full-disclosure mailing list - 2017/09

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2017/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 12	²	³
⁴ 3	⁵ 7	⁶	⁷	⁸ 12	⁹	¹⁰
¹¹	¹² 5	¹³ 2	¹⁴ 2	¹⁵ 6	¹⁶	¹⁷ 1
¹⁸	¹⁹ 6	²⁰	²¹ 11	²² 1	²³	²⁴
²⁵ 1	²⁶ 16	²⁷ 3	²⁸	²⁹ 22	³⁰

Messages by day:

September 1 (12 messages)

[FD] Lexmark Scan to Network (SNF) printer application <= 3.2.9 Information Exposure (Daniel Correa <admin@...focol.org>)
[FD] New BlackArch Linux ISOs (2017.08.30) released! (Black Arch <blackarchlinux@...il.com>)
[FD] [ICS] Schneider Electric Pro-Face WinGP – Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] Solar Controls WATTConfig M Software – Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] Solar Controls Heating Control Downloader – Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] SIMPlight SCADA software – Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] SpiderControl SCADA Web Server – Directory Traversal Vulnerability (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] SpiderControl SCADA MicroBrowser – Stack Buffer Overflow Vulnerability (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] Schneider Electric Trio TView – vulnerable JRE versions in use (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] Moxa SoftNVR-IA Live Viewer – Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] AzeoTech DAQFactory – Insecure Default Permissions and Insecure Library Loading Allows Code Execution (Karn Ganeshen <karnganeshen@...il.com>)
Re: [FD] libmad memory corruption vulnerability (Timo Teras <timo.teras@....fi>)

September 4 (3 messages)

[FD] WpJobBoard v4.5.1 - Multiple Cross Site Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Wibu Systems AG CodeMeter 6.50 - Persistent XSS Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Play TV v1.25.1(Build r123776) - DLL Hijack Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

September 5 (7 messages)

[FD] CVE-2017-11567 Mongoose Web Server v6.5 CSRF Command Execution (hyp3rlinx <apparitionsec@...il.com>)
[FD] DNSMap.sh - 0.1 - enumerate DNS hostnames faster | release announcement. (Levi Shahar <bindh3x@...il.com>)
[FD] "VirusTotal Windows Uploader" poor design of privacy (Eitan Caspi via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Hijacking .uk domains with eNom (Joseph Harris <j@...r>)
[FD] SEC-T 0x0Anniversary Con next week (mattias bååth via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Authentication Bypass in Xerox Printers – It is not a bug! It is a legacy feature ;-) (Peter Weidenbach <peter.weidenbach@...e.fraunhofer.de>)
[FD] Asterisk vulnerable to RTP Bleed (Sandro Gauci <sandro@...blesecurity.com>)

September 8 (12 messages)

[FD] Aerohive HiveManager Classic privilege escalation and auth code execution vulnerability ("Sandro \"guly\" Zaccarini" <guly@...y.org>)
[FD] CVE-2017-11567 Mongoose Web Server v6.5 CSRF Command Execution (John Page <hyp3rlinx@...il.com>)
[FD] Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] EE 4GEE Multiple Security Vulnerabilities Advisory (CSRF/Stored XSS/JSONP) ("James Hemmings (Security)" <security@...eshemmings.co.uk>)
[FD] ESA-2017-099: EMC AppSync SQL Injection Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] SSD Advisory – Oracle Java and Apache Xerces PDF/Docx Server Side DoS (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Remote Command Execution in Western Digital with Dropbox App (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – ScrumWorks Pro Remote Code Execution (Maor Shwartz <maors@...ondsecurity.com>)
[FD] Hack2Win – Code Blue 3rd Edition (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Polycom Memory Disclosure (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – WiseGiga NAS Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote Command Execution (Maor Shwartz <maors@...ondsecurity.com>)

September 12 (5 messages)

[FD] SSD Advisory – Hanbanggaoke IP Camera Arbitrary Password Change (Maor Shwartz <maors@...ondsecurity.com>)
[FD] Access control bypass in Hikvision IP Cameras (Monte Crypto <mc_noreply@...lfence.com>)
[FD] How Apple fixed my 2008's hole in their browser after 9 years ("MustLive" <mustlive@...security.com.ua>)
[FD] R.I.P. Kaspersky Privacy Cleaner: withdrawn due to multiple begiinner's errors which allow escalation of privilege ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] SEC Consult SA-20170912-0 :: Email verification bypass in SAP E-Recruiting (SEC Consult Vulnerability Lab <research@...-consult.com>)

