full-disclosure mailing list - 2016/08

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 7	² 8	³ 3	⁴ 6	⁵ 9	⁶ 6	⁷
⁸ 2	⁹ 4	¹⁰ 2	¹¹ 2	¹² 13	¹³	¹⁴
¹⁵ 13	¹⁶ 8	¹⁷	¹⁸ 1	¹⁹ 14	²⁰ 1	²¹
²² 14	²³ 3	²⁴ 5	²⁵ 11	²⁶ 1	²⁷	²⁸
²⁹	³⁰ 4	³¹ 2

Messages by day:

August 1 (7 messages)

[FD] Cross-Site Scripting vulnerability in Booking Calendar WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] SQL injection vulnerability in Booking Calendar WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Contact Bank WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Stored Cross-Site Scripting vulnerability in WP Live Chat Support WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

August 2 (8 messages)

[FD] FortiManager (Series) - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Guppy CMS v5.01.03 - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Docebo LMS 6.9 - (Moxie) API Calls RST Remote Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Zoll ePCR v2.6.4 iOS - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WinSaber - Unquoted Service Path Privilege Escalation (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cross-Site Scripting in Uji Countdown WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in WangGuard WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

August 3 (3 messages)

[FD] Cross-Site Scripting vulnerability in search function Activity Log WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Activity Log WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in WordPress Landing Pages Plugin (Summer of Pwnage <lists@...urify.nl>)

August 4 (6 messages)

[FD] FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FortiManager (Series) - (Bookmark) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cross-Site Scripting vulnerability in Events Made Easy WordPress plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in FormBuilder WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Count per Day WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Stored Cross-Site Scripting vulnerability in Count per Day WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

August 5 (9 messages)

[FD] Typesettercms v5.0.1 - (Delete Files) CSRF Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Subrion v4.0.5 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FortiCloud - (Reports Summary) Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] DLL side loading vulnerability in VMware Host Guest Client Redirector ("Securify B.V." <lists@...urify.nl>)
[FD] Cross-Site Scripting in Store Locator Plus for WordPress (Summer of Pwnage <lists@...urify.nl>)
[FD] Ecwid Ecommerce Shopping Cart WordPress Plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] Kaspersky Safe Browser iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6231) (David Coomber <davidcoomber.infosec@...il.com>)
[FD] D-Link NAS, DNS Series: Stored XSS via Unauthenticated SMB (Benjamin Daniel Mussler <sec@...fl7.de>)
[FD] [SYSS-2016-065] NASdeluxe NDL-2400r: OS Command Injection ("Klaus Eisentraut (SySS GmbH)" <Klaus.Eisentraut@...S.de>)

August 6 (6 messages)

[FD] CVE-2016-6526 Possible Privilege Escalation in telecom of Samsung Mobile Phone (0xr0ot <0xr0ot.sec@...il.com>)
[FD] CVE-2016-6527 Possible Privilege Escalation in telecom of Samsung Mobile Phone (0xr0ot <0xr0ot.sec@...il.com>)
[FD] K2 (Joomla! Extension) < 2.7.1 - Reflected Cross Site Scripting (Manuel Mancera <mmancera@...ecure.com>)
[FD] Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance (Pedro Ribeiro <pedrib@...il.com>)
Re: [FD] Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance (Pedro Ribeiro <pedrib@...il.com>)
[FD] [SYSS-2016-063] VMware ESXi 6 - Improper Input Validation (CWE-20) (Matthias Deeg <matthias.deeg@...s.de>)

August 8 (2 messages)

[FD] phpCollab v2.5 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

August 9 (4 messages)

[FD] Facebook Bug Bounty #33 - Bypass ID user to linked Phone Number Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] FortiVoice v5.0 - Filter Bypass & Persistent Validation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Nuke Evolution 2.0.9d - Multiple Client Side Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Internet Explorer iframe sandbox local file name disclosure vulnerability ("Securify B.V." <lists@...urify.nl>)

August 10 (2 messages)

[FD] SEC Consult SA-20160810-0 :: Multiple vulnerabilities in LINE instant messenger platform (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] [CORE-2016-0006] - SAP CAR Multiple Vulnerabilities (CORE Advisories Team <advisories@...esecurity.com>)

August 11 (2 messages)

[FD] Microsoft Education - Stored Cross Site Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

August 12 (13 messages)

