full-disclosure mailing list - 2017/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2017/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 6	⁴ 19	⁵	⁶ 6	⁷ 13	⁸	⁹ 6
¹⁰	¹¹ 13	¹² 6	¹³	¹⁴ 2	¹⁵	¹⁶
¹⁷ 3	¹⁸ 1	¹⁹	²⁰ 1	²¹ 15	²² 1	²³
²⁴ 6	²⁵ 8	²⁶	²⁷	²⁸ 2	²⁹ 3	³⁰ 3

Messages by day:

April 3 (6 messages)

[FD] SEC Consult SA-20170403-0 :: Misbehavior of PHP fsockopen function (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Trend Micro Enterprise Mobile Security Android Application - MITM SSL Certificate Vulnerability (CVE-2016-9319) (David Coomber <davidcoomber.infosec@...il…)
[FD] CVE-2017-7239: ninka license identification tool: insufficient escaping of external input [vs] (Dirk-Willem van Gulik <dirkx@...weaving.org>)
[FD] CVE Request -- mapr: information disclosure vulnerability (Mark Felder <feld@...d.me>)
[FD] Cross-site request forgery (CSRF) vulnerability in the D-Link (DIR 615 ) Wireless Router Firmware:20.09 (pratik shah <pratik.mhaswadkar@...il.com>)
[FD] APPLE-SA-2017-04-03-1 iOS 10.3.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)

April 4 (19 messages)

[FD] AST-2017-001: Buffer overflow in CDR's set user ("Asterisk Security Team" <security@...erisk.org>)
[FD] Dell OpenManage Server Administrator v8.4: CVE-2016-4004 Addendum (Harrison Neal <hneal@...tdidibreak.com>)
[FD] CVE-2017-7185 - Mongoose OS - Use-after-free / Denial of Service (Advisories <advisories@...pass-security.com>)
[FD] ManageEngine Applications Manager Multiple Vulnerabilities (ljj <ljj@...eu>)
[FD] Inchoo Facebook Connect Extension for Magento Parameter XSS (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Manhattan Software IWMS (Integrated Workplace Management System) XML External Entity (XXE) Injection File Disclosu… (Patrick Webster via Fulldisclosure <ful…)
[FD] AirWatch Self Service Portal Username Parameter LDAP Injection (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Avaya Radvision SCOPIA Desktop dlg_loginownerid.jsp ownerid SQL Injection (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Lotus Protector for Mail Security remote code execution (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Kaseya VSA 6.5 Parameter Reflected XSS, Enumeration and Bruteforce Weakness (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Computer Associates API Gateway CRLF Response Splitting, Directory Traversal vulnerabilities (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.…)
[FD] Tweek!DM Document Management Authentication bypass, SQL injection (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] SilverStripe CMS - Path Disclosure (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] SmartJobBoard - Cross-site scripting, personal information disclosure and PHPMailer package (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.o…)
[FD] AcoraCMS browser redirect and Cross-site scripting vulnerabilities (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Kaseya information disclosure vulnerability (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] iPlatinum iOneView Multiple Parameter Reflected XSS (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Moodle URL Manipulation Remote Account Information Disclosure (Patrick Webster via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] DefenseCode ThunderScan SAST Advisory: Apache Tomcat Directory/Path Traversal (DefenseCode <defensecode@...ensecode.com>)

April 6 (6 messages)

[FD] Spiceworks 7.5 TFTP Improper Access Control File Overwrite / Upload (hyp3rlinx <apparitionsec@...il.com>)
[FD] Apple Music Android Application - MITM SSL Certificate Vulnerability (CVE-2017-2387) (David Coomber <davidcoomber.infosec@...il.com>)
[FD] QNAP QTS multiple RCE vulnerabilities (CVE-2017-6361, CVE-2017-6360, CVE-2017-6359) (Harry Sintonen <fulldisclosure@...er.fi>)
[FD] APPLE-SA-2017-04-04-1 Apple Music 2.0 for Android (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] CSRF/stored XSS in WordPress Firewall 2 allows unauthenticated attackers to do almost anything an admin can (WordPress plu… (dxw Security <security@....com>)
[FD] [DefenseCode WhitePaper]: BroadCom UPnP Format String Preauth Root Exploit Aftermath (Few Years Later) (DefenseCode <defensecode@...ensecode.com>)

April 7 (13 messages)

[FD] SEC Consult SA-20170407-0 :: Server-Side Request Forgery in MyBB forum (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] DAVOSET v.1.3.1 ("MustLive" <mustlive@...security.com.ua>)
[FD] Executable installers are vulnerable^WEVIL (case 49): 1Password-4.6.1.619.exe allows arbitrary code execution ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[FD] [DefenseCode WhitePaper]: BroadCom UPnP Format String Preauth Root Exploit Aftermath (Few Years Later) (DefenseCode <defensecode@...ensecode.com>)
[FD] LAquis SCADA Access Control Vulnerability (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Sielco Sistemi Winlog SCADA Software Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
[FD] SenNet Data Logger appliances and Electricity Meters Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Cambium SNMP Security Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] Carlo Gavazzi VMUC-EM - Multiple Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] DragonWave Horizon Hard-coded Credentials Vulnerability (multiple versions) (Ian Ling <iancling@...il.com>)
[FD] CVE Request:Mutiple CSRF vulnerabilities in e107 CMS 2.1.4 (Wester 95 <evilzyzeng@...look.com>)
[FD] CVE Request:Multiple CSRF in WordPress WHIZZ allow attackers to delete any wordpress users and change plugins status (Wester 95 <evilzyzeng@...look.com>)
[FD] CVE Request:CSRF in wordpress copysafe web allows attacker changes plugin settings (Wester 95 <evilzyzeng@...look.com>)

