full-disclosure mailing list - 2017/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2017/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
²	³	⁴ 11	⁵	⁶ 3	⁷ 2	⁸
⁹	¹⁰ 4	¹¹ 10	¹²	¹³ 5	¹⁴	¹⁵ 1
¹⁶ 3	¹⁷ 6	¹⁸ 1	¹⁹ 8	²⁰ 1	²¹	²² 2
²³ 11	²⁴ 3	²⁵ 3	²⁶ 1	²⁷ 2	²⁸ 3	²⁹
³⁰ 16	³¹ 4

Messages by day:

January 4 (11 messages)

[FD] Zend Framework / zend-mail < 2.4.11 Remote Code Execution (CVE-2016-10034) (Dawid Golunski <dawid@...alhackers.com>)
[FD] CINtruder v0.3 released... (psy <epsylon@...eup.net>)
[FD] Advisories Unsafe Dll in Audacity, telegram and Akamai (filipe <filipe.xavier@...pest.com.br>)
[FD] Persisted Cross-Site Scripting (XSS) in Confluence Jira Software (jlss <jodson.santos@...pest.com.br>)
[FD] 0-day: QNAP NAS Devices suffer of heap overflow (bashis <mcw@...mail.eu>)
Re: [FD] 0-day: QNAP NAS Devices suffer of heap overflow (bashis <mcw@...mail.eu>)
Re: [FD] 0-day: QNAP NAS Devices suffer of heap overflow (bashis <mcw@...mail.eu>)
[FD] Executable installers are vulnerable^WEVIL (case 43): SoftMaker's Office service pack installers allow escalation … ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Executable installers are vulnerable^WEVIL (case 45): ReadPDF's installers allow escalation of privilege ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] Persisted Cross-Site Scripting (XSS) in Confluence Jira Software (Moritz Naumann <moritz.naumann@...elievable-machine.com>)
[FD] Stop User Enumeration does not stop user enumeration (WordPress plugin) (dxw Security <security@....com>)

January 6 (3 messages)

Re: [FD] Persisted Cross-Site Scripting (XSS) in Confluence Jira Software (David Black <dblack@...assian.com>)
Re: [FD] Persisted Cross-Site Scripting (XSS) in Confluence Jira Software (jlss <jodson.santos@...pest.com.br>)
[FD] CarolinaCon-13 - May 2017 - Call for Papers/Presenters and Attendees (Vic Vandal <vvandal@...l.com>)

January 7 (2 messages)

[FD] Trango Altum AC600 Default root Login (Ian Ling <iancling@...il.com>)
[FD] YSTS 11th Edition - CFP (Luiz Eduardo <le@...s.org>)

January 10 (4 messages)

[FD] BSides Las Vegas 2017 CFP is open. (Daemon Tamer <cfp@...deslv.org>)
[FD] Hotlinking Vulnerability in PHProxy 0.5b2 (Celso Bento <celsobento2009@...il.com>)
[FD] enigma2-plugin-extensions-webadmin Remote Code Execution (IoT) (Fabian Fingerle <fabian@...ensalat.eu>)
[FD] pev 0.80 released (Fernando Mercês <nandu88@...il.com>)

January 11 (10 messages)

[FD] CSRF/XSS in Responsive Poll allows unauthenticated attackers to do almost anything an admin can (WordPress plugin) (dxw Security <security@....com>)
[FD] Docker 1.12.6 - Security Advisory (Nathan McCauley <nathan.mccauley@...ker.com>)
Re: [FD] [oss-security] Docker 1.12.6 - Security Advisory (Kurt Seifried <kseifried@...hat.com>)
[FD] Blackboard LMS 9.1 SP14 - (Profile) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] BlackBoard LMS 9.1 SP14 - (Title) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Bit Defender #39 - Auth Token Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Huawei Flybox B660 - (POST Reboot) CSRF Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Boxoft Wav v1.1.0.0 - Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Cobi Tools v1.0.8 iOS - Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] [oss-security] Docker 1.12.6 - Security Advisory (Andreas Stieger <astieger@...e.com>)

January 13 (5 messages)

