full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2024/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹	²	³	⁴ 1
⁵	⁶ 2	⁷ 2	⁸ 4	⁹	¹⁰	¹¹ 6
¹²	¹³ 2	¹⁴	¹⁵	¹⁶	¹⁷	¹⁸ 9
¹⁹	²⁰	²¹	²² 12	²³	²⁴	²⁵ 2
²⁶	²⁷ 1	²⁸	²⁹	³⁰	³¹

Messages by day:

August 4 (1 message)

[FD] Blind SQL Injection - dolphinv7.4.2. (Andrey Stoykov <mwebsec@...il.com>)

August 6 (2 messages)

[FD] CVE-2024-40101 exploit: Reflected Cross-Site Scripting (XSS) on Microweber (masquerad3r <masquerad3r@...il.com>)
[FD] CyberDanube Security Research 20240805-0 | Multiple Vulnerabilities in JetPort Series (Thomas Weber via Fulldisclosure <fulldisclosure@...lists.org>)

August 7 (2 messages)

[FD] KL-001-2024-005: Open WebUI Stored Cross-Site Scripting (KoreLogic Disclosures via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] KL-001-2024-006: Open WebUI Arbitrary File Upload + Path Traversal (KoreLogic Disclosures via Fulldisclosure <fulldisclosure@...lists.org>)

August 8 (4 messages)

[FD] KL-001-2024-007: Journyx Unauthenticated Password Reset Bruteforce (KoreLogic Disclosures via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] KL-001-2024-008: Journyx Authenticated Remote Code Execution (KoreLogic Disclosures via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] KL-001-2024-009: Journyx Reflected Cross Site Scripting (KoreLogic Disclosures via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] KL-001-2024-010: Journyx Unauthenticated XML External Entities Injection (KoreLogic Disclosures via Fulldisclosure <fulldisclosure@...lists.org>)

August 11 (6 messages)

[FD] Certified Asterisk Security Release certified-18.9-cert11 (Asterisk Development Team via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Certified Asterisk Security Release certified-20.7-cert2 (Asterisk Development Team via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Asterisk Security Release 18.24.2 (Asterisk Development Team via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Asterisk Security Release 20.9.2 (Asterisk Development Team via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Asterisk Security Release 21.4.2 (Asterisk Development Team via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Backdoor.Win32.Nightmare.25 / Unauthenticated Remote Command Execution (malvuln <malvuln13@...il.com>)

August 13 (2 messages)

[FD] Microsoft PlayReady WMRMECC256 Key / root key issue (attack #5) (Security Explorations <contact@...urity-explorations.com>)
Re: [FD] Microsoft PlayReady WMRMECC256 Key / root key issue (attack #5) (Security Explorations <contact@...urity-explorations.com>)

August 18 (9 messages)

[FD] CVE-2024-23184: Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensi… (Aki Tuomi via Fulldisclosure <fulldiscl…)
[FD] Dovecot CVE-2024-23185: Very large headers can cause resource exhaustion when parsing message (Aki Tuomi via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Improper Neutralization of Input During Web Page Generation (CWE-79) CVE-2024-33893 (Moritz Abrell via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Cleartext Storage of Sensitive Information in a Cookie (CWE-315) CVE-2024-33892 (Moritz Abrell via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) CVE-2024-33896 (Moritz Abrell via Fulldisclosure <fulld…)
[FD] Use of Hard-coded Cryptographic Key (CWE-321) CVE-2024-33895 (Moritz Abrell via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Execution with Unnecessary Privileges (CWE-250) CVE-2024-33894 (Moritz Abrell via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Improper Authentication (CWE-287) CVE-2024-33897 (Moritz Abrell via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] Authenticated Code Injection - smfv2.1.4 (Andrey Stoykov <mwebsec@...il.com>)

August 22 (12 messages)

[FD] ` Piano ` (Teri Olson <morrisstout9881593@...il.com>)
Re: [FD] Improper Authentication (CWE-287) CVE-2024-33897 (Jeffrey Walton <noloader@...il.com>)
[FD] [SYSS-2024-036] DiCal-RED - Missing Authentication for Critical Function (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [SYSS-2024-035] DiCal-RED - Missing Authentication for Critical Function (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [SYSS-2024-037] DiCal-RED - Use of Password Hash With Insufficient Computational Effort (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [SYSS-2024-038] DiCal-RED - Use of Password Hash Instead of Password for Authentication (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [SYSS-2024-039] DiCal-RED - Path Traversal (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [SYSS-2024-040] DiCal-RED - Improper Authentication (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [SYSS-2024-041] DiCal-RED - Use of Unmaintained Third Party Components (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] [SYSS-2024-042] DiCal-RED - Exposure of Sensitive Information to an Unauthorized Actor (Sebastian Hamann via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] OXAS-ADV-2024-0004: OX App Suite Security Advisory (Martin Heiland via Fulldisclosure <fulldisclosure@...lists.org>)
[FD] OXAS-ADV-2024-0003: OX App Suite Security Advisory (Martin Heiland via Fulldisclosure <fulldisclosure@...lists.org>)

August 25 (2 messages)

[FD] SCHUTZWERK-SA-2024-004: Buffer overread in U-Boot DHCP (David Brown via Fulldisclosure <fulldisclosure@...lists.org>)
Re: [FD] [SYSS-2024-038] DiCal-RED - Use of Password Hash Instead of Password for Authentication (Jeffrey Walton <noloader@...il.com>)

August 27 (1 message)

Re: [FD] [SYSS-2024-038] DiCal-RED - Use of Password Hash Instead of Password for Authentication ("J. Hellenthal via Fulldisclosure" <fulldisclosure@...lists.o…)

41 messages