full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2018/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 13	²	³ 4	⁴ 2	⁵	⁶
⁷ 2	⁸ 2	⁹ 1	¹⁰	¹¹ 4	¹²	¹³
¹⁴ 7	¹⁵ 7	¹⁶ 5	¹⁷	¹⁸	¹⁹	²⁰
²¹	²²	²³	²⁴	²⁵	²⁶	²⁷
²⁸	²⁹ 22	³⁰ 2	³¹ 2

Messages by day:

May 1 (13 messages)

[FD] airgapping kvm switch (debug <debug.net@...il.com>)
Re: [FD] Unvalidated Redirect in Shibboleth component of Blackboard (Derrek Bertrand <derrekbertrand@...il.com>)
[FD] ASUSTOR ADM 3.1.0.RFQ3 and below vulnerabilities (matthew f <matthew.e.fulton@...il.com>)
[FD] XSS-Flexense-DiskBoss-Enterprise-all-versions (n0ipr0cs <franciscojaviersantiagovazquez@...il.com>)
[FD] XSS in Flexense SyncBreeze, affects all versions (n0ipr0cs <franciscojaviersantiagovazquez@...il.com>)
[FD] XSS in Flexense DiskPulse, affects all versions (n0ipr0cs <franciscojaviersantiagovazquez@...il.com>)
[FD] XSS in Flexense DiskSavvy, affects all versions (n0ipr0cs <franciscojaviersantiagovazquez@...il.com>)
[FD] XSS in Flexense DupScout, affects all versions (n0ipr0cs <franciscojaviersantiagovazquez@...il.com>)
[FD] XSS in Flexense VX Search, affects all versions (n0ipr0cs <franciscojaviersantiagovazquez@...il.com>)
[FD] XSS in Flexense DiskSorter, affects all versions (n0ipr0cs <franciscojaviersantiagovazquez@...il.com>)
[FD] SSRF（Server Side Request Forgery） in Cockpit 0.4.4-0.5.5 (CVE-2018-9302) ("service@...maohui.net" <service@...maohui.net>)
[FD] Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919) ("service@...maohui.net" <service@...maohui.net>)
[FD] Multiple issues in WatchGuard AP100 AP102 AP200 result in remote code execution (Stephen Shkardoon <stephen@...ecurity.co.nz>)

May 3 (4 messages)

[FD] SEC Consult SA-20180503-0 :: Authentication Bypass in Oracle Access Manager (OAM) (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] CA20180501-01: Security Notice for CA Spectrum ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[FD] DSA-2018-063: Dell EMC Unity Family OS Command Injection Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] [CORE-2018-0001] TP-Link EAP Controller Multiple Vulnerabilities (Core Security Advisories Team <advisories@...esecurity.com>)

May 4 (2 messages)

[FD] Insecure Authentication Practices in D-LINK DIR-601 Router, Hardware version A1, Firmware Version 1.02NA (CVE-2018… (Joe Gray <jgray@...ancedpersistentsecur…)
[FD] DSA-2018-086: RSA® Authentication Manager Multiple Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)

May 7 (2 messages)

[FD] APPLE-SA-2018-05-04-1 Security Update 2018-001 Swift 4.1.1 for Ubuntu 14.04 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] GNU Wget Cookie Injection [CVE-2018-0494] (Harry Sintonen <fulldisclosure@...er.fi>)

May 8 (2 messages)

[FD] CVE-2018-10201 – Ncomputing vSpace Pro Directory Traversal Vulnerability (Javier Bernardo <javier@...ll.net>)
[FD] APPLE-SA-2018-05-08-1 Additional information for APPLE-SA-2018-04-24-2 Security Update 2018-001 (Apple Product Security <product-security-noreply@...ts.ap…)

May 9 (1 message)

[FD] [ADV170017] Defense in depth -- the Microsoft way (part 54): escalation of privilege during installation of Micros… ("Stefan Kanthak" <stefan.kanthak@...go.…)

May 11 (4 messages)

[FD] Microsoft Windows "FxCop" v10-12 / XML External Entity Injection (hyp3rlinx <apparitionsec@...il.com>)
[FD] Vulnerabilities in IBMs Flashsystems and Storwize Products (Sebastian Neuner via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] t2'18: Call For Papers 2018 (Helsinki, Finland) ("Tomi Tuominen" <tomi.tuominen@...fi>)
[FD] CSRF in WP User Groups allows anybody to modify user groups and types (WordPress plugin) (dxw Security <harry@....com>)

May 14 (7 messages)

[FD] Calamp.com Incorrect privilege assignment could lead to full user compromise (Vangelis Stykas <evstykas@...il.com>)
[FD] Buffer overflow in xls2csv (xlsparse.c:716) - catdoc (Mohd Hanafie <nafiez.skins@...il.com>)
[FD] CVE-2018-10759/CVE-2018-10760: Project Pier 0.8.8 vulnerabilities (Imre Rad <radimre83@...il.com>)
Re: [FD] Vulnerabilities in IBMs Flashsystems and Storwize Products (Sebastian Neuner via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] SEC Consult SA-20180514-0 :: Arbitrary File Upload & Cross-site scripting in MyBiz MyProcureNet (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] Stored XSS in WP ULike allows unauthorised users to do almost anything an admin can (WordPress plugin) (dxw Security <harry@....com>)
[FD] WP ULike allows anybody to delete any row in any WordPress table (WordPress plugin) (dxw Security <harry@....com>)

