full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2018/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹	² 4	³ 5	⁴ 1	⁵ 8	⁶ 3	⁷
⁸	⁹	¹⁰ 17	¹¹ 5	¹² 7	¹³ 10	¹⁴
¹⁵ 3	¹⁶ 6	¹⁷	¹⁸ 1	¹⁹ 4	²⁰	²¹ 1
²² 1	²³ 8	²⁴ 7	²⁵	²⁶ 4	²⁷	²⁸
²⁹	³⁰ 6	³¹ 1

Messages by day:

January 2 (4 messages)

[FD] "." (period) in file extension(s) in windows (debug <debug.net@...il.com>)
[FD] FAQin congress CFP (Esteban Dauksis <esteban@...ksis.com>)
[FD] SSD Advisory – Kingsoft Antivirus/Internet Security 9+ Privilege Escalation (Maor Shwartz <maors@...ondsecurity.com>)
[FD] SSD Advisory – D-Link DSL-6850U Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)

January 3 (5 messages)

Re: [FD] "." (period) in file extension(s) in windows (Gynvael Coldwind <gynvael@...dwind.pl>)
[FD] Gain Access to SSH Group via ssh-agent and OpenSSL (halfdog <me@...fdog.net>)
[FD] EMC xDashboard - SQL Injection Vulnerability (Paweł Gocyla <pawellgocyla@...il.com>)
[FD] ChromeOS Doesn’t Always Use SSL During Startup [CVE-2017-15397] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
Re: [FD] "." (period) in file extension(s) in windows (Dave Horsfall <dave@...sfall.org>)

January 4 (1 message)

[FD] SonicWall SonicOS NSA UTM Firewall - Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 5 (8 messages)

[FD] Icyphoenix 2.2.0.105 - Multiple SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] iJoomla com_adagency 6.0.9 - SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] AMD-PSP: fTPM Remote Code Execution via crafted EK certificate (Cfir Cohen via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [CVE-2017-7998] Gespage stored cross-site-scripting (XSS) vulnerability (Sydream Labs <labs@...dream.com>)
[FD] [CVE-2017-7997] Gespage SQL Injection vulnerability (Sydream Labs <labs@...dream.com>)
[FD] SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] RCE in DuoLingo’s TinyCards App for Android [CVE-2017-16905] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] ESA-2018-001: EMC Avamar Server, NetWorker Virtual Edition and Integrated Data Protection Appliance Multiple Secu… (EMC Product Security Response Center <S…)

January 6 (3 messages)

[FD] Wickr Inc - App Clock & Message Deletion Glitch P2 - Bug Bounty (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SonicWall SonicOS NSA Web Firewall - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] WpJobBoard v4.4.4 - Multiple SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 10 (17 messages)

Re: [FD] AMD-PSP: fTPM Remote Code Execution via crafted EK certificate (Cfir Cohen via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Handy Password 4.9.3 Buffer Overflow (filipe <filipe.xavier@...pest.com.br>)
[FD] Call For Paper - Nuit du Hack - June 30th - July 1st, 2018 (Freeman <freeman@...kerzvoice.net>)
[FD] SSD Advisory – Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access (Maor Shwartz <maors@...ondsecurity.com>)
[FD] beVX Security Conference - Call For Papers / Workshops (Maor Shwartz <maors@...ondsecurity.com>)
[FD] FiberHome MIFI LM53Q1 Multiple Vulnerabilities (Ibad Shah <muhammad.ibad.shah@...il.com>)
[FD] Wapiti 3.0.0 released! Web vulnerability scanner (Nicolas SURRIBAS <nicolas.surribas@...il.com>)
[FD] Social Media Widget by Acurax [CSRF] (Panagiotis Vagenas <pan.vagenas@...il.com>)
[FD] CMS Tree Page View [CSRF, Privilege Escalation] (Panagiotis Vagenas <pan.vagenas@...il.com>)
[FD] Admin Menu Tree Page View [CSRF, Privilege Escalation] (Panagiotis Vagenas <pan.vagenas@...il.com>)
[FD] WordPress Download Manager [CSRF] (Panagiotis Vagenas <pan.vagenas@...il.com>)
[FD] APPLE-SA-2018-1-8-1 iOS 11.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-1-8-2 macOS High Sierra 10.13.2 Supplemental Update (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-1-8-3 Safari 11.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] CVE-2017-18016 - Paritytech Parity Ethereum built-in Dapp Browser <= v1.6.10 webproxy token reuse same-origin poli… ("oststrom \(public\)" <pub@...strom.com…)
[FD] Sangoma SBC Remote Command Execution - CVE-2017–17430 (Security Team Appsecco <security@...secco.com>)
[FD] WordPress LearnDash LMS: Unauthenticated arbitrary file upload (NinTechNet <security@...technet.com>)