[FD] [CVE-2016-3403] [Zimbra] Multiple CSRF in Administration interface - all versions (Sysdream Labs <labs@...dream.com>)
[FD] Multiple vulnerabilities in cPanel <= 60.0.34 ("Open Security" <open@...nsecurity.ca>)
[FD] ICMPv6 PTBs and IPv6 frag filtering (particularly at BGP peers) (Fernando Gont <fgont@...networks.com>)
[FD] nextcloud/owncloud user enumeration vulnerbility (Fabian Fingerle <fabian@...ensalat.eu>)
[FD] Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] (Dawid Golunski <dawid@...alhackers.com>)

January 15 (1 message)

[FD] Executable installers are vulnerable^WEVIL (case 44): SoftMaker's FlexiPDF installers allow escalation of privileg… ("Stefan Kanthak" <stefan.kanthak@...go.…)

January 16 (3 messages)

[FD] Huawei Flybox B660 - (POST SMS) CSRF Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Salesforce (Event Registration) - Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Apple (iTunes Notify) - Filter Bypass & Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 17 (6 messages)

[FD] Security BSides Ljubljana 0x7E1 CFP - March 10, 2017 (Andraz Sraka <a@...bix.org>)
[FD] New exploit for new vulnerability in WordPress Plugin + tutorial ("Diego" <diego@...goceldran.es>)
[FD] Multiple RCE in ZyXEL / Billion / TrueOnline routers (Pedro Ribeiro <pedrib@...il.com>)
[FD] Reflected Cross-Site Scripting (XSS) in Atlassian Jira Software (Roberto Soares <roberto.soares@...pest.com.br>)
[FD] EuskalHack Security Congress CFP (Joxean Koret <joxeankoret@...oo.es>)
[FD] SEC Consult SA-20170117-0 :: XSS in Recommend Page extension for TYPO3 CMS (pb_recommend_page) (SEC Consult Vulnerability Lab <research@...-consult.com>)

January 18 (1 message)

[FD] Announce Keypatch v2.1, a better assembler for IDA Pro! (Nguyen Anh Quynh <aquynh@...il.com>)

January 19 (8 messages)

[FD] APPLE-SA-2017-01-18-1 GarageBand 10.1.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-01-18-2 Logic Pro X 10.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] [ERPSCAN-16-036] SAP ASE ODATA SERVER - DENIAL OF SERVICE (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-16-037] SAP NetWeaver AS JAVA P4 - INFORMATION DISCLOSURE (ERPScan inc <erpscan.online@...il.com>)
[FD] CALL FOR PAPERS - br3aking c0de (Estación Informática <franciscojaviersantiagovazquez@...il.com>)
[FD] Persistent XSS in Ghost 0.11.3 (Patrick <patrick.costa@...pest.com.br>)
[FD] [RCESEC-2016-012] Mattermost <= 3.5.1 "/error" Unauthenticated Reflected Cross-Site Scripting / Content Injection (Julien Ahrens <info@...security.com>)
[FD] Tap 'n' Sniff ("Curesec Research Team (CRT)" <crt@...esec.com>)

January 20 (1 message)

[FD] Apple iOS 10.2 (Notify - iTunes) - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 22 (2 messages)

[FD] Executable installers are vulnerable^WEVIL (case 46): Pelles C allows arbitrary code execution ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability] (Taoguang Chen <taoguangchen@...il.com>)

January 23 (11 messages)

[FD] RVAsec 2017 Call for Presentations (Sullo <sullo@...t.net>)
[FD] [ERPSCAN-17-005] Oracle PeopleSoft - XSS vulnerability CVE-2017-3300 (ERPScan inc <erpscan.online@...il.com>)
[FD] CVE-2017-3241 - [ERPSCAN-17-006] Oracle OpenJDK - Java Serialization DoS (ERPScan inc <erpscan.online@...il.com>)
[FD] APPLE-SA-2017-01-23-1 iOS 10.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-01-23-2 macOS 10.12.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-01-23-3 watchOS 3.1.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-01-23-4 tvOS 10.1.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-01-23-5 Safari 10.0.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-01-23-6 iCloud for Windows 6.1.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 46): Pelles C allows arbitrary code execution (Ding Dong <dingdongloop@...il.com>)
[FD] New mailing-list on IoT hacking (Fernando Gont <fgont@...networks.com>)

January 24 (3 messages)

