full-disclosure mailing list - 2017/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2017/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
²	³ 1	⁴ 4	⁵	⁶ 9	⁷ 2	⁸
⁹	¹⁰ 12	¹¹	¹²	¹³ 5	¹⁴	¹⁵
¹⁶ 5	¹⁷ 7	¹⁸ 2	¹⁹	²⁰ 6	²¹	²²
²³ 1	²⁴ 5	²⁵ 1	²⁶	²⁷ 4	²⁸	²⁹
³⁰	³¹ 7

Messages by day:

October 3 (1 message)

[FD] CVE-2017-9807: e2openplugin-OpenWebif: Remote code execution through HTTP GET parameter manipulation (John Torakis <johntorakis@...sus-labs.com>)

October 4 (4 messages)

[FD] SSD Advisory – Netgear ReadyNAS Surveillance Unauthenticated Remote Command Execution (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Mac OS X 10.12 Quarantine Bypass (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Horde Groupware Unauthorized File Download (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Tiandy IP cameras Sensitive Information Disclosure (Maor Shwartz <maors@...ondsecurity.com>)

October 6 (9 messages)

[FD] CVE-2017-9292, Lansweeper 6.0.0.63 XSS vulnerability (Giovanni Cerrato <cerratogianni@...il.com>)
[FD] DefenseCode Security Advisory: Magento Commerce CSRF, Stored Cross Site Scripting #1 (DefenseCode <defensecode@...ensecode.com>)
[FD] DefenseCode Security Advisory: Magento Commerce CSRF, Stored Cross Site Scripting #2 (DefenseCode <defensecode@...ensecode.com>)
[FD] SmartBear SoapUI - Remote Code Execution via Deserialization (Etnies <kuba25101990@...il.com>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - SQL Injection (Marcin Wołoszyn <mw@....pl>)
[FD] APPLE-SA-2017-10-05-1 macOS High Sierra 10.13 Supplemental Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] ESA-2017-112: EMC Network Configuration Manager Reflected Cross-Site Scripting Vulnerability (EMC Product Security Response Center <Security_Alert@....com…)
[FD] ESA-2017-111: RSA Archer® GRC Platform Multiple Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)
[FD] Nullcon Goa 2018 Call For Papers is Open! (Yuliya Pliavaka <yuliya@...atu.com>)

October 7 (2 messages)

[FD] CVE-2017-13706, Lansweeper 6.0.100.29 XXE Vulnerability (Barkın Kılıç <barkin@...kin.info>)
[FD] WordPress does not hash or expire wp_signups.activation_key allowing an attacker with SQL injection to create accounts (dxw Security <security@....com>)

October 10 (12 messages)

[FD] DefenseCode ThunderScan SAST Advisory: WordPress Simple Login Log Plugin Multiple SQL Injection Security Vulnerabi… (DefenseCode <defensecode@...ensecode.co…)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Ad Widget Plugin Local File Inclusion Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] ArcGIS Server 10.3.1: RMIClassLoader useCodebaseOnly=false RCE (Harrison Neal <hneal@...tdidibreak.com>)
Re: [FD] ArcGIS Server 10.3.1: RMIClassLoader useCodebaseOnly=false RCE (Harrison Neal <hneal@...tdidibreak.com>)
Re: [FD] SmartBear SoapUI - Remote Code Execution via Deserialization (Harrison Neal <hneal@...tdidibreak.com>)
Re: [FD] Authentication Bypass in Xerox Printers – It is not a bug! It is a legacy feature ;-) (kvnjs <kvnjs@...eup.net>)
[FD] SSD Advisory – Vacron NVR Remote Command Execution (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – PHP Melody Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – QNAP HelpDesk SQL Injection (Maor Shwartz <maors@...ondsecurity.com>)
[FD] OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) - SQL Injection (Marcin Wołoszyn <mw@....pl>)
[FD] Executable installers are vulnerable^WEVIL (case 54): escalation of privilege with PostgresSQL installers for Wind… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Bad rolling code in keyfob for many Subaru cars (Tom Wimmenhove <tom.wimmenhove@...il.com>)

October 13 (5 messages)

[FD] Advisory X41-2017-008: Multiple Vulnerabilities in Shadowsocks (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
[FD] Advisory X41-2017-010: Command Execution in Shadowsocks-libev (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
[FD] Multiple vulnerabilities in OpenText Documentum Content Server ("Andrey B. Panfilov" <andrew@...filov.tel>)
[FD] Bezeq, Israel Telco, allows resetting its home subscribers (Baruch via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [RCESEC-2017-002][CVE-2017-14956] AlienVault USM v5.4.2 "/ossim/report/wizard_email.php" Cross-Site Request Forgery l… (Julien Ahrens <info@...security.com>)