May 15 (7 messages)

Re: [FD] SEC Consult SA-20180514-0 :: Arbitrary File Upload & Cross-site scripting in MyBiz MyProcureNet (SEC Consult Vulnerability Lab <research@...-consult.c…)
[FD] CSRF in Metronet Tag Manager allows anybody to do almost anything an admin can (WordPress plugin) (dxw Security <harry@....com>)
[FD] Calamp.com Incorrect privilege assignment could lead to full user and vehicle compromise (Vangelis Stykas <evstykas@...il.com>)
[FD] Multiple Arris Touchstone Gateway Vulnerabilities (Akshay Sharma <hi@...haysharma.net>)
[FD] CVE-2018-10994: HTML tag injection in Signal-desktop (Alfredo Ortega <ortegaalfredo@...il.com>)
Re: [FD] Buffer overflow in xls2csv (xlsparse.c:716) - catdoc (Vadim Zhukov <persgray@...il.com>)
[FD] Keeper Commander (<sosumi@...amail.com>)

May 16 (5 messages)

[FD] SEC Consult SA-20180516-0 :: XXE & XSS vulnerabilities in RSA Authentication Manager (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] vcftools 0.1.15 vuln bugs ("bear.xiong" <bear.xiong@...ppsecurity.com.cn>)
[FD] PDFParser vulnerability ("bear.xiong" <bear.xiong@...ppsecurity.com.cn>)
[FD] Privilege escalation on Windows10/x by shortcut alteration. (Davide Lombardo <davide.l_ombardo@...look.com>)
[FD] CVE-2018-11101: Signal-desktop HTML tag injection variant 2 (Alfredo Ortega <ortegaalfredo@...il.com>)

May 29 (22 messages)

[FD] MachForm Multiple Vulnerabilities CVE-2018-6409/CVE-2018-6410/CVE-2018-6411 (Amine Taouirsa <amine_taouirsa@...otecsystem.com>)
[FD] libmobi 0.3 vulns (熊文彬 <bear.xiong@...ppsecurity.com.cn>)
[FD] taglib 1.11.1 vuln (熊文彬 <bear.xiong@...ppsecurity.com.cn>)
[FD] WindScribe VPN 1.81 Privilege Escalation (Emin Ghuliev <drmint80@...il.com>)
[FD] Authentication Bypass in Accellion Kiteworks (<jerinjoy@...amail.com>)
[FD] [CVE-2018-10094] Dolibarr SQL Injection vulnerability (Sysdream Labs <labs@...dream.com>)
[FD] [CVE-2018-10092] Dolibarr admin panel authenticated Remote Code Execution (RCE) vulnerability (Sysdream Labs <labs@...dream.com>)
[FD] Dolibarr XSS Injection vulnerability (Sysdream Labs <labs@...dream.com>)
[FD] [CVE-2018-1418] IBM QRadar SIEM unauthenticated remote code execution as root (Pedro Ribeiro <pedrib@...il.com>)
[FD] SharePoint Site User Enumeration (pzpcve180528@...ke7.net)
[FD] Qualys Security Advisory - Procps-ng Audit Report (Qualys Security Advisory <qsa@...lys.com>)
[FD] Android OS Didn’t use FLAG_SECURE for Sensitive Settings [CVE-2017-13243] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] Reptile: a LKM rootkit written for evil purposes (nullbyte <seclist45@...il.com>)
[FD] DSA-2018-095: Dell EMC RecoverPoint Multiple Vulnerabilities (EMC Product Security Response Center <Security_Alert@....com>)
[FD] MachForm Multiple Vulnerabilities CVE-2018-6409/CVE-2018-6410/CVE-2018-6411 (Amine Taouirsa <taouirsa@...il.com>)
[FD] NUUO NVRmini2 / NVRsolo Arbitrary File Upload Vulnerability ("xiaotian.wang"<xiaotian.wang@...ppsecurity.com.cn>)
[FD] JDA Warehouse Management System (WMS) Multiple Critical Vulnerabilities (Xiaoran Wang via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] JDA Connect Multiple Critical Vulnerabilities (Xiaoran Wang via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Ruckus (Brocade) ICX7450-48 Reflected Cross Site Scripting (Yavuz Atlas <yavuz.atlas@...net.com.tr>)
[FD] SEC Consult SA-20180529-0 :: Unprotected WiFi access & Unencrypted data transfer in Vgate iCar2 OBD2 Dongle (SEC Consult Vulnerability Lab <research@...-c…)
[FD] foilChat sign up email PIN confirmation bypass (Harry Sintonen <fulldisclosure@...er.fi>)
Re: [FD] taglib 1.11.1 vuln (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 30 (2 messages)

[FD] CVE-2018-11551 AXON PBX DLL Loading Arbitrary Code Execution & Privilege Escalation Vulnerability (Himanshu Mehta <mehta.himanshu21@...il.com>)
[FD] CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting (Himanshu Mehta <mehta.himanshu21@...il.com>)

May 31 (2 messages)

[FD] [CORE-2018-0002] - Quest DR Series Disk Backup Multiple Vulnerabilities (Core Security Advisories Team <advisories@...esecurity.com>)
[FD] [CORE-2018-0004] - Quest KACE System Management Appliance Multiple Vulnerabilities (Core Security Advisories Team <advisories@...esecurity.com>)

73 messages