[FD] WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass (Kacper Szurek <kacperszurek@...il.com>)
[FD] APPLE-SA-2017-01-23-7 iTunes for Windows 12.5.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
Re: [FD] Executable installers are vulnerable^WEVIL (case 46): Pelles C allows arbitrary code execution ("Stefan Kanthak" <stefan.kanthak@...go.de>)

January 25 (3 messages)

[FD] Google Forms WordPress Plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] CMS Commander Client WordPress Plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] InfiniteWP Client WordPress Plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)

January 26 (1 message)

[FD] Call for Papers: DigitalSec2017 in Kuala Lumpur, Malaysia on July 11-13, 2017 (Sandra Evans <sandra.sdiwc@...il.com>)

January 27 (2 messages)

[FD] Digital Ocean ssh key authentication security risk -- password authentication is re-enabled (Daniel Elebash <danelebash@...mail.com>)
[FD] Privilege Escalation in VirtualBox (CVE-2017-3316) (Wolfgang <lister@...dyourhead.at>)

January 28 (3 messages)

[FD] Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification (Summer of Pwnage <lists@...urify.nl>)
[FD] Multiple blind SQL injection vulnerabilities in FormBuilder WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting vulnerability in User Access Manager WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)

January 30 (16 messages)

[FD] SEC Consult SA-20170130-0 :: XSS & CSRF in multiple Ubiquiti Networks products (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] New BlackArch Linux ISOs (2017.01.28) released! (Black Arch <blackarchlinux@...il.com>)
[FD] BSidesHannover 2017! (Daniel Busch <bsideshannover2017@...il.com>)
[FD] secuvera-SA-2017-01: Privilege escalation in an OPSI Managed Client environment ("rise of the machines") (Simon Bieber <sbieber@...uvera.de>)
Re: [FD] Announcing NorthSec 2017 CFP + Reg - Montreal, May 16-21 (Olivier Bilodeau <olivier@...tomlesspit.org>)
Re: [FD] Digital Ocean ssh key authentication security risk -- password authentication is re-enabled (gp@...rent.net)
Re: [FD] Digital Ocean ssh key authentication security risk -- password authentication is re-enabled (Daniel Elebash <danelebash@...mail.com>)
[FD] Free ebook to learn ethical hacking techniques (Sparc Flow <sparc.flow@...tonmail.com>)
[FD] Sophos Web Appliance - Block & Unblock IPs Remote Command Injection (CVE-2016-9553) (Russell Sanford <russell.sanford@...ticalstart.com>)
Re: [FD] [0-day] RCE and admin credential disclosure in NETGEAR WNR2000 (Pedro Ribeiro <pedrib@...il.com>)
[FD] Hacking Printers Advisory 1/6: PostScript printers vulnerable to print job capture (Jens Müller <jens.a.mueller@....de>)
[FD] Hacking Printers Advisory 2/6: Various HP/OKI/Konica printers file/password disclosure via PostScript/PJL (Jens Müller <jens.a.mueller@....de>)
[FD] Hacking Printers Advisory 5/6: HP printers restoring factory defaults through PML commands (Jens Müller <jens.a.mueller@....de>)
[FD] Hacking Printers Advisory 4/6: Multiple vendors buffer overflow in LPD daemon and PJL interpreter (Jens Müller <jens.a.mueller@....de>)
[FD] Hacking Printers Advisory 3/6: Brother printers vulnerable to memory access via PJL commands (Jens Müller <jens.a.mueller@....de>)
[FD] Hacking Printers Advisory 6/6: Multiple vendors physical NVRAM damage via PJL commands (Jens Müller <jens.a.mueller@....de>)

January 31 (4 messages)

[FD] PEAR Base System v1.10.1 Arbitrary File Download (hyp3rlinx <apparitionsec@...il.com>)
[FD] [REVIVE-SA-2017-001] Revive Adserver - Multiple vulnerabilities (Matteo Beccati <matteo@...cati.com>)
Re: [FD] [0-day] RCE and admin credential disclosure in NETGEAR WNR2000 (Netgear Security <security@...gear.com>)
[FD] Executable installers are vulnerable^WEVIL (case 47): Heimdal Security's SetupLauncher vulnerable to DLL hijacking ("Stefan Kanthak" <stefan.kanthak@...go.…)

100 messages

Powered by blists - more mailing lists