September 13 (2 messages)

[FD] SEC Consult SA-20170913-0 :: Multiple Vulnerabilities in IBM Infosphere Information Server / Datastage (SEC Consult Vulnerability Lab <research@...-consul…)
[FD] SEC Consult SA-20170913-1 :: Local File Disclosure in VLC media player iOS app (SEC Consult Vulnerability Lab <research@...-consult.com>)

September 14 (2 messages)

[FD] SEC Consult SA-20170914-0 :: Authenticated Command Injection in Ubiquiti Networks UniFi Cloud Key (SEC Consult Vulnerability Lab <research@...-consult.com…)
[FD] SEC Consult SA-20170914-1 :: Persistent Cross-Site Scripting in SilverStripe CMS (SEC Consult Vulnerability Lab <research@...-consult.com>)

September 15 (6 messages)

[FD] BSides Roma (Agostino Panico <agostino.panico@...il.com>)
[FD] Mako Web Server v2.5 Multiple Unauthenticated Vulnerabilities (hyp3rlinx <apparitionsec@...il.com>)
[FD] Exploit toolkit for CVE-2017-8759 - Microsoft .NET Framework RCE (Builder + listener + video tutorial) (Bhdresh <bhdresh@...il.com>)
[FD] stack buffer overflow in openexif 2.1.4 (luanjunchao <luanjunchao@....com>)
[FD] Updated advisory for CVE-2017-8769 - WhatsApp Issues with Media Files (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] ESA-2017-098: EMC Data Protection Advisor Hardcoded Password Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)

September 17 (1 message)

[FD] Internet Security Conference 2017 in China by 360 Qihoo (Vulnerability Lab <research@...nerability-lab.com>)

September 19 (6 messages)

[FD] ZKTime_Web Software 2.0 - Cross Site Request Forgery (Arvind Vishwakarma <arvind12786@...il.com>)
[FD] ZK Time_Web Software 2.0 - Broken Authentication (Arvind Vishwakarma <arvind12786@...il.com>)
[FD] Recon Brussels 2018 Call For Papers - 0xD - Registration - Training - Conference - Submit! - PGP key (cfpbrussels2018@...on.cx)
[FD] SSD Advisory – NEXXT Authentication Bypass (Maor Shwartz <maors@...ondsecurity.com>)
[FD] Vulnerabilities in D-Link DGS-3000-10TC ("MustLive" <mustlive@...security.com.ua>)
[FD] AST-2017-008: RTP/RTCP information leak ("Asterisk Security Team" <security@...erisk.org>)

September 21 (11 messages)

[FD] APPLE-SA-2017-09-19-1 iOS 11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-19-2 Safari 11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-19-3 Xcode 9 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-20-1 Additional information for APPLE-SA-2017-09-19-1 iOS 11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-20-2 watchOS 4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-20-3 tvOS 11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Pixie image Editor SSRF vulnerability for CVE-2017-12905 ("service@...maohui.net" <service@...maohui.net>)
[FD] ESA-2017-081: EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net) for SAS Solution Packs Multiple Vul… (EMC Product Security Response Center <S…)
[FD] CSNC-2017-023: Buffer Overflow in Mongoose MQTT Broker (Advisories <advisories@...pass-security.com>)
Re: [FD] Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol (Pierre Kim <pierre.kim.sec@...il.com>)
[FD] Mako Web Server v2.5 Multiple Unauthenticated Vulnerabilities (hyp3rlinx <hyp3rlinx@...il.com>)

September 22 (1 message)

[FD] WordPress Plugin Responsive Image Gallery 1.1.8 - SQL Injection (Manuel Garcia Cardenas <advidsec@...il.com>)

September 25 (1 message)

[FD] KL-001-2017-016 : Solarwinds LEM Insecure Update Process (KoreLogic Disclosures <disclosures@...elogic.com>)

September 26 (16 messages)

