full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2017/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 29	²	³ 2	⁴	⁵ 4
⁶ 8	⁷ 7	⁸ 3	⁹	¹⁰ 9	¹¹	¹²
¹³	¹⁴ 4	¹⁵	¹⁶ 7	¹⁷ 4	¹⁸ 2	¹⁹
²⁰ 5	²¹ 2	²² 1	²³	²⁴ 11	²⁵	²⁶
²⁷ 7	²⁸ 9	²⁹ 3	³⁰	³¹ 2

Messages by day:

March 1 (29 messages)

[FD] Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field (Summer of Pwnage <lists@...urify.nl>)
[FD] Admin Custom Login WordPress plugin custom login page affected by persistent Cross-Site Scripting (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Trust Form WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in WP-Filebase Download Manager WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in WP-SpamFree Anti-Spam WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery in File Manager WordPress plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery in Global Content Blocks WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Gwolle Guestbook WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Simple Ads Manager WordPress plugin unauthenticated PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)
[FD] Persistent Cross-Site Scripting in the WordPress NewStatPress plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting vulnerability in Tribulant Slideshow Galleries WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery in WordPress Download Manager Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Gwolle Guestbook mass action vulnerable for Cross-Site Request Forgery (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery in Atahualpa WordPress Theme (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Atahualpa WordPress Theme (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Magic Fields 1 WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Scripting in Alpine PhotoTile for Instagram WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] VaultPress - Remote Code Execution via Man in The Middle attack (Summer of Pwnage <lists@...urify.nl>)
[FD] WordPress Adminer plugin allows public (local) database login (Summer of Pwnage <lists@...urify.nl>)
[FD] Popup by Supsystic WordPress plugin vulnerable to Cross-Site Request Forgery (Summer of Pwnage <lists@...urify.nl>)
[FD] Stored Cross-Site Scripting vulnerability in User Login Log WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Cross-Site Request Forgery & Cross-Site Scripting in Contact Form Manager WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
[FD] Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin (Summer of Pwnage <lists@...urify.nl>)
Re: [FD] Teradici Management Console 2.2.0 - Privilege Escalation (Jack Cha <jcha@...adici.com>)
[FD] Python + PostgreSQL pgAdmin4 – Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Veritas NetBackup v6.x, v7.x, v8.0 and NetBackup appliances v2.x, v3.0 - Multiple Critical Vulnerabilities (Sven Blumenstein <svbl@...gle.com>)
[FD] SEC Consult SA-20170301 :: XXE and XSS vulnerabilities in Aruba AirWave (SEC Consult Vulnerability Lab <research@...-consult.com>)

March 3 (2 messages)

[FD] New BlackArch Linux ISOs (2017.03.01) released! (Black Arch <blackarchlinux@...il.com>)
[FD] Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0 ("Larry W. Cashdollar" <larry0@...com>)

March 5 (4 messages)

[FD] Executable installers are defective^WEVIL (case 1): putty-0.68-installer.exe ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] Call for Papers for 5th Balkan Computer Congress – BalCCon2k17 (Milos Krasojevic <milobit@...ons.org>)
[FD] CVE-2017-6443: Persistent XSS in EPSON TMNet WebConfig Ver. 1.00 (Michael Benich <benichmt1@...tonmail.com>)
[FD] Remote code execution via CSRF vulnerability in the web UI of Deluge 1.3.13 (Kyle Neideck <kyle@...risdriving.com>)

March 6 (8 messages)

[FD] 0-Day: Dahua backdoor Generation 2 and 3 (bashis <mcw@...mail.eu>)
[FD] Executable installers are defective^WEVIL (case 2): innosetup-5.5.9.exe and innosetup-5.5.9-unicode.exe ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: [FD] 0-Day: Dahua backdoor Generation 2 and 3 (Chris Holland <frenchy@...il.com>)
[FD] CVE-2017-6429: Buffer overflow vulnerability in Tcpreplay tcpcapinfo utility (Aromal Raj <ddos2me@...il.com>)
[FD] OpenElec: Remote Code Execution Vulnerability through Man-In-The-Middle(CVE-2017-6445) (Wolfgang <lister@...dyourhead.at>)
[FD] CVE-2017-6430: Out-of-Bounds Read (DOS) Vulnerability in Ettercap Etterfilter utility (Aromal Raj <ddos2me@...il.com>)
[FD] Cross-Site Request Forgery in WordPress Press This function allows DoS (Summer of Pwnage <lists@...urify.nl>)
[FD] WordPress audio playlist functionality is affected by Cross-Site Scripting (Summer of Pwnage <lists@...urify.nl>)

March 7 (7 messages)

