Full Disclosure: by date

86 messages starting Jul 31 15 and ending Aug 30 15
Date index | Thread index | Author index

Friday, 31 July

PhotoPost PHP 4.8c Cookie Based Stored XSS (Cross-site Scripting) Web Application 0-Day Bug Jing Wang
Symantec Endpoint Protection Markus Wulftange

Saturday, 01 August

Re: Symantec Endpoint Protection Brandon Perry
Vulnerability in VirtueMart for Joomla MustLive

Sunday, 02 August

CODEBLUE.JP - Security Conference in Tokyo Calling for Papers by Sep.10 Kana Shinoda
New BlackArch Linux ISOs (version 2015.07.31) Black Arch

Monday, 03 August

Re: Symantec Endpoint Protection Markus Wulftange

Wednesday, 05 August

Mozilla extensions: a security nightmare Stefan Kanthak
SEC Consult SA-20150805-0 :: Websense Content Gateway Stack Buffer Overflow in handle_debug_network SEC Consult Vulnerability Lab
Re: Mozilla extensions: a security nightmare Mario Vilas
Comment form CSRF in WordPress 4.2.2 allows admin impersonation via comments dxw Security

Thursday, 06 August

Security Advisory - "Cross-VM ASL INtrospection (CAIN)" antonio
Vulnerable MSVC++ runtime distributed with LibreOffice 5.0.0 for Windows Stefan Kanthak
Re: Security Advisory - "Cross-VM ASL INtrospection (CAIN)" Артур Истомин
SCADA with antenna SCADA StrangeLove

Friday, 07 August

Ferrari - PHP CGI Argument Injection (RCE) Vulnerability Vulnerability Lab
Device Inspector v1.5 iOS - Command Inject Vulnerabilities Vulnerability Lab
Use After Free Vulnerability in unserialize() with SPL ArrayObject Taoguang Chen
Use After Free Vulnerability in unserialize() with SplDoublyLinkedList Taoguang Chen
Use After Free Vulnerability in unserialize() with SplObjectStorage Taoguang Chen
Re: Mozilla extensions: a security nightmare Dave Horsfall

Saturday, 08 August

Pineapple autopwn script 2.3.0 or lower versions. Electric Mind

Monday, 10 August

T Mobile Business - Client Side Cross Site Scripting Vulnerability Vulnerability Lab

Tuesday, 11 August

CVE-2015-5699 - Cumulus Linux's Switch Configuration Tools Backend, clcmd_server, Vulnerable to Local Privilege Escalation Gregory Pickett
Thomson Reuters FATCA - Local File Inclusion Etnies
Thomson Reuters FATCA - Arbitrary File Upload Etnies
php 7 use after free bug 牛保龙
Re: Mozilla extensions: a security nightmare Thomas D.
BigTree CMS 4.2.3 Multiple Cross-Site-Scripting Vulnerabilities Curesec Research Team
BigTree CMS 4.2.3 Multiple Sql Injections Curesec Research Team
CodoForum 3.3.1 Multiple Cross Site Scriptings Curesec Research Team
CodoForum 3.3.1 Multiple SQL Injections Curesec Research Team
Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack other users (WordPress plugin) dxw Security
Blind SQL Injection in WP Symposium allows unauthenticated attackers to access sensitive data (WordPress plugin) dxw Security
Reflected XSS in iframe allows unauthenticated users to do almost anything an admin can (WordPress plugin) dxw Security
Stored XSS in iframe allows less privileged users to do almost anything an admin can (WordPress plugin) dxw Security

Wednesday, 12 August

bizidea Design CMS 2015Q3 - SQL Injection Vulnerability Vulnerability Lab
[Onapsis Security Advisory 2015-011] SAP Mobile Platform DataVault Predictable encryption passwords for Configuration Values Onapsis Research Labs
[Onapsis Security Advisory 2015-010] SAP Mobile Platform DataVault Keystream Recovery Onapsis Research Labs
[Onapsis Security Advisory 2015-012] SAP Mobile Platform DataVault Predictable Encryption Password for Secure Storage Onapsis Research Labs
Open source tool for applying Google Chrome security updates David Leo
BFS-SA-2015-001: Internet Explorer CTreeNode::GetCascadedLang Use-After-Free Vulnerability Blue Frost Security Research Lab
Re: Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack other users (WordPress plugin) dxw Security
The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically secure (WordPress plugin) dxw Security
Re: The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically secure (WordPress plugin) Scott Arciszewski
Update: Backdoor and RCE found in 8 TOTOLINK router models Pierre Kim
Zend Framework <= 2.4.2 XML eXternal Entity Injection (XXE) on PHP FPM Dawid Golunski
Cisco Unified Communications Manager Multiple Vulnerabilities (VP2015-001) Vantage Point Security