[FD] OpenText Documentum Administrator and Webtop - Open Redirection (Etnies <kuba25101990@...il.com>)
[FD] OpenText Documentum Administrator and Webtop - XML External Entity Injection (Etnies <kuba25101990@...il.com>)
[FD] SSD Advisory – Sentora / ZPanel Password Reset Vulnerability (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – FLIR Systems Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] First public BlueBorne (Linux Kernel <= 4.13.1 - BlueTooth Buffer Overflow) DEMO/Proof of Concept exploit (Marcin Kozlowski <marcinguy@...il.com>)
[FD] APPLE-SA-2017-09-25-1 macOS High Sierra 10.13 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-2 iCloud for Windows 7 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-3 Additional information for APPLE-SA-2017-09-19-2 Safari 11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-4 Additional information for APPLE-SA-2017-09-19-1 iOS 11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-5 Additional information for APPLE-SA-2017-09-20-2 watchOS 4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-6 Additional information for APPLE-SA-2017-09-20-3 tvOS 11 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-7 iTunes 12.7 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-8 iTunes 12.7 for Windows (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2017-09-25-9 macOS Server 5.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Advisory: Git cvsserver OS Command Injection (joernchen <joernchen@...noelit.de>)
[FD] Qualys Security Advisory - Linux PIE/stack corruption (CVE-2017-1000253) (Qualys Security Advisory <qsa@...lys.com>)

September 27 (3 messages)

[FD] CSRF/XSS in Content Audit allowing an unauthenticated attacker to do almost anything an admin can (WordPress plugin) (dxw Security <security@....com>)
[FD] ESA-2017-119: EMC Elastic Cloud Storage Undocumented Account Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] ESA-2017-115: EMC AppSync Host Plug-in Denial of Service Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)

September 29 (22 messages)

[FD] Zyxel P-2812HNU-F1 DSL router - command injection (Willem de Groot <gwillem@...il.com>)
[FD] Faleemi FSC-880 Multiple Security Vulnerabilities (Oleg Puzanov <oleg@...sploit.co>)
[FD] [CVE-2017-11321] UCOPIA Wireless Appliance < 5.1.8 Restricted Shell Escape (Sysdream Labs <labs@...dream.com>)
[FD] [CVE-2017-11322] UCOPIA Wireless Appliance < 5.1.8 Privileges Escalation (Sysdream Labs <labs@...dream.com>)
[FD] [CVE-2017-6089] PhpCollab 2.5.1 Multiple SQL Injections (unauthenticated) (Sysdream Labs <labs@...dream.com>)
[FD] [CVE-2017-6090] PhpCollab 2.5.1 Arbitrary File Upload (unauthenticated) (Sysdream Labs <labs@...dream.com>)
[FD] SAP Enterprise Portal and Clients Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks (netizen 01k <netizen01k@...il.com>)
[FD] Zoho Site24x7 for Android Didn’t Properly Validate SSL (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Server Side Request Forgery (hyp3rlinx <apparitionsec@...il.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized NT Domain / PHP Information Disclosures CVE-2017-14085 (hyp3rlinx <apparitionsec@...il.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* Host Header Injection CVE-2017-14087 (hyp3rlinx <apparitionsec@...il.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* CURL (MITM) Remote Code Execution CVE-2017-14084 (hyp3rlinx <apparitionsec@...il.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Start Remote Process Code Execution / DOS - INI Corruption CV… (hyp3rlinx <apparitionsec@...il.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Change Prevention Image File Execution Bypass (hyp3rlinx <apparitionsec@...il.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Remote Encryption Key Disclosure CVE-2017-14083 (hyp3rlinx <apparitionsec@...il.com>)
[FD] Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Remote Memory Corruption CVE-2017-14089 (hyp3rlinx <apparitionsec@...il.com>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - Arbitrary File Read (Marcin Wołoszyn <mw@....pl>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - SQL Injection (Marcin Wołoszyn <mw@....pl>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - SQL Injection (Marcin Wołoszyn <mw@....pl>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - Cross-Site Scripting (Marcin Wołoszyn <mw@....pl>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - Cross-Site Scripting (Marcin Wołoszyn <mw@....pl>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - XML External Entity (Marcin Wołoszyn <mw@....pl>)

110 messages

Powered by blists - more mailing lists