full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2017/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 1	²	³ 7	⁴ 13	⁵ 1	⁶	⁷ 1
⁸	⁹ 7	¹⁰ 7	¹¹ 6	¹² 1	¹³	¹⁴
¹⁵ 12	¹⁶ 7	¹⁷ 1	¹⁸ 1	¹⁹ 12	²⁰	²¹
²² 7	²³ 8	²⁴ 8	²⁵	²⁶	²⁷	²⁸
²⁹	³⁰ 8	³¹

Messages by day:

May 1 (1 message)

Re: [FD] SyntaxHighlight MediaWiki extension allows injection of arbitrary Pygments options ("Securify B.V." <lists@...urify.nl>)

May 3 (7 messages)

[FD] Super File Explorer 1.0.1 - Arbitrary File Upload Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Icecream v4.53 & Pro - File Permission Privilege Escalation (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Hola VPN v1.34 - Privilege Escalation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Joomla com_tag v1.7.6 - (tag) SQL Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Arachni v1.5-0.5.11 - Persistent Cross Site Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Zenario v7.6 - Persistent Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Zenario v7.6 - (Delete) Persistent Cross Site Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

May 4 (13 messages)

Re: [FD] Joomla com_tag v1.7.6 - (tag) SQL Injection Vulnerability (Brandon Perry <bperry.volatile@...il.com>)
Re: [FD] 360 security android app snoops data to China Unicom network via insecure HTTP (Daniel Wood <daniel.wood@...sp.org>)
[FD] [oss-security]Sourcetree arbitrary command execution (洪宇 <hongyu-s@....cn>)
[FD] [CVE-2017-6086] Multiple CSRF vulnerabilities in ViMbAdmin version 3.0.15 (Sysdream Labs <labs@...dream.com>)
[FD] [CVE-2017-5870] Multiple XSS vulnerabilities in ViMbAdmin (Sysdream Labs <labs@...dream.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Facebook Plugin SQL Injection Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Spider Event Calendar Plugin SQL Injection Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress WebDorado Gallery Plugin SQL Injection Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] SSD Advisory – Serviio Media Server Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] https://blogs.securiteam.com/index.php/archives/3171 (Maor Shwartz <maors@...ondsecurity.com>)
[FD] Aleph Research: Google Nexus 9 Cypress SAR Firmware Injection via I2C (CVE-2017-0563) (Roee Hay <roee.hay@....com>)
[FD] ES File Explorer android app snoops data to China Unicom network via insecure HTTP (seclists@...il.tg)
Re: [FD] 360 security android app snoops data to China Unicom network via insecure HTTP ("seclists@...il.tg" <seclists@...il.tg>)

May 5 (1 message)

[FD] Executable installers are vulnerable^Wdefective^WEVIL (case 49): xampp-win32-7.1.1-0-VC14-installer.exe allows esc… ("Stefan Kanthak" <stefan.kanthak@...go.…)

May 7 (1 message)

Re: [FD] 360 security android app snoops data to China Unicom network via insecure HTTP (Craig Young <vuln-report@...ur3.us>)

May 9 (7 messages)

[FD] CSRF in wordpress plugin clean login allows remote attacker change wordpress login redirect url or logout redirect ur… (Zeng Wester <evilzyzeng@...look.com>)
[FD] Aleph Research: Google Nexus 9 SensorHub Firmware Downgrade Vulnerability (CVE-2017-0582) (Roee Hay <roee.hay@....com>)
Re: [FD] 360 security android app snoops data to China Unicom network via insecure HTTP (seclists@...il.tg)
[FD] CSRF/Stored XSS in MSMC – Redirect After Comment could allow unauthenticated individuals to do almost anything (WordPress… (dxw Security <security@....com>)
[FD] Veritas Netbackup v8.0 - Multiple Vulnerabilities (Sven Blumenstein via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] SEC Consult SA-20170509-0 :: Multiple vulnerabilities in I, Librarian PDF manager (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Numerous FreeTDS crashes fixed on master (Brandon Perry <bperry.volatile@...il.com>)

May 10 (7 messages)

[FD] SEC Consult SA-20170510-0 :: Insecure Handling Of URI Schemes in Microsoft OneDrive iOS App (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] [CORE-2017-0001] - SAP SAPCAR Heap Based Buffer Overflow Vulnerability (Core Security Advisories Team <advisories@...esecurity.com>)
[FD] [FOXMOLE SA 2017-02-23] Dolibarr ERP & CRM - Multiple Issues (FOXMOLE Advisories <advisories@...mole.com>)
Re: [FD] Numerous FreeTDS crashes fixed on master (Brandon Perry <bperry.volatile@...il.com>)
[FD] QNAP PhotoStation 5.2.4 and MusicStation 4.8.4 Authentication Bypass (Kacper Szurek <kacperszurek@...il.com>)
[FD] Gemalto SmartDiag Diagnosis Tool <= v2.5 - Buffer Overflow - SEH Overwrite - Code Execution (Majid Alqabandi <majid@...host.com>)
[FD] Multiple Vulnerabilities in ASUS Routers [CVE-2017-5891 and CVE-2017-5892] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)