January 11 (5 messages)

[FD] SSD Advisory – Seagate Personal Cloud Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Dbox 3D Slider Lite Multiple SQL injection Security Vulnerabiliti… (DefenseCode <defensecode@...ensecode.co…)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Smooth Slider Plugin SQL injection Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Testimonial Slider Plugin SQL injection Security Vulnerability (DefenseCode <defensecode@...ensecode.com>)
[FD] [CVE-2018-5189] Rumble In The Jungo – A Code Execution Walkthrough (Kurtis <kurtis@...usinfosec.com>)

January 12 (7 messages)

[FD] Flash Operator Panel v2.31.03 - Command Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] MagicSpam 2.0.13 - Insecure File Permission Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Piwigo v2.8.2 & 2.9.2 CMS - Multiple Cross Site Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Magento Connect T1 - (Claim) Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Microsoft Sharepoint 2013 - Limited Access Permission Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Magento Commerce - SSRF & XSPA Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SonicWall GMS v8.1 - Filter Bypass & Persistent Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 13 (10 messages)

[FD] Arbitrary file read in Kaseya VSA ("Securify B.V. via Fulldisclosure" <fulldisclosure@...lists.org>)
[FD] Code execution in Kaseya VSA ("Securify B.V. via Fulldisclosure" <fulldisclosure@...lists.org>)
[FD] Authentication bypass in Kaseya VSA ("Securify B.V. via Fulldisclosure" <fulldisclosure@...lists.org>)
[FD] Broken TLS certificate validation in VTech DigiGo browser (Summer of Pwnage via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Multiple vulnerabilities in VTech DigiGo allow browser overlay attack (Summer of Pwnage via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Broken TLS certificate pinning in VTech DigiGo Kid Connect app (Summer of Pwnage via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] PyroBatchFTP <= 3.18 - Local Buffer Overflow (SEH) (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] Seagate Media Server allows deleting of arbitrary files and folders (Summer of Pwnage via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [Fixed Link] [CVE-2018-5189] Rumble In The Jungo – A Code Execution Walkthrough (Kurtis <kurtis@...usinfosec.com>)
[FD] Kentico CMS v11.0 - Stack Buffer Overflow Vulnerability (Vulnerability Lab <submit@...nerability-lab.com>)

January 15 (3 messages)

[FD] [RT-SA-2017-013] Truncation of SAML Attributes in Shibboleth 2 (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] MagicSpam 2.0.13 - Insecure File Permission Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Zenario v7.6 CMS - SQL Injection Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 16 (6 messages)

[FD] Multiple vulnerabilities in all versions of ASUS routers (Blazej Adamczyk <blazej.adamczyk@...il.com>)
[FD] Adminer <= v4.3.1 Server Side Request Forgery (hyp3rlinx <hyp3rlinx@...il.com>)
[FD] [CVE-2018-5258] Neon 1.6.14 for iOS Missing SSL Certificate Validation (Rodrigo Menezes <rodrigo@...idlight.io>)
[FD] SSD Advisory – GitStack Unauthenticated Remote Code Execution (Maor Shwartz <maors@...ondsecurity.com>)
Re: [FD] [CVE-2018-5258] Neon 1.6.14 for iOS Missing SSL Certificate Validation (Rodrigo Menezes <rodrigo@...idlight.io>)
[FD] [v2] [CVE-2018-5258] Neon 1.6.14 for iOS Missing SSL Certificate Validation (Rodrigo Menezes <rodrigo@...idlight.io>)

