full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2018/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 16	³ 1	⁴ 3	⁵	⁶ 8	⁷	⁸
⁹	¹⁰ 10	¹¹ 8	¹² 5	¹³ 6	¹⁴	¹⁵
¹⁶	¹⁷ 1	¹⁸ 5	¹⁹ 1	²⁰ 12	²¹	²²
²³ 1	²⁴ 8	²⁵	²⁶ 2	²⁷ 7	²⁸	²⁹
³⁰	³¹

Messages by day:

July 2 (16 messages)

[FD] Significant Vulnerabilities in Axis IP Cameras (Vulnerability Report <vuln@...o.com>)
[FD] DSA-2018-126: EMC ECS S3 Authentication Bypass Vulnerability (EMC Product Security Response Center <Security_Alert@....com>)
[FD] Microsoft Forefront Unified Access Gateway 2010 External DNS Interaction (okan coskun <okancoskun2@...il.com>)
[FD] KL-001-2018-008 : HPE VAN SDN Unauthenticated Remote Root Vulnerability (KoreLogic Disclosures <disclosures@...elogic.com>)
[FD] XXE in WeChat Pay Sdk ( WeChat leave a backdoor on merchant websites) (Rose Jackcode <1024rosecode@...il.com>)
[FD] APPLE-SA-2018-06-27-1 SwiftNIO 1.8.0 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] XSS in Sencha Ext JS 4 to 6 (Daniel Fritsch <daniel.fritsch.86@...il.com>)
[FD] Windows Kernel (win32k.sys) Local Denial Of Service (Victor Portal Gonzalez <vportalg@...il.com>)
[FD] Open-Xchange Security Advisory 2018-07-02 (Open-Xchange GmbH <martin.heiland.lists@...n-xchange.com>)
[FD] [CVE-2018-8755] Nucom NC-WR644GACV Auth Bypass ("Fernando A. Lagos Berardi" <fernando@...ial.org>)
[FD] DSA-2018-122: RSA Certificate Manager Path Traversal Vulnerability (Dell EMC Product Security Response Center <Security_Alert@....com>)
[FD] ntop-ng < 3.4.180617 - Authentication bypass / session hijacking (Ioannis Profetis <me@....re>)
Re: [FD] Microsoft Forefront Unified Access Gateway 2010 External DNS Interaction (okan coskun <okancoskun2@...il.com>)
[FD] Double free in openslp 2.0.0 (Magnus Klaaborg Stubman <magnus@...bman.eu>)
[FD] Faraday Beta V3.0 Released (Francisco Amato <famato@...obytesec.com>)
[FD] CVE-2018-12103 (Kevin R <krandall2013@...il.com>)

July 3 (1 message)

Re: [FD] XXE in WeChat Pay Sdk ( WeChat leave a backdoor on merchant websites) (Rose Jackcode <1024rosecode@...il.com>)

July 4 (3 messages)

[FD] SEC Consult SA-20180704-0 :: Local root jailbreak via network file sharing flaw in all ADB Broadband Gateways / Ro… (SEC Consult Vulnerability Lab <research…)
[FD] SEC Consult SA-20180704-1 :: Authorization Bypass in all ADB Broadband Gateways / Routers (SEC Consult Vulnerability Lab <research@...-consult.com>)
[FD] SEC Consult SA-20180704-2 :: Privilege escalation via linux group manipulation in all ADB Broadband Gateways / Rou… (SEC Consult Vulnerability Lab <research…)

July 6 (8 messages)

[FD] Sophos Safeguard Products - Multiple Privilege Escalation Vulnerabilities. (Kyriakos Economou <kyrecon@...i-reversing.com>)
[FD] c0c0n XI | The cy0ps c0n - Call For Papers & Call For Workshops extended till July 15th (Prajwal Panchmahalkar <prajwal.hy468@...il.com>)
[FD] APPLE-SA-2018-7-05-1 Wi-Fi Update for Boot Camp 6.4.0 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] DSA-2018-117 RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability (Dell EMC Product Security Response Center <Security_Alert@....c…)
[FD] info-zip, zip command crash. (오세훈 <sehun.oh@...erone.kr>)
[FD] can (should?) packets from unauthentcated wifi devices enter layer2 ? (devzero@....de)
[FD] [CVE-2018-3667, CVE-2018-3668] Escalation of priviilege via executable installer of Intel Processor Diagnostic To… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] Microsoft Forefront Unified Access Gateway 2010 External DNS Interaction (Thierry Zoller <thierry@...ler.lu>)

