full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2018/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹	² 7	³	⁴
⁵	⁶ 10	⁷	⁸ 1	⁹ 11	¹⁰	¹¹
¹² 1	¹³ 7	¹⁴ 1	¹⁵ 1	¹⁶	¹⁷	¹⁸
¹⁹ 5	²⁰	²¹	²² 7	²³ 1	²⁴ 1	²⁵
²⁶	²⁷ 11	²⁸	²⁹	³⁰ 15	³¹

Messages by day:

March 2 (7 messages)

[FD] DualDesk v20 "Proxy.exe" Server / Denial Of Service - CVE-2018-7583 (hyp3rlinx <apparitionsec@...il.com>)
[FD] CVE-2018-7449 SEGGER embOS/IP FTP Server v3.22 / FTP CMDs Denial Of Service (hyp3rlinx <apparitionsec@...il.com>)
[FD] Another TCP based IDS bypass technique. CVE-2018-6794 (Kirill Shipulin <kshipulin@...ecurity.com>)
[FD] CSRF vulnerabilities in D-Link DGS-3000-10TC ("MustLive" <mustlive@...security.com.ua>)
[FD] Content Injection in Samsung Display Solutions Application for Android [CVE-2018-6019] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurit…)
[FD] CVE-2017-12544 XSS on HPE System Management Homepage v7.6.0.11 and minor (spinfoo via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] KL-001-2018-007 : Sophos UTM 9 loginuser Privilege Escalation via confd Service (KoreLogic Disclosures <disclosures@...elogic.com>)

March 6 (10 messages)

[FD] KL-001-2018-007 : Sophos UTM 9 loginuser Privilege Escalation via confd Service (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] Softros Network Time System Server v2.3.4 / Denial Of Service CVE-2018-7658 (hyp3rlinx <apparitionsec@...il.com>)
[FD] DefenseCode Security Advisory: Magento Backups Cross-Site Request Forgery (Defense Code <defensecode@...ensecode.com>)
[FD] DefenseCode Security Advisory: Magento Multiple Stored Cross-Site Scripting Vulnerabilities (Defense Code <defensecode@...ensecode.com>)
[FD] DefenseCode Security Advisory: Magento Stored Cross-Site Scripting – Downloadable Products (Defense Code <defensecode@...ensecode.com>)
[FD] DefenseCode Security Advisory: Magento Stored Cross-Site Scripting – Product Attributes (Defense Code <defensecode@...ensecode.com>)
[FD] Rapid Scada - 5.5.0 - Insecure Permissions (filipe <filipe.xavier@...pest.com.br>)
[FD] DSA-2018-038: RSA Archer GRC Platform Multiple Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)
[FD] DSA-2018-011: RSA Identity Governance and Lifecycle Privilege Escalation Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] CVE-2017-12544 XSS on HPE System Management Homepage v7.6.0.11 and minor (spinfoo via Fulldisclosure <fulldisclosure@...lists.org>)

March 8 (1 message)

[FD] [RT-SA-2018-001] Arbitrary Redirect in Tuleap (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

March 9 (11 messages)

[FD] WebLog Expert Web Server Enterprise v9.4 / Authentication Bypass CVE-2018-7581 (hyp3rlinx <apparitionsec@...il.com>)
[FD] WebLog Expert Web Server Enterprise v9.4 / Remote Denial Of Service CVE-2018-7582 (hyp3rlinx <apparitionsec@...il.com>)
[FD] Tuleap SQL Injection (Cristiano Maruti <cmaruti@...il.com>)
[FD] 10-Strike Network Monitor 5.4 - Unquoted Service Path (filipe <filipe.xavier@...pest.com.br>)
[FD] BitDefender Total Security 2018 - Insecure Pipe Permissions (filipe <filipe.xavier@...pest.com.br>)
[FD] Panda Global Security 17.0.1 - Unquoted service path (filipe <filipe.xavier@...pest.com.br>)
[FD] Panda Global Security 17.0.1 - NULL DACL grants full access (filipe <filipe.xavier@...pest.com.br>)
[FD] WPS Free Office 10.2.0.5978 - NULL DACL grants full access (filipe <filipe.xavier@...pest.com.br>)
[FD] Hola VPN 1.79.859 - Insecure service permissions (filipe <filipe.xavier@...pest.com.br>)
[FD] Multiple SQL injection vulnerabilities in Bacula-Web (CVE-2017-15367) (Gustavo Sorondo <gs@...tainfinita.com.ar>)
[FD] DSA-2018-020: Dell EMC Data Protection Advisor Hardcoded Password Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)

March 12 (1 message)

[FD] SEC Consult SA-20180312-0 :: Multiple Critical Vulnerabilities in SecurEnvoy SecurMail (SEC Consult Vulnerability Lab <research@...-consult.com>)

March 13 (7 messages)

[FD] [RT-SA-2017-012] Shopware Cart Accessible by Third-Party Websites (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[FD] PayPal Inc - New Venmo Bug Bounty Program (Vulnerability Lab <research@...nerability-lab.com>)
[FD] PayPal Inc Increases Bug Bounty Payments in 2018 up to 30.000$ (Vulnerability Lab <research@...nerability-lab.com>)
Re: [FD] BitDefender Total Security 2018 - Insecure Pipe Permissions (Alex BALAN <abalan@...defender.com>)
[FD] SQL Injection in Textpattern <= 4.6.2 (Manuel Garcia Cardenas <advidsec@...il.com>)
[FD] DEWESoft X3 SP1 (64-bit) installer / Remote Internal Command Access - CVE-2018-7756 (hyp3rlinx <apparitionsec@...il.com>)
[FD] hardwear.io CFP is Open & New Security Training in Berlin! (Yuliya Pliavaka <yuliya@...atu.com>)