[FD] [Tool] Docker Scan: Security analysis tools for Docker Images and Docker Registries (cr0hn <cr0hn@...hn.com>)
Re: [FD] Executable installers are defective^WEVIL (case 2): innosetup-5.5.9.exe and innosetup-5.5.9-unicode.exe (fulldisclosure@...l.cat)
Re: [FD] 0-Day: Dahua backdoor Generation 2 and 3 (bashis <mcw@...mail.eu>)
[FD] Western Digital My Cloud vulnerable to multiple command injection vulnerabilities ("Securify B.V." <lists@...urify.nl>)
[FD] SEC Consult SA-20170307-0 :: Unauthenticated OS command injection & arbitrary file upload in Western Digital WD My… (SEC Consult Vulnerability Lab <research…)
[FD] Western Digital My Cloud vulnerable to Cross-Site Request Forgery vulnerability ("Securify B.V." <lists@...urify.nl>)
[FD] Stack-based buffer overflow in Western Digital My Cloud allows for remote code execution ("Securify B.V." <lists@...urify.nl>)

March 8 (3 messages)

[FD] Bypassing Authentication on iball Baton Routers (Indrajith AN <indu.an444@...il.com>)
[FD] Multiple vulnerabilities found in Wireless IP Camera (P2P) WIFICAM cameras and vulnerabilities in GoAhead (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] SEC Consult SA-20170308-0 :: Multiple vulnerabilities in Navetti PricePoint (SEC Consult Vulnerability Lab <research@...-consult.com>)

March 10 (9 messages)

[FD] SICUNET Physical Access Controller - Multiple Vulnerabilities (Andrew Griffiths <agriffiths+fd@...gle.com>)
[FD] FTP Voyager Scheduler v16.2.0 CSRF Remote Command Execution (hyp3rlinx <apparitionsec@...il.com>)
[FD] Bypassing Authentication on iball Baton Routers (Indrajith AN <indu.an444@...il.com>)
[FD] CVE-2017-6466 - Remote Code Execution under SYSTEM via MITM in F-Secure AV (Martin Kolárik <MartinKolarik@...look.com>)
[FD] Multiple vulnerabilities discovered in dnaLIMS DNA sequencing web-application (Nicholas von Pechmann <nicholas@...rebreaksecurity.com>)
[FD] Hardwear.io Call For Papers 2017 is open! (Yuliya Pliavaka <yuliya@...atu.com>)
[FD] CVE-2017-6550: Kinsey Infor-Lawson - Multiple SQL Injections (Michael Benich <benichmt1@...tonmail.com>)
[FD] DAVOSET v.1.3 ("MustLive" <mustlive@...security.com.ua>)
[FD] KL-001-2017-004 : WatchGuard XTMv User Management Cross-Site Request Forgery (KoreLogic Disclosures <disclosures@...elogic.com>)

March 14 (4 messages)

[FD] CVE-2017-6805 MobaXterm Personal Edition v9.4 Directory Traversal File Disclosure (hyp3rlinx <apparitionsec@...il.com>)
[FD] Aleph Research: Attacking Nexus 9 with Malicious Headphones (CVE-2017-0510) (Roee Hay <roee.hay@....com>)
[FD] URL spoofing in UC browser. (x ksi <s3810@...stk.edu.pl>)
[FD] Microsoft Edge Fetch API allows setting of arbitrary request headers ("Securify B.V." <lists@...urify.nl>)

March 16 (7 messages)

[FD] SEC Consult SA-20170316-0 :: Authenticated command injection in multiple Ubiquiti Networks products (SEC Consult Vulnerability Lab <research@...-consult.c…)
[FD] Microsoft Windows "LoadUvsTable()" Buffer Overflow Vulnerability (Hossein Lotfi <hossein.lotfi.all@...il.com>)
[FD] Windows DVD Maker XML External Entity File Disclosure (hyp3rlinx <apparitionsec@...il.com>)
[FD] Axis Camera Multiple Vulnerabilities (David Wearing <wearing@...gle.com>)
[FD] USB Pratirodh XML External Entity Injection Vulnerability (Sachin Wagh <wsachin092@...il.com>)
[FD] USB Pratirodh Insecure Password Storage Information Disclosure Vulnerability (Sachin Wagh <wsachin092@...il.com>)
[FD] Skype Insecure Library Loading Vulnerability (api-ms-win-core-winrt-string-l1-1-0.dll) (Sachin Wagh <wsachin092@...il.com>)

March 17 (4 messages)

[FD] phplist 3.2.6: SQL Injection ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] phplist 3.2.6: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] HumHub 1.0.1: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] HumHub 0.20.1 / 1.0.0-beta.3: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)

March 18 (2 messages)

[FD] [CVE-2017-6878]:MetInfo5.3.15 Stored Cross Site Scripting (陈彦羽 <callarice@....com>)
[FD] TS Session Hijacking / Privilege escalation all windows versions (Alexander Korznikov <nopernik@...il.com>)

March 20 (5 messages)

