full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	²	³
⁴ 19	⁵ 2	⁶ 7	⁷ 6	⁸ 2	⁹ 5	¹⁰
¹¹	¹² 3	¹³ 1	¹⁴ 9	¹⁵ 6	¹⁶ 3	¹⁷
¹⁸	¹⁹	²⁰ 6	²¹ 4	²² 2	²³	²⁴
²⁵ 6	²⁶ 7	²⁷ 2	²⁸ 2	²⁹ 1	³⁰

Messages by day:

April 4 (19 messages)

[FD] Wordpress Scoreme Theme - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Techsoft Web Solutions CMS 2016 Q2 - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FortiManager & FortiAnalyzer 5.x (Appliance Application) - (filename) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [SE-2012-01] Broken security fix in IBM Java 7/8 (Security Explorations <contact@...urity-explorations.com>)
[FD] [CVE-2016-3659]Cacti graph_view.php SQL Injection Vulnerability ("xiaotian.wang@...ppsecurity.com.cn"<xiaotian.wang@...ppsecurity.com.cn>)
[FD] DotCMS injection Vulnerability ("p0x2015" <573031544@...com>)
[FD] Daily Edition theme for WordPress ("MustLive" <mustlive@...security.com.ua>)
[FD] APPLE-SA-2016-03-31-1 iBooks Author 2.4.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Unauthenticated CSRF reboot flaw in ARRIS (Motorola) SURFboard modems (David Longenecker <david@...urityforrealpeople.com>)
[FD] Daily Edition theme for WordPress ("MustLive" <mustlive@...security.com.ua>)
[FD] Multiple vulnerabilities found in Quanta LTE routers (backdoor, backdoor accounts, RCE, weak WPS ...) (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] SQL Injection Vulnerability in DotCms v3.3 (xiong piaox <yahoo860201@...il.com>)
[FD] MeshCMS Command Execution Vulnerability (xiong piaox <yahoo860201@...il.com>)
[FD] Pulse CMS Multiple Vulnerabilities (xiong piaox <yahoo860201@...il.com>)
[FD] ManageEngine Password Manager Pro Multiple Vulnerabilities (Sebastian Perez <s3bap3@...il.com>)
[FD] CVE-2016-2191: optipng: invalid write (Hans Jerry Illikainen <hji@...topia.com>)
[FD] Reprint your I$ACA CPE's using Burp Suite! ( the no refund addition ! ) (robert mccurdy <freeload101@...oo.com>)
[FD] Tradukka affected by Cross-Site Scripting (Francisco Javier Santiago Vázquez <franciscojaviersantiagovazquez@...il.com>)
[FD] Bitcoin/Altcoin Stratum Pool Mass Duplicate Shares Exploit ("exploits4coins.com 2" <lists@...loits4coins.com>)

April 5 (2 messages)

[FD] Apple iOS 9.3.1 (iPhone 6S & iPhone Plus) - (3D Touch) Passcode Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] [SE-2012-01] Broken security fix in IBM Java 7/8 (Security Explorations <contact@...urity-explorations.com>)

April 6 (7 messages)

[FD] MeshCMS 3.6 – Multiple vulnerabilities (xiong piaox <yahoo860201@...il.com>)
[FD] Fireware XTM Web UI - Open Redirect (Manuel Mancera <mmancera@...ecure.com>)
[FD] hardwear.io CFP 2016 - Hardware Security Conference Call for Papers (Hardwear Team <hw@...dwear.io>)
[FD] Panda Security Multiple Business Products - Privilege Escalation (Kyriakos Economou <keconomou@...titude.com>)
[FD] Panda Security 2016 Home User Products - Privilege Escalation (Kyriakos Economou <keconomou@...titude.com>)
[FD] CVE-2016-3672 - Unlimiting the stack not longer disables ASLR (Hector Marco-Gisbert <hecmargi@....es>)
[FD] Check out faraday v1.0.18! New CLI mode, Jira support & bug fixes! (Francisco Amato <famato@...obytesec.com>)

April 7 (6 messages)

[FD] Techsoft WS CMS (2016 Q2) - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Virtual Freer v1.58 - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Quicksilver HQ VoHo Concept4E CMS v1.0 - Multiple SQL Injection Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Eight Webcom CMS (2016 Q2) - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Perli v2.6 iOS - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Monsta Box WebFTP 1.8.2 and below arbitrary file read and path traversal vulnerabilities (Imre RAD <imre.rad@...rch-lab.hu>)

April 8 (2 messages)

[FD] AccelSite Content Manager v1.0 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WP Multiple Meta Box v1.0 - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

April 9 (5 messages)

[FD] [CVE-2016-3972]DotCMS Directory traversal vulnerability (xiong piaox <yahoo860201@...il.com>)
[FD] [CVE-2016-3971]DotCMS xss vulnerability (xiong piaox <yahoo860201@...il.com>)
[FD] Blind SQL injections in CivicRM ("Simon Waters (Surevine)" <simon.waters@...evine.com>)
[FD] Express Zip <= 2.40 Path Traversal (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] end of useable crypto in browsers? (Árpád Magosányi <mag@...was.rulez.org>)

April 12 (3 messages)

[FD] Wordpress Robo Gallery v2.0.14 - Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] .NET Framework 4.6 allows side loading of Windows API Set DLL ("Securify B.V." <lists@...urify.nl>)
[FD] [SE-2012-01] Yet another broken security fix in IBM Java 7/8 (Security Explorations <contact@...urity-explorations.com>)

