Full Disclosure: by date

112 messages starting Jun 01 15 and ending Jun 30 15
Date index | Thread index | Author index

Monday, 01 June

[CFP] SOURCE Dublin, Sept 5-8, Trinity College Genevieve Southwick
Freebox OS Web interface 3.0.2 XSS, CSRF DAU Huy Ngoc
Call for Papers for 3rd Balkan Computer Congress – BalCCon2k15 Milos Krasojevic
t2'15: Call for Papers 2015 (Helsinki / Finland) Tomi Tuominen

Tuesday, 02 June

WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability Vulnerability Lab
Re: Safari Address Spoofing (How We Got It) David Leo
Re: Safari Address Spoofing (How We Got It) Michal Zalewski
Re: Safari Address Spoofing (How We Got It) Jeffrey Walton

Wednesday, 03 June

[Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc) Pedro Ribeiro

Thursday, 04 June

[CVE-2015-1234] Tanium all versions arbitrary file overwrite reek35
[CVE-2015-4051]: Beckhoff IPC diagnostics < 1.8 : Authentication bypass The Security Factory
Broken, Abandoned, and Forgotten Code, Part 7 Zach C

Friday, 05 June

1 Click Audio Converter v2.3.6 - Activex Buffer Overflow Vulnerability Lab
1 Click Audio Converter v2.3.6 - Activex Buffer Overflow Vulnerability Lab
1 Click Extract Audio v2.3.6 - Activex Buffer Overflow Vulnerability Lab

Tuesday, 09 June

NEW VMSA-2015-0004 - VMware Workstation, Fusion and Horizon View Client updates address critical security issues VMware Security Response Center
[call for paper] SIGIR workshop: privacy-preserving information retrieval Hongkai Wu
Re: [CVE-2015-1234] Tanium all versions arbitrary file overwrite Justin Burke
Xloner v3.1.2 wordpress plugin authenticated command execution and XSS Larry W. Cashdollar
[CVE-2015-4342]SQL Injection and Location header injection from cdef id xin.wang
Broken, Abandoned, and Forgotten Code, Intermission Zach C
Fwd: Potentially critical buffer overflow in TinySRP Douglas Held

Wednesday, 10 June

[RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session ID RedTeam Pentesting GmbH
[RT-SA-2015-004] Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery RedTeam Pentesting GmbH
Heroku Bug Bounty #2 - (API) Re Auth Session Bypass Vulnerability Vulnerability Lab
This POODLE Bites: Exploiting The SSL 3.0 Fallback Bruno Luiz
Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin Larry W. Cashdollar
Authentication Bypass in Pandora FMS Manuel Mancera
2 vulns 1 line in RNCryptor (PHP) + Call to Action Scott Arciszewski

Thursday, 11 June

[KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability Egidio Romano
[KIS-2015-02] Concrete5 <= 5.7.3.1 Multiple Reflected Cross-Site Scripting Vulnerabilities Egidio Romano
[KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability Egidio Romano
Apache vulnerability program faulting module ntdll.dll Bruno Luiz
SAP Security Notes June 2015 Darya Maenkova
6kbbs v8.0 Weak Encryption Cryptography Security Vulnerabilities Jing Wang
FC2 & Rakuten Online Websites Multiple XSS (Cross-site Scripting) and Open Redirect Cyber Vulnerabilities Jing Wang
Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Larry W. Cashdollar
D-Link DSP-W110 - multiple vulnerabilities Peter Adkins
XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 ) Stas Volfus

Friday, 12 June

The token order of OpVectorTimesScalar and OpMatrixTimesScalar which generated in glslangValidator isn't consistant with SPEC Aras Pranckevicius
Yoast Wordpress SEO Plugin <= 2.1.1 Stored, Authenticated XSS sec () inventropy us

Saturday, 13 June

OpenBSD "sys_execve()" Executable Header Parsing Denial of Service Vulnerability Bruno Luiz

Sunday, 14 June

E-Detective Lawful Interception System - multiple security vulnerabilities Mustafa Al-Bassam

Monday, 15 June

[RT-SA-2015-002] SQL Injection in TYPO3 Extension Akronymmanager RedTeam Pentesting GmbH
Cross-Site Request Forgery Vulnerability in Users to CSV Wordpress Plugin v1.4.5 Nitin Venkatesh
eBay Security Assessment cosmin0maier

