full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2018/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³	⁴ 9	⁵ 1	⁶	⁷ 11	⁸	⁹
¹⁰ 1	¹¹ 4	¹²	¹³	¹⁴ 6	¹⁵	¹⁶
¹⁷	¹⁸	¹⁹	²⁰	²¹ 16	²²	²³
²⁴	²⁵	²⁶	²⁷	²⁸	²⁹	³⁰
³¹ 8

Messages by day:

December 4 (9 messages)

[FD] SolarWinds SFTP Vulnerabilities (Alex Craggs <ajcraggs@...il.com>)
[FD] CVE-2018-11741 / CVE-2018-11742 / NEC Univerge Sv9100 WebPro - 6.00 / Predictable Session ID / Clear Text Password Sto… (hyp3rlinx <apparitionsec@...il.com>)
[FD] Multiple Reflected Cross-site Scripting Vulnerabilities in Seopanel 3.13.0 (Daniel Bishtawi <daniel@...sparker.com>)
[FD] Multiple Cross-Site Scripting Vulnerabilities in FreshRSS 1.11.1 (Daniel Bishtawi <daniel@...sparker.com>)
[FD] Reflected Cross-site Scripting Vulnerability in CubeCart 6.2.2 (Daniel Bishtawi <daniel@...sparker.com>)
[FD] Reflected Cross-site Scripting Vulnerability in Typesetter 5.1 (Daniel Bishtawi <daniel@...sparker.com>)
[FD] SQL Injection and Cross-site Scripting Vulnerabilities in Chamilo 1.11.6 (Daniel Bishtawi <daniel@...sparker.com>)
[FD] Multiple Cross-site Scripting Vulnerabilities in OSclass 3.7.4 (Daniel Bishtawi <daniel@...sparker.com>)
[FD] Multiple Cross-site Scripting and Blind SQL Injection Vulnerabilities in Plikli 4.0.0 (Daniel Bishtawi <daniel@...sparker.com>)

December 5 (1 message)

[FD] SEC Consult SA-20181205-0 :: Inadequate cryptography implementation in Kerio Control VPN protocol (SEC Consult Vulnerability Lab <research@...-consult.com…)

December 7 (11 messages)

[FD] Cross-Site Scripting in Adiscon LogAnalyzer (CVE-2018-19877) (Gustavo Sorondo <gs@...tainfinita.com.ar>)
[FD] APPLE-SA-2018-12-05-1 iOS 12.1.1 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra (Apple Product Security via Fulldisclosu…)
[FD] APPLE-SA-2018-12-05-3 tvOS 12.1.1 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2018-12-05-4 Safari 12.0.2 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2018-12-05-5 iTunes 12.9.2 for Windows (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2018-12-05-7 Shortcuts 2.1.2 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2018-12-05-6 iCloud for Windows 7.9 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2018-12-06-1 watchOS 5.1.2 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [CVE-2018-19861, CVE-2018-19862] Buffer overflow in MiniShare 1.4.1 HEAD and POST method (Rafael Pedrero <rafael.pedrero@...il.com>)
[FD] [CVE-2018-19649, CVE-2018-19765 to CVE-2018-19775, CVE-2018-19809 to CVE-2018-19822] - Multiple Cross Site Scripti… (Rafael Pedrero <rafael.pedrero@...il.co…)

December 10 (1 message)

[FD] Multiple vulnerabilities found in Trendnet routers and IP Cameras. (Prashast Srivastava <prashast.srivastava@...il.com>)

December 11 (4 messages)

[FD] [CFP] Security BSides Ljubljana 0x7E3 | March 16, 2019 (Andraz Sraka <a@...bix.org>)
[FD] Vmware airwatch feature (Jacek Lipkowski <fdlist@...kowski.org>)
[FD] Dynamic Loader Oriented Programming - Wiedergaenger PoC (Proof of Concept) on Ubuntu 16.04.5 LTS - 2018 (Marcin Kozlowski <marcinguy@...il.com>)
[FD] Zoho ManageEngine OpManager 12.3 before Build 123237 has XSS via the domainController API. (Murat Aydemir <murat.aydemir@...net.com.tr>)

December 14 (6 messages)

[FD] CVE-2018-7690 | The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities (alt3kx via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] CVE-2018-7691 | The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities (alt3kx via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Mikrotik RouterOS telnet arbitrary root file creation 0day (Hacker Fantastic via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] GNU inetutils <= 1.9.4 telnet.c multiple overflows (Hacker Fantastic via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] YSTS 13th Edition - CFP (Luiz Eduardo <le@...s.org>)
[FD] Tracking Linux Kernel Vulnerabilities (Nicholas Luedtke <nicholas.luedtke@...lumni.com>)

December 21 (16 messages)

[FD] LibTIFF 4.0.8 has multiple memory leak vulnerabilities (CVE-2017-16232) ("zzt0907" <16362505@...com>)
[FD] Buffer Overflow in function match() PCRE 8.41 (CVE-2017-16231) ("zzt0907" <16362505@...com>)
[FD] [CORE-2017-0012] - ASUS Drivers Elevation of Privilege Vulnerabilities (advisories <advisories@...ureauth.com>)
[FD] [CORE-2018-0007] - GIGABYTE Driver Elevation of Privilege Vulnerabilities (advisories <advisories@...ureauth.com>)
[FD] Capstone disassembler v4.0 is out! (Nguyen Anh Quynh <aquynh@...il.com>)
[FD] Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API (Murat Aydemir <murat.aydemir@...net.com.tr>)
[FD] Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section (Murat Aydemir <murat.aydemir@...net.com.tr>)
[FD] Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section (Murat Aydemir <murat.aydemir@...net.com.tr>)
[FD] New vulnerabilities in Transcend Wi-Fi SD Card ("MustLive" <mustlive@...security.com.ua>)
[FD] DAVOSET v.1.3.7 ("MustLive" <mustlive@...security.com.ua>)
[FD] CVE-2018-20193 - Privilege escalation in Juniper Secure Access SSL VPN - SA-4000, 5.1R5 (build 9627) 4.2 Release (… (Rafael Pedrero <rafael.pedrero@...il.co…)
[FD] CVE-2018-20211 - DLL Hijacking in Exiftool v8.3.2.0 (Rafael Pedrero <rafael.pedrero@...il.com>)
[FD] [CVE-2018-18007] atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credential… (Tyler Cui <tyler.cui@...e.com>)
[FD] [CVE-2018-18008] spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover… (Tyler Cui <tyler.cui@...e.com>)
[FD] [CVE-2018-18009] dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin… (Tyler Cui <tyler.cui@...e.com>)
Re: [FD] LibTIFF 4.0.8 has multiple memory leak vulnerabilities (CVE-2017-16232) (Henri Salo <henri@...v.fi>)

December 31 (8 messages)

[FD] [KIS-2018-01] Oracle Application Express (AnyChart) Flash-based Cross-Site Scripting Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2018-02] SugarCRM (WorkFlow module) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2018-03] SugarCRM (portal_get_related_notes) SQL Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2018-04] SugarCRM (ConnectorsController) Server-Side Request Forgery Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2018-05] SugarCRM (SaveDropDown) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2018-06] SugarCRM (addLabels) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2018-07] SugarCRM (Web Logic Hooks module) PHP Code Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2018-08] SugarCRM (Web Logic Hooks module) Path Traversal Vulnerability (Egidio Romano <research@...mainsecurity.com>)

56 messages