April 13 (1 message)

[FD] Webline CMS (2016Q2) - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

April 14 (9 messages)

[FD] Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] DAVOSET v.1.2.8 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] end of useable crypto in browsers? (Seth Arnold <seth.arnold@...onical.com>)
Re: [FD] end of useable crypto in browsers? (Sebastian <sebb@...b767.de>)
Re: [FD] end of useable crypto in browsers? (Árpád Magosányi <mag@...was.rulez.org>)
Re: [FD] end of useable crypto in browsers? (Sebastian <sebb@...b767.de>)
[FD] Call for Papers for 4th Balkan Computer Congress – BalCCon2k16 (Milos Krasojevic <milobit@...ons.org>)
[FD] AST-2016-004: Long Contact URIs in REGISTER requests can crash Asterisk ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2016-005: TCP denial of service in PJProject ("Asterisk Security Team" <security@...erisk.org>)

April 15 (6 messages)

Re: [FD] end of useable crypto in browsers? (Reindl Harald <h.reindl@...lounge.net>)
Re: [FD] end of useable crypto in browsers? (Sebastian <sebb@...b767.de>)
Re: [FD] end of useable crypto in browsers? (Tony Arcieri <bascule@...il.com>)
[FD] PfSense Community Edition Multiple Vulnerabilities (Francesco Oddo <francesco.oddo@...urity-assessment.com>)
[FD] [ERPSCAN-16-001] SAP NetWeaver 7.4 - XSS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-002] SAP HANA - log injection and no size restriction (ERPScan inc <erpscan.online@...il.com>)

April 16 (3 messages)

[FD] [ERPSCAN-16-003] SAP NetWeaver 7.4 - cryptographic issues (ERPScan inc <erpscan.online@...il.com>)
[FD] Microsoft Internet Explorer 11 MSHTML.DLL Remote Binary Planting Vulnerability (Sandro Poppi <spoppi.sec@...il.com>)
[FD] Announcing NorthSec 2016 - Montreal, May 19-22 (Pierre-David / NorthSec Conference <conference@...c.io>)

April 20 (6 messages)

[FD] Executable installers are vulnerable^WEVIL (case 33): GData's installers allow escalation of privilege ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] [ERPSCAN-16-004] SAP NetWeaver 7.4 (Pmitest servlet) – XSS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-005] SAP HANA hdbxsengine JSON – DoS vulnerability (ERPScan inc <erpscan.online@...il.com>)
[FD] Multiple Reflected XSS vulnerabilities in Oliver (formerly Webshare) v1.3.1 ("research@...lab.org" <research@...lab.org>)
[FD] Lock Browser 5.3 (Browser Security, Open Source, Python) (David Leo <david.leo@...kbrowser.com>)
[FD] Avast SandBox Escape via IOCTL Requests (Kyriakos Economou <keconomou@...titude.com>)

April 21 (4 messages)

[FD] Time-based SQL Injection in Admin panel ImpressCMS <= v1.3.9 (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] Wordpress iThemes Security (Better WP Security) Insecure Backup/Logfile Generation (access rights) (Sysdream Labs <labs@...dream.com>)
[FD] Wordpress iThemes Security (Better WP Security) Insecure Backup/Logfile Generation (predicatable filename) (Sysdream Labs <labs@...dream.com>)
[FD] CVE-2016-3074: libgd: signedness vulnerability (Hans Jerry Illikainen <hji@...topia.com>)

April 22 (2 messages)

[FD] SEC Consult SA-20160422-0 :: Insecure credential storage in my devolo Android app (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20160422-1 :: Multiple vulnerabilities in Digitalstrom Konfigurator (SEC Consult Vulnerability Lab <research@...-consult.com>)

April 25 (6 messages)

[FD] C & C++ for OS - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Totemomail v4.x & v5.x - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] UBNT Bug Bounty #2 - XML External Entity Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cyberoam Central Console v02.03.1 - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Negin Group CMS - (v) Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

April 26 (7 messages)

[FD] VoipNow v4.0.1 - (xajax_handler) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Trend Micro (Account) - Email Spoofing Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Sophos XG Firewall (SF01V) - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Remote Code Execution in Shopware <5.1.5 (CVE-2016-3109) (David Vieira-Kurz <david.vieira-kurz@...obilienscout24.de>)
[FD] [CFP] GreHack 2016 (Paget Philippe <philippe.paget@...re.fr>)
[FD] Request For Comment: Possible Flaw of Bypassing CAPTCHA in AWS Login? (David Leo <david.leo@...kbrowser.com>)
[FD] Multiple Vulnerabilities in Voo branded Netgear CG3700b (dev@...ler.net)

April 27 (2 messages)

[FD] Oracle Discoverer Viewer BI - Open Redirect Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] EMC M&R (Watch4net) lacks Cross-Site Request Forgery protection ("Securify B.V." <lists@...urify.nl>)

April 28 (2 messages)

[FD] Bug bounty submission (test111 tesla <test111.tesla@...l.ru>)
[FD] Xerox Phaser 6700 - Remote Root-Exploits utilizing Clone Files (Raphael Ernst <raphael.ernst@...e.fraunhofer.de>)

April 29 (1 message)

[FD] Wordpress Truemag Theme - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

93 messages