full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	²	³
⁴	⁵ 9	⁶ 3	⁷ 2	⁸ 11	⁹	¹⁰
¹¹ 11	¹² 4	¹³ 2	¹⁴	¹⁵ 12	¹⁶ 2	¹⁷
¹⁸	¹⁹ 1	²⁰ 6	²¹ 1	²²	²³ 3	²⁴
²⁵ 1	²⁶	²⁷ 29	²⁸ 2	²⁹ 1	³⁰	³¹

Messages by day:

January 5 (9 messages)

[FD] Alcatel Lucent Home Device Manager - Management Console Multiple XSS (Uğur Cihan KOÇ <u.cihan.koc@...il.com>)
[FD] Executable installers/self-extractors are vulnerable^WEVIL (case 17): Kaspersky Labs utilities ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Possible vulnerability in F5 BIG-IP LTM - Improper input validation of the HTTP version number of the HTTP reqest allows an… (Eitan Caspi <eitanc@...oo.com>)
[FD] Vulnerabilities in Office Document Reader for iOS ("MustLive" <mustlive@...security.com.ua>)
[FD] Confluence Vulnerabilities (Sebastian Perez <s3bap3@...il.com>)
[FD] CVE-2015-7944, CVE-2015-7945 - Ganeti Security Advisory (DoS, Unauthenticated Info Leak) (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] CALL FOR PAPERS - NUIT DU HACK - 02/03 july 2016 (freeman <freeman@...kerzvoice.net>)
[FD] Buffer Overflow in Advanced Encryption Package Software (vishnu raju <rajuvishnu52@...il.com>)
[FD] Buffer Overflow at password field in Advanced Encryption Package Software (vishnu raju <rajuvishnu52@...il.com>)

January 6 (3 messages)

[FD] MediaAccess , unauthenticated file disclosure (Ahmed Sultan <0x4148@...il.com>)
[FD] Cross Site Scripting (XSS) & Cross Site Request Forgery (CSRF) in Crony Cronjob Manager Version 0.4.4 (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] Unauthenticated remote code execution in OpenMRS (Brian Hysell <bdhysell@...il.com>)

January 7 (2 messages)

[FD] [RT-SA-2014-014] AVM FRITZ!Box: Arbitrary Code Execution Through Manipulated Firmware Images (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] [RT-SA-2015-001] AVM FRITZ!Box: Remote Code Execution via Buffer Overflow (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

January 8 (11 messages)

[FD] [RT-SA-2015-005] o2/Telefonica Germany: ACS Discloses VoIP/SIP Credentials (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] Security BSides Ljubljana 0x7E0 CFP - March 9, 2016 (Andraz Sraka <a@...bix.org>)
[FD] [CVE-2015-8604] Cacti SQL injection in graphs_new.php ("changzhao.mao@...ppsecurity.com.cn" <changzhao.mao@...ppsecurity.com.cn>)
[FD] OpenCart Security Advisory - XSS Vulnerabiltiy - CVE-2015-4671 (Onur Yilmaz <onur@...sparker.com>)
[FD] Serendipity Security Advisory - XSS Vulnerability - CVE-2015-8603 (Onur Yilmaz <onur@...sparker.com>)
[FD] APPLE-SA-2016-01-07-1 QuickTime 7.7.9 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Combining DLL hijacking with USB keyboard emulation based attacks (Rodrigo Menezes <rodrigo@...idlight.io>)
[FD] MobaXTerm before version 8.5 vulnerability in "jump host" functionality (Thomas Bleier <thomas@...ier.at>)
[FD] Executable installers are vulnerable^WEVIL (case 18): EMSISoft's installers allow arbitrary (remote) code executio… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 19): ZoneAlarm's installers allow arbitrary (remote) code execut… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execut… ("Stefan Kanthak" <stefan.kanthak@...go.…)

January 11 (11 messages)