May 11 (6 messages)

[FD] SEC Consult SA-20170511-0 :: Stack-based buffer overflow vulnerability in Guidance Software EnCase Forensic Imager (SEC Consult Vulnerability Lab <research…)
Re: [FD] Numerous FreeTDS crashes fixed on master (Brandon Perry <bperry.volatile@...il.com>)
[FD] trashbilling.com and Trashflow 3.0.0 Multiple Issues (g00se--- via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Tracking Code Manager Plugin Multiple Security Vulnerabilities (DefenseCode <defensecode@...ensecode.com>)
[FD] DefenseCode WebScanner DAST Advisory: WordPress User Access Manager Plugin Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] DefenseCode ThunderScan SAST Advisory: GOOGLE google-api-php-client Multiple Security Vulnerabilities (DefenseCode <defensecode@...ensecode.com>)

May 12 (1 message)

[FD] CVE-2017-8798 - miniupnpc integer signedness error when parsing a chunked encoded http response ("oststrom \(public\)" <pub@...strom.com>)

May 15 (12 messages)

[FD] Multiple crashes in OpenEXR (Brandon Perry <bperry.volatile@...il.com>)
[FD] Mimosa Wireless Radios - RCE, DoS, and Local File Disclosure Vulnerabilities (Ian Ling via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Mailcow v0.14 CSRF Password Reset / Add Admin / Delete Domains (hyp3rlinx <apparitionsec@...il.com>)
[FD] APPLE-SA-2017-05-15-1 macOS 10.12.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-05-15-2 iOS 10.3.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-05-15-3 tvOS 10.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-05-15-4 watchOS 3.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-05-15-5 iCloud for Windows 6.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-05-15-6 iTunes 12.6.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-05-15-7 Safari 10.1.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] [CVE-2017-7953] Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields (Yoroi - CVE report <cve@...oi.company>)
[FD] [CVE-2017-7952] SQL injection in INFOR EAM V11.0 Build 201410 search fields (web/base/..) via filtervalue parameter (Yoroi - CVE report <cve@...oi.company>)

May 16 (7 messages)

[FD] Nextcloud/Owncloud - Reflected Cross Site Scripting in error pages (Manuel Mancera <sinkmanu@...il.com>)
[FD] PayPal Inc announces 2 new Bug Bounty Program Domains (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Mozilla Firefox v52.02 - (Stack Overflow) DoS Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] MikroTik RouterBoard v6.38.5 - Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wordpress EELV Newsletter v4.5 - Multiple Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Stealing Windows Credentials Using Google Chrome (DefenseCode <defensecode@...ensecode.com>)
[FD] Unpatched Mozilla Firefox v50 - v55 Stack Overflow DoS Vulnerability (geeknik via Fulldisclosure <fulldisclosure@...lists.org>)

May 17 (1 message)

Re: [FD] Cross-Site Request Forgery in WordPress Connection Information (Summer of Pwnage <lists@...urify.nl>)

May 18 (1 message)

[FD] SEC Consult SA-20170518-0 :: Multiple critical vulnerabilities in Western Digital TV Media Player (SEC Consult Vulnerability Lab <research@...-consult.com…)

May 19 (12 messages)

[FD] Belden Garrettcom 6K/10K Switches: Auth Bypasses, Memory Corruption (David Tomaschik via Fulldisclosure <fulldisclosure@...lists.org>)
Re: [FD] [oss-security] Dolibarr ERP & CRM - Multiple Issues (Stefan Pietsch <stefan.pietsch@...mole.com>)
Re: [FD] [oss-security] Dolibarr ERP & CRM - Multiple Issues (Brandon Perry <bperry.volatile@...il.com>)
[FD] [ERPSCAN-17-022] SSRF in PeopleSoft IMServlet (ERPScan inc <erpscan.online@...il.com>)
[FD] Ceragon FibeAir IP-10 Hidden User Backdoor (Ian Ling via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] SSD Advisory – Bitdefender Code Signing organizationName Buffer Overflow (Maor Shwartz <maors@...ondsecurity.com>)
[FD] WhatsApp (Android) Privacy Issues with Handling of Media Files [CVE-2017-8769] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] HP SiteScope 11.32: Unauthenticated JMX Console RCE (Harrison Neal <hneal@...tdidibreak.com>)
[FD] Google I/O 2017 Android App Doesn't Use SSL for Some Content [CVE-2017-9045] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] AST-2017-002: Buffer Overrun in PJSIP transaction layer ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2017-003: Crash in PJSIP multi-part body parser ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2017-004: Memory exhaustion on short SCCP packets ("Asterisk Security Team" <security@...erisk.org>)