[FD] NEW VMSA-2016-0011 - vRealize Log Insight update addresses directory traversal vulnerability. (VMware Security Response Center <security@...are.com>)
[FD] Executable installers are vulnerable^WEVIL (case 38): Microsoft's Windows10Upgrade*.exe allows elevation of privil… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Defense in depth -- the Microsoft way (part 42): Sysinternals utilities load and execute rogue DLLs from %TEMP% ("Stefan Kanthak" <stefan.kanthak@...go.de…)
[FD] DDanchev's Blog Going Private - Request Access (Ddanchev <ddanchev@...tonmail.ch>)
[FD] Stored XSS in Advanced Custom Fields: Table Field allows authenticated users to do almost anything an admin user can (Wor… (dxw Security <security@....com>)
[FD] [CVE-2016-6600/1/2/3]: Multiple vulnerabilities (RCE, file download, etc) in WebNMS Framework 5.2 / 5.2 SP1 (Pedro Ribeiro <pedrib@...il.com>)
[FD] CVE-2016-6483 - vBulletin <= 5.2.2 Preauth Server Side Request Forgery (SSRF) (Dawid Golunski <dawid@...alhackers.com>)
[FD] Nagios Log Server Multiple Vulnerabilities (Francesco Oddo <francesco.oddo@...urity-assessment.com>)
[FD] Nagios Network Analyzer Multiple Vulnerabilities (Francesco Oddo <francesco.oddo@...urity-assessment.com>)
[FD] Nagios Incident Manager Multiple Vulnerabilities (Francesco Oddo <francesco.oddo@...urity-assessment.com>)
[FD] Directory Traversal Vulnerability in ColoradoFTP v1.3 Prime Edition (Build 8) ("Rv3Lab.org" <research@...lab.org>)
[FD] Zabbix 2.2.x, 3.0.x SQL Injection Vulnerability (1n3@...hmail.com)
[FD] RCE in Teamspeak 3 server (Hanz Jenson <xnq25hla@...il.com>)

August 15 (13 messages)

[FD] Stash v1.0.3 CMS - SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc BB #127 - 2FA Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows adding of images (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of galleries (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of images (Summer of Pwnage <lists@...urify.nl>)
[FD] Stored Cross-Site Scripting vulnerability in Photo Gallery WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Google Maps WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery vulnerability in Email Users WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Ajax Load More Local File Inclusion vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Link Library WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting in Magic Fields 2 WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting in Magic Fields 1 WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

August 16 (8 messages)

[FD] Actiontec T2200H (Telus Modem) Root Reverse Shell (Andrew Klaus <andrewklaus@...il.com>)
[FD] php-gettext php code execution in select_string, ngettext, npgettext count parameter <1.0.12 (crashenator@...il.com)
[FD] Executable installers are vulnerable^WEVIL (case 39): MalwareBytes' "junkware removal tool" allows escalation of p… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] German Cable Provider Router (In)Security (Sebastian Michel <s.michel@...net-systems.de>)
[FD] Taser Axon Dock (Body-Worn Camera Docking Station) v3.1 - Authentication Bypass (Reggie Dodd <reggie.dodd30@...il.com>)
Re: [FD] Zabbix 2.2.x, 3.0.x SQL Injection Vulnerability (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] Zabbix 2.2.x, 3.0.x SQL Injection Vulnerability (1n3@...hmail.com)
Re: [FD] Zabbix 2.2.x, 3.0.x SQL Injection Vulnerability (Brandon Perry <bperry.volatile@...il.com>)

August 18 (1 message)

[FD] Onapsis Security Advisory ONAPSIS-2016-006: SAP HANA Get Topology Information (Onapsis Research <research@...psis.com>)

August 19 (14 messages)

[FD] Onapsis Security Advisory ONAPSIS-2016-007: SAP HANA Password Disclosure (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-019: SAP TREX Remote Command Execution (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-020: SAP TREX Remote Directory Traversal (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-021: SAP TREX Remote file read (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-022: SAP TREX Arbitrary file write (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-025: SAP HANA arbitrary audit injection via SQL protocol (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-024: SAP HANA arbitrary audit injection via HTTP requests (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-026: SAP HANA SYSTEM user brute force attack (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-027: SAP HANA User information disclosure (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-033: SAP TREX TNS Information Disclosure in NameServer (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-034: SAP TREX remote command execution (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-037: SAP HANA Potential Remote Code Execution (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-040: SAP HANA potential wrong encryption (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-038: SAP HANA Information disclosure in EXPORT (Onapsis Research <research@...psis.com>)

August 20 (1 message)

[FD] Path traversal vulnerability in WordPress Core Ajax handlers (Summer of Pwnage <lists@...urify.nl>)

August 22 (14 messages)