April 9 (6 messages)

[FD] WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] CVE-Request:stored XSS in Serendipity v2.1-rc1 allows attacker steals admin’s cookie and other informations (Wester 95 <evilzyzeng@...look.com>)
[FD] NSE script for exploiting BOF in Microsoft's IIS 6.0 and Windows Server 2003 (Rewanth Cool <ravatheruler4@...il.com>)
[FD] NSE Script for exploiting Directory traversal vulnerability in Wordpress (Rewanth Cool <ravatheruler4@...il.com>)
[FD] NSE scripts for XSS and session hijacking in AsusWRT (Rewanth Cool <ravatheruler4@...il.com>)
[FD] NSE Script for CVE 2017-6527 (Rewanth Cool <ravatheruler4@...il.com>)

April 11 (13 messages)

[FD] Moxa MXview v2.8 Remote Private Key Disclosure (hyp3rlinx <apparitionsec@...il.com>)
[FD] CVE-2017-7456 MXview v2.8 Denial Of Service (hyp3rlinx <apparitionsec@...il.com>)
[FD] Moxa MX AOPC-Server v1.5 XML External Entity (hyp3rlinx <apparitionsec@...il.com>)
[FD] CVE Request:CSRF in Serendipity allows attacker installs any themes (Wester 95 <evilzyzeng@...look.com>)
[FD] CVE Request:XSS Injection in Email MyCode (MyBB <1.8.11) (Wester 95 <evilzyzeng@...look.com>)
[FD] CVE Request:Directory Traversal in smilie module(MyBB <1.8.11) (Wester 95 <evilzyzeng@...look.com>)
[FD] CVE-2017-7643 Local root privesc in Proxifier for Mac <= 2.18 ("Mark Wadham" <fd@....io>)
[FD] SSD Advisory – Horde Groupware Webmail Multiple Remote Code Execution Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] [SYSS-2015-035] Password Safe and Repository Enterprise v7.4.4 - SQL Injection (CWE-89) (Matthias Deeg <matthias.deeg@...s.de>)
[FD] [SYSS-2015-036] Password Safe and Repository Enterprise v7.4.4 - Violation of Secure Design Principles (CWE-657) (Matthias Deeg <matthias.deeg@...s.de>)
[FD] ChromeOS / ChromeBooks Persist Certain Network Settings in Guest Mode (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] Multiple local privilege escalation vulnerabilities in Proxifier for Mac ("Securify B.V." <lists@...urify.nl>)
[FD] Microsoft Office OneNote 2007 DLL side loading vulnerability ("Securify B.V." <lists@...urify.nl>)

April 12 (6 messages)

[FD] c0c0n X August 17-19, 2017 Call for Papers Open (Prajwal Panchmahalkar <prajwal.hy468@...il.com>)
[FD] Proxifier for Mac 2.19 local root privesc ("Mark Wadham" <fd@....io>)
Re: [FD] CVE-2017-7643 Local root privesc in Proxifier for Mac <= 2.18 ("Mark Wadham" <fd@....io>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Tribulant Slideshow Gallery Plugin - Cross-Site Scripting Vulnera… (DefenseCode <defensecode@...ensecode.co…)
[FD] DefenseCode ThunderScan SAST Advisory: 53+ WordPress plugins by BestWebSoft Multiple Cross-Site Scripting (XSS) Vu… (DefenseCode <defensecode@...ensecode.co…)
[FD] DefenseCode Security Advisory: Magento 0day Arbitrary File Upload Vulnerability (Remote Code Execution, CSRF) (DefenseCode <defensecode@...ensecode.com>)

April 14 (2 messages)

[FD] Adobe Creative Cloud Desktop Application <= v4.0.0.185 Privilege Escalation (hyp3rlinx <apparitionsec@...il.com>)
[FD] Persistent Cross-Site Scripting in Scriptler Jenkins Plugin ("Securify B.V." <lists@...urify.nl>)

April 17 (3 messages)

[FD] CVE-2017-0199 PoC (David ROUTIN <david@...urity-on.com>)
Re: [FD] [SYSS-2015-036] Password Safe and Repository Enterprise v7.4.4 - Violation of Secure Design Principles (CWE-657) (Nick Boyce <nick.boyce@...il.com>)
[FD] Mantis Bug Tracker v1.3.0 / 2.3.0 Pre-Auth Remote Password Reset (hyp3rlinx <apparitionsec@...il.com>)