Thursday, 13 August

SAP Security Notes August 2015 ERPScan inc
NetRipper - Smart traffic sniffing for penetration testers Poyo VL
APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 Apple Product Security
APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006 Apple Product Security
APPLE-SA-2015-08-13-3 iOS 8.4.1 Apple Product Security
APPLE-SA-2015-08-13-4 OS X Server v4.1.5 Apple Product Security
BFS-SA-2015-002: OpenSSH PAM Privilege Separation Vulnerabilities Blue Frost Security Research Lab
[CVE-2015-5617]Enorth Webpublisher CMS SQL Injection from delete_pending_news.jsp cbNewsid xin . wang

Friday, 14 August

ERPSCAN Research Advisory [ERPSCAN-15-012] SAP Afaria 7 XComms – Buffer Overflow ERPScan inc
Sandbox bypass through Google Admin WebView Vahagn Vardanyan

Saturday, 15 August

vBulletin x.x.x rce "0day" Joshua Rogers

Sunday, 16 August

Oracle CSO numbers, security hygiene and fixes at the same time Security Explorations

Monday, 17 August

Insufficient certificate validation in EMC Secure Remote Services Virtual Edition Securify B.V.
Weak authentication in EMC Secure Remote Services Virtual Edition Web Portal Securify B.V.
[ERPSCAN-15-013] SAP NetWeaver AS Java CIM UPLOAD – XXE ERPScan inc
Re: The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically secure (WordPress plugin) dxw Security
Severe weakness in checkout provider Borderfree allows users to easily control the prices they pay on ecommerce websites John Smith

Tuesday, 18 August

Phorum 5.2.19 - Reflected XSS and Open Redirect Curesec Research Team (CRT)
Bolt 2.2.4 - Code Execution Curesec Research Team (CRT)
ModX Revolution 2.3.5 - Reflected XSS Curesec Research Team (CRT)
UNIT4TETA TETA WEB - Authorization Bypass vulnerability Lukasz Miedzinski

Thursday, 20 August

Microsoft HTA (HTML Application) - Remote Code Execution Vulnerability (MS14-064) Vulnerability Lab
PDF Shaper v3.5 - (MSF) Remote Buffer Overflow Vulnerability Vulnerability Lab
ChiefPDF Software v2.x - Buffer Overflow Vulnerability Vulnerability Lab
WebSolutions India Design CMS - SQL Injection Vulnerability Vulnerability Lab
UBNT Bug Bounty #1 - Client Side Cross Site Scripting Vulnerability Vulnerability Lab
UBNT Bug Bounty #3 - Persistent Filename Vulnerability Vulnerability Lab

Thursday, 27 August

nullcon se7en CFP is open nullcon
AnchorCMS - PHP Object Injection (CVE-2015-5687) and More Scott Arciszewski
CSRF/XSS vulnerability in Private Only could allow an attacker to do almost anything an admin user can (WordPress plugin) dxw Security
Publicly exploitable XSS in WordPress plugin Navis Documentcloud (WordPress plugin) dxw Security

Friday, 28 August

Dogma India dogmaindia CMS - Auth Bypass Session Vulnerability Vulnerability Lab
LinuxOptic CMS 2009 - Auth Bypass Session Vulnerability Vulnerability Lab
PayPal Bug Bounty #119 - Stored Cross Site Scripting Vulnerability Vulnerability Lab
Photo Transfer (2) v1.0 iOS - Denial of Service Vulnerability Vulnerability Lab

Saturday, 29 August

Re: AnchorCMS - PHP Object Injection (CVE-2015-5687) and More Scott Arciszewski

Sunday, 30 August

KnowledgeTree OSS 3.0.3b Reflected XSS (Cross-site Scripting) Web Application 0-Day Security Bug Jing Wang
Winmail Server 4.2 Reflected XSS (Cross-site Scripting) Web Application 0-Day Security Bug Jing Wang

Previous period

Next period