full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2020/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 5	² 2	³	⁴ 9	⁵	⁶
⁷ 6	⁸ 2	⁹	¹⁰	¹¹ 6	¹² 1	¹³
¹⁴	¹⁵ 3	¹⁶	¹⁷	¹⁸ 7	¹⁹	²⁰
²¹	²² 6	²³	²⁴	²⁵ 1	²⁶	²⁷
²⁸	²⁹ 7	³⁰

Messages by day:

September 1 (5 messages)

[FD] Bagisto: Insecure installation in sub-directories (devsecweb--- via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Bagisto: Default credentials for admin interface (devsecweb--- via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Roundcube issue - Auth bypass via Improper Session Management (Balázs Hambalkó <hambalko.balazs@...il.com>)
[FD] Sagemcom router insecure deserialization > privilege escalation (Ryan Delaney <ryan.delaney@...sp.org>)
[FD] Kamailio vulnerable to header smuggling possible due to bypass of remove_hf ("Sandro Gauci" <sandro@...blesecurity.com>)

September 2 (2 messages)

[FD] [RT-SA-2020-004] Inconsistent Behavior of Go's CGI and FastCGI Transport May Lead to Cross-Site Scripting (RedTeam Pentesting GmbH <release@...team-pentes…)
[FD] SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W (SEC Consult Vulnerability Lab <research@...-cons…)

September 4 (9 messages)

[FD] Hyland OnBase 19.x and below - SQL Injection (Adaptive Security Consulting via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Hyland OnBase 19.x and below - Insufficient Logging (Client-Side Enforcement of Server-Side Security) (Adaptive Security Consulting via Fulldisclosure <f…)
[FD] Hyland OnBase 19.x and below - CSRF (Adaptive Security Consulting via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Full Disclosure - Telnet Hardcoded credentials - CVE-2018-20432 (CSW Research Lab <disclose@...ersecurityworks.com>)
[FD] Noise-Java AESGCMFallbackCipherState.encryptWithAd() insufficient boundary checks (Pietro Oliva via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Noise-Java AESGCMOnCtrCipherState.encryptWithAd() insufficient boundary checks (Pietro Oliva via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Noise-Java ChaChaPolyCipherState.encryptWithAd() insufficient boundary checks (Pietro Oliva via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Pulse Secure Windows Client <9.1.6 (CVE-2020-13162) - exploit (Red Timmy Security <publications@...timmy.com>)
[FD] Open Source Tool | vPrioritization | Risk Prioritization Framework (Pramod Rana <varchashva@...il.com>)

September 7 (6 messages)

[FD] Hyland OnBase 19.x and below - Insufficient Authorization (Client-Side Enforcement of Server-Side Security) (AdaptiveSecurity Consulting via Fulldisclosur…)
[FD] Hyland OnBase 19.x and below - Log Injection And Denial Of Service (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Hyland OnBase 19.x and below - Hardcoded PKI Certificates And AES Key Material (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.o…)
[FD] Hyland OnBase 19.x and below - Unity Client Malformed Image Denial Of Service (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.or…)
[FD] Hyland OnBase 19.x and below - DLL Hijacking (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Hyland OnBase 19.x and below - Path Traversal (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)

September 8 (2 messages)

[FD] Hyland OnBase 19.x and below - Insecure Deserialization (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Hyland OnBase 19.x and below - XML External Entity (XXE) Injection (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)

September 11 (6 messages)

[FD] Hyland OnBase 19.x and below - Unrestricted File Upload (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Hyland OnBase 19.x and below - Data Import Denial Of Service (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Two vulnerabilities found in MikroTik's RouterOS (Q C <cq674350529@...il.com>)
[FD] Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37 (Daniel Bishtawi via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze (Jason Geffner <geffner@...il.com>)
[FD] CVE-2020-8152 – Elevation of Privilege in Backblaze (Jason Geffner <geffner@...il.com>)

September 12 (1 message)

[FD] Windows TCPIP Finger Command / C2 Channel and Bypassing Security Software (hyp3rlinx <apparitionsec@...il.com>)

September 15 (3 messages)

[FD] ARA-2020-005: Insecure Direct Object Reference in 1CRM (CVE-2020-15958) (Andreas Sperber <andreas.sperber@...mido.de>)
[FD] ModSecurity v3 affected by DoS (CVE-2020-15598) (Christian Folini <christian.folini@...nea.com>)
[FD] [CVE-2020-16171] Acronis Cyber Backup <= v12.5 Build 16341 Full Unauthenticated SSRF ("Julien Ahrens (RCE Security)" <info@...security.com>)

September 18 (7 messages)

[FD] Apache + PHP <= 7.4.10 open_basedir bypass (Havijoori via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Navy Federal Reflective Cross Site Scripting (XSS) (Juan Avila <javila@...hrocyber.com>)
[FD] APPLE-SA-2020-09-16-1 iOS 14.0 and iPadOS 14.0 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2020-09-16-2 tvOS 14.0 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2020-09-16-3 Safari 14.0 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2020-09-16-4 watchOS 7.0 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2020-09-16-5 Xcode 12.0 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)

September 22 (6 messages)

[FD] Seat Reservation System 1.0 Unauthenticated Remote Code Execution (CVE-2020-25763) (Ava Tester One <avatesterone@...il.com>)
[FD] Seat Reservation System 1.0 Unauthenticated SQL Injection (CVE-2020-25762) (Ava Tester One <avatesterone@...il.com>)
[FD] Visitor Management System in PHP 1.0 - Authenticated SQL Injection (Ava Tester One <avatesterone@...il.com>)
[FD] Visitor Management System in PHP 1.0 - Unauthenticated Stored XSS (Ava Tester One <avatesterone@...il.com>)
[FD] [CVE-2020-25203] Frame Preview "com.framer.viewer.FramerViewActivity" Arbitrary URL Loading ("Julien Ahrens (RCE Security)" <info@...security.com>)
[FD] Google's osconfig agent - local privilege escalation (Imre Rad <radimre83@...il.com>)

September 25 (1 message)

[FD] APPLE-SA-2020-09-24-1 macOS Catalina 10.15.6 Supplemental Update, Security Update 2020-005 High Sierra, Security … (Apple Product Security via Fulldisclosu…)

September 29 (7 messages)

[FD] [SYSS-2020-025] DOMOS 5.8 - OS Command Injection (Patrick Hener <patrick.hener@...s.de>)
[FD] [SYSS-2020-024] Qiata FTA - Persistent Cross-Site Scripting (Patrick Hener <patrick.hener@...s.de>)
[FD] [SYSS-2019-049] Insufficient Session Expiration (CWE-613) in REDDOXX MailDepot (CVE-2019-19199) (Micha Borrmann <micha.borrmann@...s.de>)
[FD] Regarding the semi-recent OnBase vulnerabilities (Ken <catatonicprime@...il.com>)
[FD] Critical Information Disclosure on WP Courses plugin <= 2.0.29 exposes private course videos and materials (Red Timmy Security <publications@...timmy.com>)
[FD] CVE-2020-24721: Corona Exposure Notifications API: risk of coercion/data leakage [vs] (Dirk-Willem van Gulik <dirkx@...weaving.org>)
Re: [FD] Navy Federal Reflective Cross Site Scripting (XSS) (AdaptiveSecurity Consulting via Fulldisclosure <fulldisclosure@...lists.org>)

55 messages