full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹	² 3	³	⁴
⁵	⁶ 1	⁷	⁸ 13	⁹	¹⁰ 4	¹¹
¹² 5	¹³	¹⁴	¹⁵ 19	¹⁶	¹⁷	¹⁸
¹⁹ 4	²⁰ 3	²¹ 2	²² 1	²³ 2	²⁴	²⁵
²⁶	²⁷ 12	²⁸ 4	²⁹ 4	³⁰ 8

Messages by day:

September 2 (3 messages)

[FD] FormatFactory 3.9.0 - (.task) Stack Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Kaspersky Company Account - Response XSS Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Kaspersky Company Account - FileManager Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

September 6 (1 message)

[FD] SEC Consult SA-20160906-0 :: Private key for browser-trusted certificate embedded in multiple Aruba Networks / Alc… (SEC Consult Vulnerability Lab <research…)

September 8 (13 messages)

[FD] Picosmos Shows v1.6.0 - Stack Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PHPHolidays CMS v3.00.50 - Cross Site Scripting Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names (Summer of Pwnage <lists@...urify.nl>)
[FD] Unrar 0.0.1 Memory Corruption (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] Multiple vulnerabilities - Powerlogic/Schneider Electric IONXXXX series Smart Meters (Karn Ganeshen <karnganeshen@...il.com>)
[FD] ELNet Energy & Electrical Power Meter - Mulitple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Heap 'two-write-where-and-what' format string (FMS) technique (bashis <mcw@...mail.eu>)
[FD] Defense in depth -- the Microsoft way (part 43): restricting the DLL load order fails ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] cve request: Airmail URLScheme render and file:// xss vulnerability (redrain root <rootredrain@...il.com>)
[FD] CVE-2016-4264 Adobe ColdFusion <= 11 XXE Vulnerability (Dawid Golunski <dawid@...alhackers.com>)
[FD] CVE request - Samsumg Mobile Phone SVE-2016-6248: SystemUI Security issue (0xr0ot <0xr0ot.sec@...il.com>)
[FD] AST-2016-006: Crash on ACK from unknown endpoint ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2016-007: RTP Resource Exhaustion ("Asterisk Security Team" <security@...erisk.org>)

September 10 (4 messages)

[FD] Reflected Cross-Site Scripting vulnerability in MailPoet Newsletters plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Command injection in InfiniteWP Admin Panel (Summer of Pwnage <lists@...urify.nl>)
[FD] Authorization bypass in InfiniteWP Admin Panel (Summer of Pwnage <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting in Woocommerce WordPress plugin (Summer of Pwnage <lists@...urify.nl>)

September 12 (5 messages)

[FD] [oss-security] CVE request - Airmail URLScheme render and file:// xss vulnerability (redrain root <rootredrain@...il.com>)
[FD] Brute force every Samsung repair customer's info with ease (Justa Person <keepondoin@...il.com>)
[FD] CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Dawid Golunski <dawid@...alhackers.com>)
[FD] [RCESEC-2016-006] XenForo ToggleME 3.1.2 "/admin.php?options/list/toggleME" Multiple Persistent Cross-Site Scripting… (Julien Ahrens <info@...security.com>)
[FD] XSS found on www.google.fr (Sysdream Labs <labs@...dream.com>)

September 15 (19 messages)

[FD] APPLE-SA-2016-09-13-1 iOS 10 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-09-13-2 Xcode 8 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-09-13-3 watchOS 3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-09-14-1 iOS 10.0.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Re: [FD] Brute force every Samsung repair customer's info with ease (Nick <akarta315h@...il.com>)
Re: [FD] Brute force every Samsung repair customer's info with ease (Justa Person <keepondoin@...il.com>)
[FD] Security Advisory -- Multiple Vulnerabilities - MuM Map Edit (Paul Baade <Paul.Baade@...ec.tuv.com>)
Re: [FD] Brute force every Samsung repair customer's info with ease (Justa Person <keepondoin@...il.com>)
Re: [FD] CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Mark Koek <mark.koek@...ec.com>)
[FD] Keypatch v2.0 is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] Multiple vulnerabilities in ASUS RT-N10 ("MustLive" <mustlive@...security.com.ua>)
[FD] Insecure transmission of data in Android applications developed with Adobe AIR [CVE-2016-6936] (Nightwatch Cybersecurity <research@...htwatchcybersecurity…)
[FD] Peel Shopping 8.0.2: Object Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Kajona 4.7: XSS & Directory Traversal ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] MyBB 1.8.6: CSRF, Weak Hashing, Plaintext Passwords ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] MyBB 1.8.6: SQL Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] MyBB 1.8.6: Improper validation of data passed to eval ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Oxwall 1.8.0: XSS & Open Redirect ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] BINOM3 Electric Power Quality Meter Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)

September 19 (4 messages)