[FD] Multiple Cross Site Scripting in Netgear Router Version 1.0.0.24 (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 (<operator8203@...box.com>)
[FD] Google Chrome - Javascript Execution Via Default Search Engines (metalkey net <6d3374346c6b33@...il.com>)
[FD] Cross Site Request Forgery in Netgear Router JNR1010 Version 1.0.0.24 (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] Broken Authentication & Improper Session Management in Netgear Router JNR1010 Version 1.0.0.24 (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] Exploiting XXE vulnerabilities in AMF libraries (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
[FD] Linux user namespaces overlayfs local root (halfdog <me@...fdog.net>)
[FD] CVE-2015-8396: GDCM buffer overflow in ImageRegionReader::ReadIntoBuffer (Stelios Tsampas <stelios@...sus-labs.com>)
[FD] CVE-2015-8397: GDCM out-of-bounds read in JPEGLSCodec::DecodeExtent (Stelios Tsampas <stelios@...sus-labs.com>)
[FD] New BlackArch Linux ISOs (2016.01.10) released (Black Arch <blackarchlinux@...il.com>)
Re: [FD] Combining DLL hijacking with USB keyboard emulation (gremlin@...mlin.ru)

January 12 (4 messages)

Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code executi… (Douglas Held <risk@...glasheld.net>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code exe… (Sarah Allen <sarah@...esspositive.com.a…)
Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code ex… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] SEC Consult whitepaper: Bypassing McAfee Application Whitelisting for Critical Infrastructure Systems (SEC Consult Vulnerability Lab <research@...-consult…)

January 13 (2 messages)

[FD] Html injection Dolibarr 3.8.3 ("NaxoneZ ." <naxonez@...il.com>)
[FD] EasyDNNnews Reflected XSS (Peter Lapp <lappsec@...il.com>)

January 15 (12 messages)

[FD] [KIS-2016-01] CakePHP <= 3.2.0 "_method" CSRF Protection Bypass Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [TOOL] The Metabrik Platform (GomoR <nmapfd@...or.org>)
[FD] Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Qualys Security Advisory <qsa@...lys.com>)
[FD] FreeBSD bsnmpd information disclosure (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Whatever happened with CVE-2015-0072? (Patrick Toomey <ptoomey3@...sedcoin.com>)
[FD] CCA on CoreProc/crypto-guard and an Appeal to PHP Programmers (Scott Arciszewski <scott@...agonie.com>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code ex… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] [CVE-2016-0014] Executable installers are vulnerable^WEVIL (case 1): Microsoft's IExpress resp. WExtract, SFXCab, … ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 22): python.org's executable installers allow arbitrary (remote) … ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Defense in depth -- the Microsoft way (part 38): does Microsoft follow their own security guidance/advisories? ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execu… (Michel Arboi <michel.arboi@...il.com>)
Re: [FD] Combining DLL hijacking with USB keyboard emulation (Rodrigo Menezes <rodrigo@...idlight.io>)

January 16 (2 messages)

[FD] Correct answer Information Disclosure in TCExam <= 12.2.5 ("lists@...onioherraizs.com lists@...onioherraizs.com" <lists@...onioherraizs.com>)
[FD] It essentially wins crypto vulnerability bingo! gilfether/phpcrypt (Scott Arciszewski <scott@...agonie.com>)

January 19 (1 message)

[FD] [CORE-2016-0001] - Intel Driver Update Utility MiTM (CORE Advisories Team <advisories@...esecurity.com>)

January 20 (6 messages)

[FD] Administrator auto-logout design flaw in ASUS wireless routers (David Longenecker <david@...urityforrealpeople.com>)
[FD] SeaWell Networks Spectrum - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] GRR <= 3.0.0-RC1 (all versions) file upload filter bypass (authenficated) (Jean-Marie Bourbon <mail.bourbon@...il.com>)
[FD] mobile.facebook.com is not on HSTS preload list or sending the Strict-Transport-Security header (Ricardo Iramar dos Santos <riramar@...il.com>)
[FD] LiteSpeed Web Server - Security Advisory - HTTP Header Injection Vulnerability (Onur Yilmaz <onur@...sparker.com>)
[FD] OpenCart users, switch to OpenCart-CE immediately (Scott Arciszewski <scott@...agonie.com>)