July 10 (10 messages)

[FD] VLC media player 2.2.8 Arbitrary Code Execution PoC ("Eugene NG (GOVTECH)" <Eugene_NG@...h.gov.sg>)
[FD] [CVE-2018-10197] ELO 9/10 - Time-Based blind SQL injection (Jens Regel <jregel@...neider-wulf.de>)
[FD] APPLE-SA-2018-7-9-1 iOS 11.4.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-7-9-2 watchOS 4.3.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-7-9-3 tvOS 11.4.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-7-9-4 macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capita… (Apple Product Security <product-securit…)
[FD] APPLE-SA-2018-7-9-5 Safari 11.1.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-7-9-6 iCloud for Windows 7.6 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-7-9-7 iTunes 12.8 for Windows (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Crashing Facebook Messenger for Android with an MITM attack (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)

July 11 (8 messages)

[FD] SEC Consult SA-20180711-0 :: Remote code execution via multiple attack vectors in WAGO e!DISPLAY 7300T (SEC Consult Vulnerability Lab <research@...-consul…)
[FD] Secutech DSL WR RIS 330 - Filter Bypass Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Intel System CU - Buffer Overflow (Denial of Service) Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] ASUS WRT-AC66U 3.x - Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Barracuda ADC 5.x - Filter Bypass & Persistent Validation Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Barracuda ADC 5.x - Client Side Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] AT&T Bizcircle - Persistent Profile Cross Site Scripting Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities (Core Security Advisories Team <advisories@...esecurity.com>)

July 12 (5 messages)

[FD] DSA-2018-084: RSA Identity Governance and Lifecycle Multiple Vulnerabilities (Dell EMC Product Security Response Center <Security_Alert@....com>)
[FD] Lenovo SU v5.07 - Buffer Overflow & Arbitrary Code Execution Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Barracuda ADC v5.x - Multiple Persistent Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
[FD] SEC Consult SA-20180712-0 :: Remote Code Execution & Local File Disclosure in Zeta Producer Desktop CMS (SEC Consult Vulnerability Lab <research@...-consu…)
[FD] HackRF Circuit Board - New Universal Case for Devs & Pentesters (Vulnerability Lab <research@...nerability-lab.com>)

July 13 (6 messages)

[FD] 0day CVE-2018-12463 (alt3kx via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] XSS in OpenConext-EngineBlock 5.7.0 to 5.7.3 (Andrew Klaus <andrewklaus@...il.com>)
[FD] eScan ISS for Business v14.0.1400.2029 - BSOD through of a IOCTL (filipe <filipe.xavier@...pest.com.br>)
[FD] Total AV 4.1.7 ~ 4 .6.19 - Insecure Permissions (filipe <filipe.xavier@...pest.com.br>)
[FD] G DATA TOTAL SECURITY v25.4.0.3 Activex Buffer Overflow (filipe <filipe.xavier@...pest.com.br>)
[FD] Huawei eNSP v1 - Buffer Overflow (DoS) Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 17 (1 message)

[FD] CSRF vulnerabilities in D-Link DIR-300 ("MustLive" <mustlive@...security.com.ua>)

July 18 (5 messages)

[FD] Barracuda Cloud Control v3.020 - CS Cross Site Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Barracuda Cloud Control 7.1.1.003 - Cross Site Scripting Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Binance v1.5.0 - Insecure File Permission Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] GhostMail - (filename to link) POST Inject Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[FD] GhostMail - (Status Message) Persistent Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 19 (1 message)

[FD] Adobe Systems - Arbitrary Code Injection Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)

July 20 (12 messages)