[FD] Segmentation fault in Oracle Outside In File ID 8.5.3 (Brandon Perry <bperry.volatile@...il.com>)
[FD] Facebook Privacy Issue - IRL Direct Human Reference ("Hicham A. Tolimat" <hicham@...imat.com>)
[FD] ShoreTel Connect ONSITE Blind SQL Injection Vulnerability ("Iraklis A. Mathiopoulos" <mathiopoulos@...il.com>)
[FD] Unrestricted Upload/RCE in Neosense theme for WordPress (Walter Hop <walter@...eforms.nl>)

September 20 (3 messages)

[FD] Critical Vulnerabilities in Sparkassen Bank Server discovered by German Security Researchers (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Joomla! session id not hashed. (Blazej Adamczyk <blazej.adamczyk@...il.com>)
[FD] Blind SQL Injection in Exponent CMS <= v2.3.9 (Manuel Garcia Cardenas <advidsec@...il.com>)

September 21 (2 messages)

[FD] XSS Wordpress W3 Total Cache <= 0.9.4.1 ("Fernando A. Lagos Berardi" <fernando@...ial.org>)
[FD] CVE-2016-5725 - JCraft/JSch Java Secure Channel <= 0.1.53 recursive sftp-get path traversal (client-side, windows) ("oststrom \(public\)" <pub@...strom.com…)

September 22 (1 message)

[FD] SEC Consult SA-20160922-0 :: Potential backdoor access through multiple vulnerabilities in Kerio Control Unified T… (SEC Consult Vulnerability Lab <research…)

September 23 (2 messages)

[FD] DllHijackAuditor 3.5 - Stack Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] 3GP Player 4.7.0 - DLL Hijacking Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

September 27 (12 messages)

[FD] Recon Europe 2017 Call For Papers - January 27 - 29, 2017 - Brussels, Belgium (cfpbrussels2017@...on.cx)
[FD] Call for Papers 0x7E0 hack4 in Berlin (Daniel Ashton <dash@...k4.org>)
Re: [FD] CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Dawid Golunski <dawid@...alhackers.com>)
[FD] Vulnerability Note VU#667480 - AVer EH6108H+ hybrid DVR contains multiple vulnerabilities ("Travis Lee" <eelsivart@...il.com>)
[FD] Welcome Faraday 2.1! Collaborative Penetration Test & Vulnerability Management Platform (Francisco Amato <famato@...obytesec.com>)
Re: [FD] XSS Wordpress W3 Total Cache <= 0.9.4.1 ("Fernando A. Lagos Berardi" <fernando@...ial.org>)
[FD] skype installer dll hijacking vulnerability - CVE-2016-5720 (Tien Phan <heart2heart.it@...il.com>)
[FD] [Adobe Flash] local-with-filesystem sandbox bypass via navigateToURL() and UI redressing (TRUEL IT | Leone Pontorieri <leone.pontorieri@...el.it>)
Re: [FD] CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Mark Koek <mark.koek@...ec.com>)
Re: [FD] CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Mark Koek <mark.koek@...ec.com>)
[FD] IE11 is not following CORS specification for local files (Ricardo Iramar dos Santos <riramar@...il.com>)
Re: [FD] XSS Wordpress W3 Total Cache <= 0.9.4.1 (Simon Rawet <sr@...post24.com>)

September 28 (4 messages)

[FD] Edward Snowden won Glas of Reason - (Glas der Vernunft) Award 2016 (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Multiple vulnerabilities found in the Dlink DWR-932B (backdoor, backdoor accounts, weak WPS, RCE ...) (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Symantec Messaging Gateway <= 10.6.1 Directory Traversal (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] [REVIVE-SA-2016-002] Revive Adserver - Multiple vulnerabilities (Matteo Beccati <matteo@...cati.com>)

September 29 (4 messages)

[FD] Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla ("Larry W. Cashdollar" <larry0@...com>)
[FD] Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla ("Larry W. Cashdollar" <larry0@...com>)
[FD] KeepNote 0.7.8 Remote Command Execution (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] Persistent XSS in Abus Security Center - CVSS 8.0 (Tim Schughart <t.schughart@...sec-networks.com>)

September 30 (8 messages)

[FD] Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6 ("Larry W. Cashdollar" <larry0@...com>)
[FD] [SYSS-2016-058] CHERRY B.UNLIMITED AES - Insufficient Verification of Data Authenticity (CWE-345) (Matthias Deeg <matthias.deeg@...s.de>)
[FD] [SYSS-2016-060] Logitech M520 - Insufficient Verification of Data Authenticity (CWE-345) (Matthias Deeg <matthias.deeg@...s.de>)
[FD] [SYSS-2016-061] PERIDUO-710W - Insufficient Verification of Data Authenticity (CWE-345) (Matthias Deeg <matthias.deeg@...s.de>)
[FD] Radioactive Mouse States the Obvious: Exploiting unencrypted and unauthenticated data communication of wireless mice (Matthias Deeg <matthias.deeg@...s.de>)
[FD] Multiple exposures in Sophos UTM (Tim Schughart <t.schughart@...sec-networks.com>)
[FD] Critical Vulnerability in Ubiquiti UniFi (Tim Schughart <t.schughart@...sec-networks.com>)
[FD] CompTIA Security+ and its insecure support system (<user09990@...a.io>)

85 messages