October 16 (5 messages)

[FD] SEC Consult SA-20171016-0 :: Multiple vulnerabilities in Micro Focus VisiBroker C++ (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] ESA-2017-124: EMC Isilon OneFS Reflected Cross Site Scripting Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] ESA-2017-122: EMC NetWorker Buffer Overflow Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] SSD Advisory – ZTE uSmartView DLL Hijacking (Maor Shwartz <maors@...ondsecurity.com>)
[FD] [CVE-2017-15359] 3CX Phone System - Authenticated Directory Traversal (Jens Regel <jregel@...neider-wulf.de>)

October 17 (7 messages)

[FD] SEC Consult SA-20171017-0 :: Cross site scripting in Webtrekk Pixel tracking component (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] [CVE-2017-14322] Interspire Email Marketer - Remote Admin Authentication Bypass (Hakan Küsne <Hakan.Kusne@...oteam.ch>)
[FD] SSD Advisory – FiberHome Directory Traversal (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Microsoft Office SMB Information Disclosure (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Webmin Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Ikraus Anti Virus Remote Code Execution (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Linux Kernel AF_PACKET Use-After-Free (Maor Shwartz <maors@...ondsecurity.com>)

October 18 (2 messages)

[FD] SEC Consult SA-20171018-0 :: Multiple vulnerabilities in Afian AB FileRun (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20171018-1 :: Multiple vulnerabilities in Linksys E-series products (SEC Consult Vulnerability Lab <research@...-consult.com>)

October 20 (6 messages)

[FD] CVE-2017-12579 Local root privesc in Hashicorp vagrant-vmware-fusion 4.0.24 ("Mark Wadham" <fd@....io>)
[FD] [RCESEC-2017-001][CVE-2017-14955] Check_mk v1.2.8p25 save_users() Race Condition leading to Sensitive Information Dis… (Julien Ahrens <info@...security.com>)
[FD] [RCE] TP-Link Remote Code Execution CVE-2017-13772 (Kurtis Brown <kurtis@...tisebear.com>)
[FD] SSD Advisory – HPE Baseline Smart Gig SFP 24 Switch Pre-authentication Stored XSS (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – Endian Firewall Stored From XSS to Remote Command Execution (Maor Shwartz <maors@...ondsecurity.com>)
[FD] Multiple vulnerabilities in BMC Remedy (Simon Rawet <sr@...post24.com>)

October 23 (1 message)

[FD] [KIS-2017-02] Tuleap <= 9.6 Second-Order PHP Object Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

October 24 (5 messages)

[FD] KL-001-2017-017 : Infoblox NetMRI Administration Shell Escape and Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-018 : Infoblox NetMRI Administration Shell Factory Reset Persistence (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-019 : Sonicwall WXA5000 Console Jail Escape and Privilege Escalation (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-020 : Sophos UTM 9 loginuser Privilege Escalation via Insecure Directory Permissions (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] KL-001-2017-021 : Sophos UTM 9 Management Appplication Local File Inclusion (KoreLogic Disclosures <disclosures@...elogic.com>)

October 25 (1 message)

[FD] Hash thief on Windows shared folder with SCF files. ADV170014 NTLM SSO (Juan Diego <diego@...ux.com>)

October 27 (4 messages)

[FD] Bomgar Remote Support - Local Privilege Escalation (CVE-2017-5996) (VSR Advisories <advisories@...curity.com>)
[FD] PIA Android App Can Be Crashed via Large Download [CVE-2017-15882] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] ESA-2017-134: RSA® Authentication Manager Security Update for Reflected Cross-Site Scripting Vulnerability (EMC Product Security Response Center <Security…)
[FD] Windows Attachment Manager *potential* feature bypass ("Stevie Lamb (WLT GB)" <stevie.lamb@....com>)

October 31 (7 messages)

[FD] Advisory SyncBreeze Enterprise 10.1.16 Buffer Overflow [CVE-2017-15950] (filipe <filipe.xavier@...pest.com.br>)
[FD] JanTek JTC-200 Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] SpiderControl SCADA Web Server Improper Privilege Management Vulnerability (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [ICS] Progea Movicon SCADA/HMI Vulnerabilities (Karn Ganeshen <karnganeshen@...il.com>)
[FD] [CVE-2017-15867] Multiple Cross-Site Scripting (XSS) vulnerabilities in User Login History Wordpress Plugin (<nicolas.buzy-debat@...nge.com>)
[FD] ESA-2017-141: EMC AppSync Hardcoded Password Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] ESA-2017-137: EMC VMAX Virtual Appliance (vApp) Authentication Bypass Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)

71 messages

Powered by blists - more mailing lists