[FD] ISPconfig v3.0.5.4 p6 - UI Exception & XSS Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] AVS Audio Converter 8.2.1 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] phpCollab v2.5 CMS - Privilege Escalate CSRF Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Jaws CMS v1.1.1 - Privilege Escalate CSRF Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] New BlackArch Linux ISOs (2016.08.19) released (Black Arch <blackarchlinux@...il.com>)
[FD] Faraday v2.0: Collaborative Penetration Test and Vulnerability Management Platform (Francisco Amato <famato@...obytesec.com>)
[FD] [CVE-2016-6582] Doorkeeper gem does not revoke tokens & uses wrong auth/auth method (Justin Bull <me@...tinbull.ca>)
Re: [FD] Onapsis Security Advisory ONAPSIS-2016-022: SAP TREX Arbitrary file write (Gary Baribault <gary@...ibault.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-038: SAP HANA Information disclosure in EXPORT ("Mevied, Matias" <mmevied@...psis.com>)
[FD] The continuing problem of a third party resources in web applications. (x ksi <s3810@...stk.edu.pl>)
[FD] New release: UFONet v0.7 - "Big Crunch!" (psy <epsylon@...eup.net>)
[FD] ObiHai ObiPhone - Multiple Vulnerabilities (David Tomaschik <davidtomaschik@...gle.com>)
[FD] Horizontal Privilege Escalation/Code Injection in ownCloud’s Windows Client (Florian Bogner <florian@...ner.sh>)
Re: [FD] Onapsis Security Advisory ONAPSIS-2016-022: SAP TREX Arbitrary file write (Onapsis Research <research@...psis.com>)

August 23 (3 messages)

Re: [FD] Onapsis Security Advisory ONAPSIS-2016-019: SAP TREX Remote Command Execution (Onapsis Research <research@...psis.com>)
Re: [FD] Onapsis Security Advisory ONAPSIS-2016-020: SAP TREX Remote Directory Traversal (Onapsis Research <research@...psis.com>)
Re: [FD] Onapsis Security Advisory ONAPSIS-2016-021: SAP TREX Remote file read (Onapsis Research <research@...psis.com>)

August 24 (5 messages)

[FD] NEW VMSA-2016-0013 - VMware Identity Manager and vRealize Automation updates address multiple security issues (VMware Security Response Center <security@v…)
[FD] Fortinet Product Series Vulnerabilities - CVE-2016-3196 CVE-2016-3195 CVE-2016-3194 & CVE-2016-3193 (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Dotclear 2.9.1 Directory Download Vulnerability (gen type <gen0typ3.n@...il.com>)
[FD] Dotclear 2.9.1 Malicious File Upload Restriction Bypass (gen type <gen0typ3.n@...il.com>)
[FD] Dotclear 2.9.1 SSRF/XSPA Vulnerability (gen type <gen0typ3.n@...il.com>)

August 25 (11 messages)

[FD] [RCESEC-2016-005][CVE-2016-6913] AlienVault USM/OSSIM 5.2 conf/reload.php "back" DOM-based Cross-Site Scripting (Julien Ahrens <info@...security.com>)
[FD] nullcon 8-bit Call for Papers is open (nullcon <nullcon@...lcon.net>)
[FD] SEC Consult SA-20160825-0 :: Multiple vulnerabilities in Micro Focus (Novell) GroupWise (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-009: JD Edwards JDENet Password Disclosure (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-010: JD Edwards Server Manager Shutdown (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-011: JD Edwards Server Manager Create users (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-012: JD Edwards JDENET function DoS (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-014: JD Edwards JDENET function DoS (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-00171: JD Edwards Server Manager Password Disclosure (Onapsis Research <research@...psis.com>)
[FD] APPLE-SA-2016-08-25-1 iOS 9.3.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-00171: JD Edwards Server Manager Password Disclosure (Matías Mevied <mmevied@...psis.com>)

August 26 (1 message)

[FD] Apple libc incomplete fix of Security Update for OS X El Capitan 10.11.2 ("[CXSEC]" <submit@...ec.org>)

August 30 (4 messages)

[FD] Onapsis Security Advisory ONAPSIS-2016-015: Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3439 (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-017: Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3436 (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-016: Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3437 (Onapsis Research <research@...psis.com>)
[FD] Onapsis Security Advisory ONAPSIS-2016-018: Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3438 (Onapsis Research <research@...psis.com>)

August 31 (2 messages)

[FD] SEC Consult SA-20160831-0 :: Manipulation of pre-boot authentication in CryptWare CryptoPro Secure Disk for Bitloc… (SEC Consult Vulnerability Lab <research…)
[FD] Executable installers are vulnerable^WEVIL (case 40): Aviras' full package installers allow escalation of privileg… ("Stefan Kanthak" <stefan.kanthak@...go.…)

139 messages

Powered by blists - more mailing lists