full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2022/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹	²	³	⁴ 3	⁵	⁶
⁷	⁸	⁹ 12	¹⁰	¹¹	¹²	¹³
¹⁴	¹⁵ 15	¹⁶	¹⁷	¹⁸	¹⁹	²⁰
²¹ 13	²² 4	²³ 1	²⁴	²⁵	²⁶ 4	²⁷
²⁸	²⁹ 9	³⁰	³¹

Messages by day:

March 4 (3 messages)

[FD] AST-2022-004: pjproject: integer underflow on STUN message ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2022-005: pjproject: undefined behavior after freeing a dialog set ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2022-006: pjproject: unconstrained malformed multipart SIP message ("Asterisk Security Team" <security@...erisk.org>)

March 9 (12 messages)

[FD] Mr. Post - Outlook Add-in - Data Theft Risk (Jonathan Gregson via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] New Release: UFONet v1.8 - "DarK-PhAnT0m!"... (psy <epsylon@...eup.net>)
[FD] Backdoor.Win32.Augudor.a / Unauthenticated Remote File Write - RCE (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.BNLite / Remote Stack Buffer Overflow (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.FTP.Nuclear.10 / Hardcoded Credentials (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.BluanWeb / Unauthenticated Remote Code Execution (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.BluanWeb / Information Disclosure (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.BluanWeb / Unauthenticated Remote Command Execution (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.RemoteNC.beta4 / Unauthenticated Remote Command Execution (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.DirectConnection.103 (1.0 RAT-Tool) / Weak Hardcoded Password (malvuln <malvuln13@...il.com>)
[FD] Loki RAT (Relapse) / Directory Traversal - Arbitrary File Delete (malvuln <malvuln13@...il.com>)
[FD] Loki RAT (Relapse) / SQL Injection (malvuln <malvuln13@...il.com>)

March 15 (15 messages)

[FD] CVE-2021-45040 - Laravel Media Library Pro <=2.1.6 - Arbitrary File Upload (Unauthenticated) (Kelvin Yip <kelvin@...ersecthreat.com>)
[FD] RedLine.MainPanel - cracked.exe / Insecure Permissions (malvuln <malvuln13@...il.com>)
[FD] Hades RAT - Web Panel / Insecure Credential Storage (malvuln <malvuln13@...il.com>)
[FD] Hades RAT - Web Panel / Information Disclosure (malvuln <malvuln13@...il.com>)
[FD] Hades RAT - Web Panel / Remote Persistent XSS (malvuln <malvuln13@...il.com>)
[FD] APPLE-SA-2022-03-14-8 Logic Pro X 10.7.3 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-9 GarageBand 10.4.6 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-6 Security Update 2022-003 Catalina (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-7 Xcode 13.3 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-10 iTunes 12.12.3 for Windows (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-5 macOS Big Sur 11.6.5 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-3 tvOS 15.4 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-1 iOS 15.4 and iPadOS 15.4 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-2 watchOS 8.5 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] APPLE-SA-2022-03-14-4 macOS Monterey 12.3 (Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>)

March 21 (13 messages)

[FD] CVE-2021-45490: Missing Certificate Verification in 3CX Client for Windows (legacy), Android & iOS (Emanuel DUSS <emanuel.duss@...pass-security.com>)
[FD] CVE-2021-45491: Exportable Cleartext Passwords in the 3CX Phone System (Emanuel DUSS <emanuel.duss@...pass-security.com>)
[FD] [CVE-2021-42063] SAP Knowledge Warehouse <= 7.50 "SAPIrExtHelp" Reflected XSS ("Julien Ahrens (RCE Security)" <info@...security.com>)
[FD] BuilderOrcus (Orcus.Administration-cracked.exe) / Insecure Permissions (malvuln <malvuln13@...il.com>)
[FD] BuilderOrcus (Orcus.Administration-cracked.exe) / Insecure Credential Storage (malvuln <malvuln13@...il.com>)
[FD] BuilderPandoraRat.b - (Pandora Rat 2.2 [Beta].exe) / Insecure Credential Storage (malvuln <malvuln13@...il.com>)
[FD] BuilderTorCTPHPRAT.b / Insecure Credential Storage (malvuln <malvuln13@...il.com>)
[FD] BuilderTorCTPHPRAT.b / Arbitrary File Upload - RCE (malvuln <malvuln13@...il.com>)
[FD] BuilderTorCTPHPRAT.b / Remote Persistent XSS (malvuln <malvuln13@...il.com>)
[FD] BuilderRevengeRAT - (Revenge-RAT v0.3) / XML External Entity Injection (malvuln <malvuln13@...il.com>)
[FD] Adversary3 v1.0 - Malware vulnerability intel tool for third-party attackers. (malvuln <malvuln13@...il.com>)
[FD] [CFP-ESORICS 2022]: 27th European Symposium on Research in Computer Security (ESORICS) 2022 (CFP - ESORICS 2022 <publicitychair.conf@...il.com>)
[FD] Open-Xchange Security Advisory 2022-03-21 (Martin Heiland via Fulldisclosure <fulldisclosure@...lists.org>)

March 22 (4 messages)

[FD] [KIS-2022-01] ImpressCMS <= 1.4.2 (autologin.php) Authentication Bypass Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2022-02] ImpressCMS <= 1.4.2 (image-edit.php) Path Traversal Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2022-03] ImpressCMS <= 1.4.2 (findusers.php) Incorrect Access Control Vulnerability (Egidio Romano <research@...mainsecurity.com>)
[FD] [KIS-2022-04] ImpressCMS <= 1.4.3 (findusers.php) SQL Injection Vulnerability (Egidio Romano <research@...mainsecurity.com>)

March 23 (1 message)

[FD] ImpressCMS: from unauthenticated SQL injection to RCE (Egidio Romano <research@...mainsecurity.com>)

March 26 (4 messages)

[FD] The Knights of NYNEX presents: Akhlut prowling terror (Knights of Nynex via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Backdoor.Win32.Agent.bxxn / Open Proxy (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.BirdSpy.b / Weak Hardcoded Credentials (malvuln <malvuln13@...il.com>)
[FD] [SYSS-2021-058] Razer Synapse - Local Privilege Escalation (Oliver Schwarz <oliver.schwarz@...s.de>)

March 29 (9 messages)

[FD] PHP filter_var vulnerability (Jordy Zomer <jordy@...ing.systems>)
Re: [FD] ImpressCMS: from unauthenticated SQL injection to RCE (Egidio Romano <n0b0d13s@...il.com>)
[FD] Backdoor.Win32.Cyn.20 / Insecure Permissions (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.Cafeini.b / Denial of Service (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.Cafeini.b / Weak Hardcoded Credentials (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.Chubo.c / Unauthenticated Remote Command Execution (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.Chubo.c / Cross Site Scripting (XSS) (malvuln <malvuln13@...il.com>)
[FD] Backdoor.Win32.Avstral.e / Unauthenticated Remote Command Execution (malvuln <malvuln13@...il.com>)
[FD] [KIS-2022-05] Joomla! <= 4.1.0 (Tar.php) Zip Slip Vulnerability (Egidio Romano <research@...mainsecurity.com>)

61 messages