May 22 (7 messages)

[FD] CFP - WPES - 2017 Workshop on Privacy in the Electronic Society (Bill Garrison <bill-cfp@...t.edu>)
[FD] CVE-2017-9046 Pegasus "winpm-32.exe" v4.72 Mailto: Link Remote Code Execution (hyp3rlinx <apparitionsec@...il.com>)
[FD] CVE-2017-9024 Secure Auditor - v3.0 Directory Traversal (hyp3rlinx <apparitionsec@...il.com>)
Re: [FD] CVE-2017-9024 Secure Auditor - v3.0 Directory Traversal (hyp3rlinx <apparitionsec@...il.com>)
[FD] CVE-2017-7620 Mantis Bug Tracker 1.3.10 / v2.3.0 CSRF Permalink Injection (hyp3rlinx <apparitionsec@...il.com>)
Re: [FD] [oss-security] Multiple crashes in OpenEXR (Brandon Perry <bperry.volatile@...il.com>)
[FD] HP SimplePass Local Privilege Escalation (Rehan Ahmed <knight_rehan@...mail.com>)

May 23 (8 messages)

[FD] Out of bound memory access in PJSIP multipart parser crashes Asterisk (Sandro Gauci <sandro@...blesecurity.com>)
[FD] Asterisk Skinny memory exhaustion vulnerability leads to DoS (Sandro Gauci <sandro@...blesecurity.com>)
[FD] Heap overflow in CSEQ header parsing affects Asterisk chan_pjsip and PJSIP (Sandro Gauci <sandro@...blesecurity.com>)
[FD] Wordpress Newsletter Supsystic 1.1.7 - Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Simple ASC CMS v1.2 - (Guestbook) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] HTTrack v3.x - Stack Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SEC Consult SA-20170523-0 :: Arbitrary File Upload & Stored XSS in InvoicePlane (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] [CORE-2017-0002] - Trend Micro ServerProtect Multiple Vulnerabilities (Core Security Advisories Team <advisories@...esecurity.com>)

May 24 (8 messages)

[FD] [CVE-2017-5868] OpenVPN Access Server : CRLF injection with Session fixation (Sydream Labs <labs@...dream.com>)
[FD] CVE-2017-8895 / VTS17-006: UAF in Veritas Backup Exec Remote Agent for Windows (Matthew Daley <mattd@...fuzz.com>)
[FD] Sunell IPR54/14AKDN(II)/13 IP Camera - Stored Cross-Site Scripting (Advisories <advisories@...pass-security.com>)
[FD] Sunell IPR54/14AKDN(II)/13 IP Camera - Reflected Cross-Site Scripting (Advisories <advisories@...pass-security.com>)
[FD] Sunell IPR54/14AKDN(II)/13 IP Camera - Session ID Enumeration (Advisories <advisories@...pass-security.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress All In One Schema.org Rich Snippets Plugin Security Vulnerability (DefenseCode <defensecode@...ensecode.co…)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Huge-IT Video Gallery Plugin Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress AffiliateWP Plugin Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)

May 30 (8 messages)

[FD] Hacktivity 2017 Call For Papers (Attila Marosi <attila.marosi@...ktivity.com>)
[FD] Faraday v2.5: Collaborative Penetration Test and Vulnerability Management Platform (Francisco Amato <famato@...obytesec.com>)
[FD] Multiple Local Privilege Escalation Vulnerabilities in Acunetix Web Vulnerability Scanner 11 (Florian Bogner <florian@...ner.sh>)
[FD] SSD Advisory – Trend Micro Deep Security Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – KEMP LoadMaster from XSS Pre Authentication to RCE (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – IBM Informix Dynamic Server and Informix Open Admin Tool Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] [CVE-2017-8782]Libming readString denial of service (吴栋 <qflb.wu@...ppsecurity.com.cn>)
[FD] Executable installers are vulnerable^WEVIL (case 51): escalation of privilege with Microsoft's Azure Recovery Ser… ("Stefan Kanthak" <stefan.kanthak@...go.…)

108 messages