[FD] Cookie based privilege escalation in DIGISOL DG-HR1400 1.00.02 wireless router. (Indrajith AN <indu.an444@...il.com>)
Re: [FD] Remote code execution via CSRF vulnerability in the web UI of Deluge 1.3.13 (Thomas Deutschmann <whissi@...too.org>)
[FD] CVE-2017-7183 ExtraPuTTY v029_RC2 TFTP Denial Of Service (hyp3rlinx <apparitionsec@...il.com>)
Re: [FD] TS Session Hijacking / Privilege escalation all windows versions (Kevin Beaumont <kevin.beaumont@...il.com>)
Re: [FD] 0-Day: Dahua backdoor Generation 2 and 3 (bashis <mcw@...mail.eu>)

March 21 (2 messages)

Re: [FD] SEC Consult SA-20170316-0 :: Authenticated command injection in multiple Ubiquiti Networks products (Carlos Silva <r3pek@...ek.org>)
[FD] Adium vulnerable to remote code execution via libpurple (erythronium23 <erythronium23@...il.com>)

March 22 (1 message)

[FD] SEC Consult SA-20170322-0 :: Multiple vulnerabilities in Solare Datensysteme Solar-Log devices (SEC Consult Vulnerability Lab <research@...-consult.com>)

March 24 (11 messages)

[FD] [ERPSCAN-16-041] SAP NETWEAVER DIRECTORY CREATION OUTSIDE OF THE JVM (ERPScan inc <erpscan.online@...il.com>)
[FD] QNAP QTS Domain Privilege Escalation Vulnerability (Pasquale Fiorillo <info@...qualefiorillo.it>)
[FD] [CVE-2017-6087] EON 5.0 Remote Code Execution (Sydream Labs <labs@...dream.com>)
[FD] [CVE-2017-6088] EON 5.0 Multiple SQL Injection (Sydream Labs <labs@...dream.com>)
[FD] [CVE-2017-5869] Nuxeo Platform remote code execution (Sydream Labs <labs@...dream.com>)
[FD] APPLE-SA-2017-03-22-1 iTunes for Windows 12.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-03-22-2 iTunes for Mac 12.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Faraday v2.4: Collaborative Penetration Test and Vulnerability Management Platform (Francisco Amato <famato@...obytesec.com>)
[FD] Defense in depth -- the Microsoft way (part 46): no checks for common path handling errors in "Application Verifie… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Defense in depth -- the Microsoft way (part 47): "AppLocker bypasses are not serviced via monthly security roll-up… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] [CVE-2017-7240] Miele Professional PG 8528 - Web Server Directory Traversal (Jens Regel <jregel@...neider-wulf.de>)

March 27 (7 messages)

[FD] [FOXMOLE SA 2017-01-25] inoERP - Multiple Issues (FOXMOLE Advisories <advisories@...mole.com>)
[FD] pfsense 2.3.2: Code Execution ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] pfsense 2.3.2: XSS ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] pfsense 2.3.2: CSRF ("Curesec Research Team (CRT)" <crt@...esec.com>)
[FD] Vulnerabilities in Transcend Wi-Fi SD Card ("MustLive" <mustlive@...security.com.ua>)
[FD] APPLE-SA-2017-03-27-1 Pages 6.1, Numbers 4.1, and Keynote 7.1 for Mac; Pages 3.1, Numbers 3.1, and Keynote 3.1 for… (Apple Product Security <product-securit…)
[FD] CVE-2017-5900 (Luke Symons <rezkon93@...il.com>)

March 28 (9 messages)

[FD] DzSoft PHP Editor v4.2.7 File Enumeration [**UPDATED FIXED TYPO] (hyp3rlinx <apparitionsec@...il.com>)
[FD] Outlook Remote Crashing Bug (Haifei Li <haifei-non-reply@...look.com>)
Re: [FD] Vulnerabilities in Transcend Wi-Fi SD Card (Joey Kelly <joey@...ykelly.net>)
[FD] APPLE-SA-2017-03-27-2 Safari 10.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-03-27-4 iOS 10.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-03-27-5 watchOS 3.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-03-27-7 macOS Server 5.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-03-27-3 macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yose… (Apple Product Security <product-securit…)
Re: [FD] Defense in depth -- the Microsoft way (part 47): "AppLocker bypasses are not serviced via monthly security rol… ("Stefan Kanthak" <stefan.kanthak@...go.…)

March 29 (3 messages)

[FD] Hidden malicious modules in MS VBA (Visual Basic for Applications) ("Thegrideon Software" <info@...grideon.com>)
[FD] APPLE-SA-2017-03-28-1 iCloud for Windows 6.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-03-28-2 Additional information for APPLE-SA-2017-03-22-1 iTunes for Windows 12.6 (Apple Product Security <product-security-noreply@...ts.app…)

March 31 (2 messages)

[FD] Splunk Enterprise Information Theft - CVE-2017-5607 (hyp3rlinx <apparitionsec@...il.com>)
Re: [FD] Hidden malicious modules in MS VBA (Visual Basic for Applications (Douglas Held <risk@...glasheld.net>)

119 messages