap-WinPcap <4.13 (imposter imp <osterimp@...il.com>)

December 18 (5 messages)

[FD] Executable uninstallers are vulnerable^WEVIL (case 12): Avira Registry Cleaner allows arbitrary code execution wit… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] PFSense <= 2.2.5 Directory Traversal (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] Samsung softap weak random generated password (Augusto Pereyra <aepereyra@...il.com>)
[FD] KL-001-2015-007 : Seagate GoFlex Satellite Remote Telnet Default Password (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2015-008 : Dell Pre-Boot Authentication Driver Uncontrolled Write to Arbitrary Address (KoreLogic Disclosures <disclosures@...elogic.com>)

December 19 (1 message)

[FD] Notepad ++ NPPFtp Plugin Buffer Overflow (Rio Sherri <rio.sherri@...nstudent.info>)

December 21 (6 messages)

[FD] giflib: heap overflow in giffix (CVE-2015-7555) (Hans Jerry Illikainen <hji@...topia.com>)
[FD] Call for Papers -YSTS X - Information Security Conference, Brazil (Luiz Eduardo <le@...s.org>)
Re: [FD] PFSense <= 2.2.5 Directory Traversal (Bacon Zombie <baconzombie@...il.com>)
[FD] Almost no resp. only some mitigation(s) for "DLL hijacking" via load-time dependencies ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Executable installers are vulnerable^WEVIL (case 13): ESET NOD32 antivirus installer allows remote code execution … ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Faraday v1.0.16: (Group vulns by fields, Filter false-positives, Canvas plugin) (Francisco Amato <famato@...obytesec.com>)

December 22 (11 messages)

[FD] [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In "Remember Me" Login Functionality (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] Executable installers are vulnerable^WEVIL (case 14): Rapid7's ScanNowUPnP.exe allows arbitrary (remote) code exec… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] DELL Scrutinizer v12.0.3 - Persistent Software Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Western Union CN Bug Bounty #6 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WP Content Text Slider on Post 6.8 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wordpress Content Text Slider on Post 6.8 - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Lithium Forum - (previewImages) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Switch v4.68 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] POP Peeper 4.0.1 - Persistent Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Aeris Calandar v2.1 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SIPROTEC 4 and SIPROTEC Compact FAQ #5 (SCADA StrangeLove <scadastrangelove@...il.com>)

December 23 (14 messages)

[FD] Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code ex… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] Symfony CMS 2.6.3 – Multiple Cross-Site Scripting Vulnerability (Sachin Wagh <wsachin092@...il.com>)
Re: [FD] Wordpress Content Text Slider on Post 6.8 - Persistent Vulnerability (Ryan Dewhurst <ryandewhurst@...il.com>)
[FD] PhpSocial v2.0.0304: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] PhpSocial v2.0.0304: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Arastta 1.1.5: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Arastta 1.1.5: SQL Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Grawlix 1.0.3: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Grawlix 1.0.3: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Grawlix 1.0.3: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] CouchCMS 1.4.5: XSS & Open Redirect ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] CouchCMS 1.4.5: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] esoTalk 1.0.0g4: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code ex… (Shawn McMahon <syberghost@...il.com>)

December 24 (5 messages)

Re: [FD] Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code executi… ("NaxoneZ ." <naxonez@...il.com>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execut… (Justin Ferguson <justin@...c.co>)
[FD] XZERES 442SR Wind Turbine XSS (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Nordex Control 2 (NC2) SCADA V16 and prior versions - XSS (Karn Ganeshen <karnganeshen@...il.com>)
[FD] eWON sa Industrial router - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)

December 27 (3 messages)

[FD] libtiff: invalid write (CVE-2015-7554) (Hans Jerry Illikainen <hji@...topia.com>)
[FD] EasyCafe Server <= 2.2.14 Remote File Read (Rio Sherri <rio.sherri@...nstudent.info>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code… ("Stefan Kanthak" <stefan.kanthak@...go.…)

December 28 (1 message)

Re: [FD] libtiff: invalid write (CVE-2015-7554) (Martin Kühne <mysatyre@...il.com>)

December 30 (4 messages)

[FD] Local root vulnerability in DeleGate v9.9.13 ("Larry W. Cashdollar" <larry0@...com>)
[FD] Vulnerabilities in Mobile Safari ("MustLive" <mustlive@...security.com.ua>)
[FD] Netduma R1 Router CSRF (Josh Chaney <josh@...ney.io>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 15):F-SecureOnlineScanner.exe allows arbitrary (remote) codeexecution and … (<lists@...ossecurity.com>)

December 31 (2 messages)

Re: [FD] Executable installers are vulnerable^WEVIL (case 15):F-SecureOnlineScanner.exe allows arbitrary (remote) code… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 16): Trend Micro's installers allows arbitrary (remote) code exec… ("Stefan Kanthak" <stefan.kanthak@...go.…)

129 messages