January 18 (1 message)

[FD] Positive Hack Days 8 CFP is now open (Alexander Lashkov <ALashkov@...ecurity.com>)

January 19 (4 messages)

[FD] Photo Vault v1.2 iOS - Insecure Authentication Vulnerability (Vulnerability Lab <admin@...nerability-lab.com>)
[FD] CentOS Web Panel v0.9.8.12 - Multiple Persistent Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Shopware 5.2.5 & v5.3 - Multiple Cross Site Scripting Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] CentOS Web Panel v0.9.8.12 - Non-Persistent Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 21 (1 message)

[FD] Acadmic Microsoft - API Query Filter Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

January 22 (1 message)

[FD] CentOS Web Panel v0.9.8.12 - Remote SQL Injection Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

January 23 (8 messages)

[FD] SEC Consult SA-20180123-0 :: XXE & Reflected XSS in Oracle Financial Services Analytical Applications (SEC Consult Vulnerability Lab <research@...-consult…)
[FD] DefenseCode ThunderScan SAST Advisory: SugarCRM Community Edition Multiple SQL Injection Vulnerabilities (DefenseCode <defensecode@...ensecode.com>)
[FD] SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution (Maor Shwartz <maors@...ondsecurity.com>)
[FD] HACKTRICK'18 | Case Study Summit (Mustafa Kaan Demirhan <mstfkndmrhan@...il.com>)
[FD] ESA-2018-002: RSA® Authentication Manager SQL Injection Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] CMS Made Simple 2.2.5 [Stored Cross-Site Scripting] (Kyaw Min Thein <weev3@...look.com>)
[FD] CMS Made Simple 2.2.5[Reflected Cross-Site Scripting] (Kyaw Min Thein <weev3@...look.com>)
[FD] CMS Made Simple 2.2.5[Reflected Cross-Site Scripting] (Kyaw Min Thein <weev3@...look.com>)

January 24 (7 messages)

[FD] APPLE-SA-2018-1-23-1 iOS 11.2.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-1-23-2 macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El C… (Apple Product Security <product-securit…)
[FD] APPLE-SA-2018-1-23-3 watchOS 4.2.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-1-23-4 tvOS 11.2.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-1-23-5 Safari 11.0.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-1-23-6 iTunes 12.7.3 for Windows (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-1-23-7 iCloud for Windows 7.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)

January 26 (4 messages)

[FD] [CVE-2018-6194, CVE-2018-6195] PHP Object Injection + XSS in WordPress Splashing Images Plugin (<nicolas.buzy-debat@...nge.com>)
[FD] [CVE-2016-6598/9]: RCE and admin cred disclosure in BMC Track-It! 11.4 (Pedro Ribeiro <pedrib@...il.com>)
Re: [FD] SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution (Pedro Ribeiro <pedrib@...il.com>)
[FD] KL-001-2018-001 : Sophos Web Gateway Persistent Cross Site Scripting Vulnerability (KoreLogic Disclosures <disclosures@...elogic.com>)

January 30 (6 messages)

[FD] Banknotes Misproduction security & biometric weakness (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SSD Advisory – iBall Multiple Vulnerabilities (Maor Shwartz <maors@...ondsecurity.com>)
[FD] [SYSS-2017-026] Microsoft Surface Hub Keyboard - Cryptographic Issues (CWE-310), Insufficient Protection against Rep… (Matthias Deeg <matthias.deeg@...s.de>)
[FD] XSS and CSRF vulnerabilities in ASUS RT-N10 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] Banknotes Misproduction security & biometric weakness (Jeffrey Walton <noloader@...il.com>)
[FD] Defense in depth -- the Microsoft way (part 49): fun with application manifests ("Stefan Kanthak" <stefan.kanthak@...go.de>)

January 31 (1 message)

[FD] SEC Consult SA-20180131-0 :: Multiple Vulnerabilities in Sprecher Automation SPRECON-E-C, PU-2433 (SEC Consult Vulnerability Lab <research@...-consult.com…)

102 messages