April 18 (1 message)

[FD] SSD Advisory – Ubuntu LightDM Guest Account Local Privilege Escalation (Maor Shwartz <maors@...ondsecurity.com>)

April 20 (1 message)

[FD] Cross-Site Request Forgery in WordPress Connection Information (Summer of Pwnage <lists@...urify.nl>)

April 21 (15 messages)

[FD] Unicorn Emulator v1.0.1 is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] nt!_SEP_TOKEN_PRIVILEGES – Single Write EoP Protect (Kyriakos Economou <arfproject@...mail.com>)
[FD] [ERPSCAN-17-020] XXE VIA DOCTYPE in PeopleSoft PeopleSoftServiceListeningConnector (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-17-021] SQL Injection in E-Business Suite IESFOOTPRINT (ERPScan inc <erpscan.online@...il.com>)
[FD] [ERPSCAN-17-022] SSRF in PeopleSoft IMServlet (ERPScan inc <erpscan.online@...il.com>)
[FD] SecretServerSecretStealer - An extraction utility for Thycotic Secret Server (Denis Andzakovic <denis.andzakovic@...urity-assessment.com>)
[FD] Code Injection through DLL Sideloading in 64bit Oracle Java (Florian Bogner <florian@...ner.sh>)
[FD] CVE-2017-7991-SQL injection-Exponent CMS ("404 Not Found" <root@...notfound.org>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress AccessPress Social Icons Plugin Multiple SQL injection Security V… (DefenseCode <defensecode@...ensecode.co…)
[FD] DefenseCode ThunderScan SAST Advisory: Ultimate Form Builder Cross-Site Scripting (XSS) Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Filippo Cavallarin <filippo.cavallarin@...resegment.com>)
Re: [FD] CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Dawid Golunski <dawid@...alhackers.com>)
Re: [FD] CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Filippo Cavallarin <filippo.cavallarin@...resegment.com>)
Re: [FD] CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Dawid Golunski <dawid@...alhackers.com>)
Re: [FD] CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Filippo Cavallarin <filippo.cavallarin@...resegment.com>)

April 22 (1 message)

[FD] Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges ("Securify B.V." <lists@...urify.nl>)

April 24 (6 messages)

[FD] Tales of SugarCRM Security Horrors (Egidio Romano <research@...mainsecurity.com>)
[FD] KL-001-2017-005 : Solarwinds LEM Privilege Escalation via Controlled Sudo Path (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-006 : Solarwinds LEM Privilege Escalation via Sudo Script Abuse (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-007 : Solarwinds LEM Management Shell Escape via Command Injection (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-008 : Solarwinds LEM Management Shell Arbitrary File Read (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-009 : Solarwinds LEM Database Listener with Hardcoded Credentials (KoreLogic Disclosures <disclosures@...elogic.com>)

April 25 (8 messages)

[FD] CVE-2017-7221. OpenText Documentum Content Server: arbitrary code execution in dm_bp_transition.ebs docbase method ("Andrey B. Panfilov" <andrew@...filov.t…)
[FD] OXATIS 'EMail' Cross Site Scripting Vulnerability ("HTTPCS" <contact@...pcs.com>)
[FD] Flyspray 'real_name' Cross Site Scripting Vulnerability ("HTTPCS" <contact@...pcs.com>)
Re: [FD] CVE-2017-7692: Squirrelmail 1.4.22 Remote Code Execution (Dawid Golunski <dawid@...alhackers.com>)
[FD] Samsung Smart TV Wi-Fi Direct Improper Authentication (Info <info@...eso.com>)
[FD] Dell Customer Connect 1.3.28.0 Privilege Escalation (Kacper Szurek <kacperszurek@...il.com>)
[FD] SSD Advisory – HPE OpenCall Media Platform (OCMP) Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SEC Consult SA-20170425-0 :: Portrait Display SDK Service Privilege Escalation (SEC Consult Vulnerability Lab <research@...-consult.com>)

April 28 (2 messages)

[FD] Security Issues in Alerton Webtalk (Auth Bypass, RCE) (David Tomaschik via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Apple iOS 10.2 & 10.3 - Control Panel Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

April 29 (3 messages)

[FD] Multiple local privilege escalation vulnerabilities in HideMyAss Pro VPN client v2.x for OS X ("Securify B.V." <lists@...urify.nl>)
[FD] Local privilege escalation vulnerability in HideMyAss Pro VPN client v3.x for macOS ("Securify B.V." <lists@...urify.nl>)
[FD] SyntaxHighlight MediaWiki extension allows injection of arbitrary Pygments options ("Securify B.V." <lists@...urify.nl>)

April 30 (3 messages)

[FD] CVE-2017-7981: Tuleap Remote OS Command Injection (Ben N <pajexali@...il.com>)
[FD] PRL and CSRF vulnerabilities in D-Link DAP-1360 ("MustLive" <mustlive@...security.com.ua>)
[FD] 360 security android app snoops data to China Unicom network via insecure HTTP (seclists@...il.tg)

114 messages

Powered by blists - more mailing lists