[FD] Adobe Patches Vulnerability Affecting Internal Systems (Vulnerability Lab <research@...nerability-lab.com>)
[FD] Capstone disassembler framework v3.0.5 is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] Oracle WebLogic - Multiple SAML Vulnerabilities (CVE-2018-2998/CVE-2018-2933) (Denis Andzakovic via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] CIRITICAL code injection vulnerability in National Instruments Linux driver package ("Enrico Weigelt, metux IT consult" <info@...ux.net>)
[FD] [CVE-2018-1000211] Public apps can't revoke OAuth access & refresh tokens in Doorkeeper (Justin Bull <me@...tinbull.ca>)
[FD] DSA-2018-130: RSA Archer® Multiple Vulnerabilities (Dell EMC Product Security Response Center <Security_Alert@....com>)
[FD] Defense in depth -- the Microsoft way (part 55): new software built with 5.5 year old tool shows 20+ year old vuln… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] Defense in depth -- the Microsoft way (part 56): 10+ year old security update installers are susceptiblle to 20+ y… ("Stefan Kanthak" <stefan.kanthak@...go.…)
[FD] [CVE-2018-12996] Zoho manageengine Applications Manager Reflected XSS ("xiaotian.wang"<xiaotian.wang@...ppsecurity.com.cn>)
[FD] [CVE-2018-12997]Zoho manageengine Arbitrary File Read in multiple Products ("xiaotian.wang"<xiaotian.wang@...ppsecurity.com.cn>)
[FD] [CVE-2018-12999]Zoho manageengine Desktop Central Arbitrary File Deletion ("xiaotian.wang"<xiaotian.wang@...ppsecurity.com.cn>)
[FD] [CVE-2018-12998]Zoho manageengine Reflected XSS in multiple Products ("xiaotian.wang"<xiaotian.wang@...ppsecurity.com.cn>)

July 23 (1 message)

[FD] Network Manager VPNC - Privilege Escalation (CVE-2018-10900) (Denis Andzakovic via Fulldisclosure <fulldisclosure@...lists.org>)

July 24 (8 messages)

[FD] CleanMyMac3 local privilege escalation (Chi Chou <codecolorist@...il.com>)
[FD] APPLE-SA-2018-7-23-1 Additional information for APPLE-SA-2018-7-9-4 macOS High Sierra 10.13.6, Security Update 20… (Apple Product Security <product-securit…)
[FD] APPLE-SA-2018-7-23-2 Additional information for APPLE-SA-2018-06-01-1 macOS High Sierra 10.13.5, Security Update … (Apple Product Security <product-securit…)
[FD] APPLE-SA-2018-7-23-3 Additional information for APPLE-SA-2018-06-01-4 iOS 11.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-7-23-4 Additional information for APPLE-SA-2018-06-01-6 tvOS 11.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2018-7-23-5 Additional information for APPLE-SA-2018-06-01-5 watchOS 4.3.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] FINAL CALL FOR PAPERS - INTEL SECURITY CONFERENCE (iSecCon) 2018 ("Branco, Rodrigo" <rodrigo.branco@...el.com>)
[FD] Integer overflow in Tracto ERC20 (姚志华 <zhihua.yao@...ppsecurity.com.cn>)

July 26 (2 messages)

[FD] [CORE-2018-0009] - SoftNAS Cloud OS Command Injection (Core Security Advisories Team <advisories@...esecurity.com>)
[FD] [CORE-2018-0009] - SoftNAS Cloud OS Command Injection (Core Security Advisories Team <advisories@...esecurity.com>)

July 27 (7 messages)

[FD] DefenseCode ThunderScan SAST Advisory: WordPress Snazzy Maps Plugin Multiple XSS Security Vulnerabilities (Defense Code <defensecode@...ensecode.com>)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Strong Testimonials Plugin Multiple XSS Security Vulnerabilities (Defense Code <defensecode@...ensecode.c…)
[FD] DefenseCode ThunderScan SAST Advisory: WordPress Gwolle Guestbook Plugin XSS Security Vulnerability (Defense Code <defensecode@...ensecode.com>)
[FD] Faraday V3.0 Released (Francisco Amato <famato@...obytesec.com>)
[FD] More - Google supported XSS kit aka AdExchange iframe buster kit (Zmx) (Zmx <larouanne@...il.com>)
[FD] DSA-2018-120: Dell EMC NetWorker Clear-Text authentication over network vulnerability (Dell EMC Product Security Response Center <Security_Alert@....com>)
[FD] Integer overflow in SunContract (姚志华 <zhihua.yao@...ppsecurity.com.cn>)

94 messages