March 14 (1 message)

[FD] SEC Consult SA-20180314-0 :: Arbitrary Shortcode Execution & Local File Inclusion in WooCommerce Products Filter (… (SEC Consult Vulnerability Lab <research…)

March 15 (1 message)

[FD] [CORE-2018-0003] MikroTik RouterOS SMB Buffer Overflow (Core Security Advisories Team <advisories@...esecurity.com>)

March 19 (5 messages)

[FD] [CVE-2018-5233] Grav CMS admin plugin Reflected Cross Site Scripting (XSS) vulnerability (Sydream Labs <labs@...dream.com>)
[FD] [CVE-2018-7422] Local File Inclusion (LFI) vulnerability in WordPress Site Editor Plugin (<nicolas.buzy-debat@...nge.com>)
[FD] c0c0n XI | The cy0ps c0n - Call For Papers & Call For Workshops 2018 Open (Prajwal Panchmahalkar <prajwal.hy468@...il.com>)
[FD] RedCoded ISR: Abine Blur Password Manager Insecure Permissions (CVE-2018-8213) ("(RS) Tyler Schroder" <redorhcs@...coded.com>)
[FD] DSA-2018-037: Dell EMC NetWorker Buffer Overflow Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)

March 22 (7 messages)

[FD] New release: UFONet v1.0 "TachY0n!" (psy <epsylon@...eup.net>)
[FD] LDAP Account Manager (6.2) CVE-2018-8763, CVE-2018-8764 (Michał Kędzior <michal.kedzior1478@...il.com>)
[FD] Kaseya AgentMon.exe <= 9.3.0.11 - Local Privilege Escalation (x ksi <s3810@...stk.edu.pl>)
[FD] Bomgar Remote Support Portal JavaStart Applet <= 52970 - Path Traversal (x ksi <s3810@...stk.edu.pl>)
[FD] ModSecurity WAF 3.0 for Nginx - Denial of Service (x ksi <s3810@...stk.edu.pl>)
[FD] ES2018-05 Kamailio heap overflow (Sandro Gauci <sandro@...blesecurity.com>)
[FD] DSA-2018-018: Dell EMC Isilon OneFS Multiple Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)

March 23 (1 message)

[FD] BSidesMilano Event and CFP (Agostino Panico <agostino.panico@...il.com>)

March 24 (1 message)

[FD] Cross-Site Scripting vulnerability in Zimbra Collaboration Suite due to the way it handles attachment links ("Securify B.V. via Fulldisclosure" <fulldiscl…)

March 27 (11 messages)

[FD] AEF CMS v1.0.9 - (PM) Persistent Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Weblication CMS Core & Grid v12.6.24 - Multiple Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Sandoba CP:Shop CMS v2016.1 - Multiple Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Microsoft Skype Mobile v81.2 & v8.13 - Remote Denial of Service Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Blind SQL Injection in Square 9 GlobalForms <= 6.2.x (CVE-2018-8820) (Hate Shape <hateshape@...il.com>)
[FD] ManageEngine Service Desk Plus < 9403 Cross-Site Scripting (okan coskun <okancoskun2@...il.com>)
[FD] DSA-2018-058: Dell EMC ScaleIO Multiple Security Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)
[FD] DSA-2018-040: RSA® Authentication Agent for Web for IIS and Apache Web Server Multiple Vulnerabilities (EMC Product Security Response Center <Security_Ale…)
[FD] new email; gw22067@...mail.com | Double-free segfault bypass (keliikoa kirland <keliikoakirland@...il.com>)
Re: [FD] new email; gw22067@...mail.com | Double-free segfault bypass (keliikoa kirland <keliikoakirland@...il.com>)
Re: [FD] new email; gw22067@...mail.com | Double-free segfault bypass (keliikoa kirland <keliikoakirland@...il.com>)

March 30 (15 messages)

[FD] CA20180329-01: Security Notice for CA Workload Automation AE and CA Workload Control Center ("Williams, Ken" <Ken.Williams@...com>)
[FD] CA20180328-01: Security Notice for CA API Developer Portal ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[FD] CVE-2018-5708 (Kevin R <krandall2013@...il.com>)
[FD] Multiple Cross-Site Scripting Vulnerabilities in Crea8Social Social Network Script ("Mohamed A. Baset" <maebaset@...kurity.com>)
[FD] APPLE-SA-2018-3-29-1 iOS 11.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-3-29-2 watchOS 4.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-3-29-3 tvOS 11.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-3-29-4 Xcode 9.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-3-29-5 macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El C… (Apple Product Security <product-securit…)
[FD] APPLE-SA-2018-3-29-6 Safari 11.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-3-29-7 iTunes 12.7.4 for Windows (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-3-29-8 iCloud for Windows 7.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] SSRF（Server Side Request Forgery） in Tpshop <= 2.0.6 （CVE-2017-16614） ("service@...maohui.net" <service@...maohui.net>)
[FD] Null Pointer Deference (Denial of Service)-Kingsoft Internet Security 9+ Kernel Driver KWatch3.sys (WTS Research Team <rnd@...teteamsec.com>)
Re: [FD] new email; gw22067@...mail.com | Double-free segfault bypass (Matthew Fernandez <matthew.fernandez@...il.com>)

79 messages