January 21 (1 message)

[FD] SEC Consult SA-20160121-0 :: Deliberately hidden backdoor account in AMX (Harman Professional) devices (SEC Consult Vulnerability Lab <research@...-consul…)

January 23 (3 messages)

[FD] LEADTOOLS ActiveX control multiple DLL side loading vulnerabilities ("Securify B.V." <lists@...urify.nl>)
[FD] HP ToComMsg DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)
[FD] HP LaserJet Fax Preview DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)

January 25 (1 message)

[FD] [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)

January 27 (29 messages)

[FD] Secure Item Hub v1.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Barracuda Networks Bug Bounty #38 Message Archiver - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Apple WatchOS v2.1 - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Telegram (API) - Cross Site Request Forgery Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Ebay Magento Bug Bounty #2 - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Kleefa v1.7 (IR) - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Classic Infomedia (Login) - Auth Bypass Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WebMartIndia CMS 2016 Q1 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] los818 CMS 2016 Q1 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Netgear GS105Ev2 - Multiple Vulnerabilities (Benedikt Westermann <benedikt.westermann@...ec.tuv.com>)
[FD] Eclipse BIRT report viewer <= 4.5.0 Persistent XSS (graphx@...aint.org)
[FD] ZyXel WAP3205 V1 Multiple Persistent and Reflected XSS (graphx@...aint.org)
[FD] Eclipse BIRT Report Viewer <= 4.5.0 XSS (graphx@...aint.org)
[FD] Eclipse BIRT Viewer <= v4.5.0 Persistent XSS (graphx@...aint.org)
[FD] PHP-FPM fpm_log.c memory leak and buffer overflow (Imre RAD <imre.rad@...rch-lab.hu>)
[FD] PHP LiteSpeed SAPI secret key improper disposal (Imre RAD <imre.rad@...rch-lab.hu>)
[FD] PHP LiteSpeed SAPI out of boundaries read due to missing input validation (Imre RAD <imre.rad@...rch-lab.hu>)
[FD] Authentication bypass in PHP File Manager 0.9.8 (Imre Rad <imre.rad@...rch-lab.hu>)
[FD] SAP Hana Cloud 4 XSS (Shahmeer Baloch <shahmeerbond@...il.com>)
[FD] HCA0005 - Liberty Global - Horizon HD STB - predictable WiFi (Hacking Corporation Sàrl <releases@...kingcorp.ch>)
[FD] McAfee File Lock Driver - Kernel Memory Leak (Kyriakos Economou <keconomou@...titude.com>)
[FD] McAfee File Lock Driver - Kernel Memory Leak (Kyriakos Economou <keconomou@...titude.com>)
[FD] McAfee File Lock Driver - Kernel Stack Based BOF (Kyriakos Economou <keconomou@...titude.com>)
[FD] Recon 2016 Call For Papers - June 17 - 19, 2016 - Montreal, Canada (cfp2016@...on.cx)
[FD] [ERPSCAN-15-024] SAP HANA hdbindexserver - Memory corruption (ERPScan inc <erpscan.online@...il.com>)
[FD] Multiple security issues in MOVEit Managed File Transfer application (Profundis Labs <profundislabs@...glemail.com>)
[FD] HCA0005 - Liberty Global - Horizon HD STB - predictable WiFi passphrase (Hacking Corporation Sàrl <releases@...kingcorp.ch>)
[FD] Announcing nullcon HackIM 2016 Powered by EMC2 (murtuja bharmal <murtuja_bharmal@...oo.com>)
[FD] CarolinaCon-12 - March 2016 - FINAL ANNOUNCEMENT (Vic Vandal <vvandal@...l.com>)

January 28 (2 messages)

[FD] Trend Micro Direct Pass - Filter Bypass & Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] New Era Company CMS - (id) SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 29 (1 message)

[FD] Netlife Photosuite Pro - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

100 messages