Wednesday, 17 June

Re: Announcing NorthSec 2015 - Montreal, May 21-24 Pierre-d
[CVE-2015-4553]Dedecms variable coverage leads to getshell zise . shi

Thursday, 18 June

CVE-2015-4453 - Authentication bypass in OpenEMR Brian Hysell
SpiderOak.com - Disclousure of sensitive information Cosmin Maier
Broken, Abandoned, and Forgotten Code, Part 8 Zach C

Friday, 19 June

ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities Vulnerability Lab
ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability Vulnerability Lab
Ebay Magento Bug Bounty #17 - Client Side Cross Site Scripting Web Vulnerability Vulnerability Lab
Ebay Magento Bug Bounty #10 - Persistent Filename Vulnerability Vulnerability Lab
Ebay Magento Bug Bounty #12 - Cross Site Request Forgery Web Vulnerability Vulnerability Lab
IBM Domino Web Server Cross-site Scripting Vulnerability (CVE-2015-1981) MustLive
Cross-Site Request Forgery in Google Analyticator Wordpress Plugin v6.4.9.3 before rev @1183563 Nitin Venkatesh

Sunday, 21 June

Tutanota Encrypted Email service - Malleable Ciphertext (AES-CBC with no MAC) Scott Arciszewski
[Survey] Help shape the future of IDSs Antonio Augusto Santos

Monday, 22 June

ManageEngine Asset Explorer v6.1 - Persistent Vulnerability Vulnerability Lab

Tuesday, 23 June

ERPSCAN Research Advisory [ERPSCAN-15-003] SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-004] SAP NetWeaver Portal XMLValidationComponent - XXE Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-005] SAP Mobile Platform - XXE Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-006] SAP NetWeaver Portal ReportXmlViewer - XXE Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-007] SAP Management Console ReadProfile Parameters - Information disclosure Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-008] SAP Afaria 7 XcListener - DoS in the module XeClient.Dll Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-009] SAP Afaria 7 XcListener - Missing authorization check Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-010] SYBASE SQL Anywhere 12 and 16 - DoS Darya Maenkova
ERPSCAN Research Advisory [ERPSCAN-15-011] SAP Mobile Platform 3.0 - XXE Darya Maenkova
CVE-2015-4413 - Wordpress “Nextend Facebook Connect” Cross Site Scripting Liran Segal
CVE-2015-4557 - Wordpress “Nextend Twitter Connect” & “Nextend Google Connect” Cross Site Scripting Liran Segal
New version: smalisca - Static Code Analysis tool for Smali files Levon Kayan
Minds.com - Several Issues Scott Arciszewski
XSS vulnerability in manage engine. Suraj Krishnaswami
Haka v0.3.0 release Mehdi Talbi

Wednesday, 24 June

ROP 101 Blog Craig Young
Securing SAP Systems from XSS vulnerabilities Part 2: Defense for SAP NetWeaver ABAP Darya Maenkova
CVE-2015-3443 XSS in Thycotic Secret Server version 8.6.000000 to 8.8.000004 Marco Delai

Thursday, 25 June

Recomendation: Flaw in K9 Web Protection 4.4.268 ICSS Security
SBA Research Vulnerability Disclosure - Multiple Critical Vulnerabilities in Koha ILS Raschin Ghanad-Tavakoli

Friday, 26 June

SEC Consult SA-20150626-0 :: Critical vulnerabilities in Polycom RealPresence Resource Manager (RPRM) allow surveillance on conferences SEC Consult Vulnerability Lab
Remote file download vulnerability in download-zip-attachments v1.0 Larry W. Cashdollar
Arbitrary File download in wordpress plugin wp-instance-rename v1.0 Larry W. Cashdollar
Response to Decision Group press release about security vulnerabilities in E-Detective Lawful Interception System Mustafa Al-Bassam

Sunday, 28 June

Re: Response to Decision Group press release about security vulnerabilities in E-Detective Lawful Interception System Luke Walker

Monday, 29 June

WedgeOS Multiple Vulnerabilities Daniel Jensen
Watchguard XCS Multiple Vulnerabilities Daniel Jensen
Courier mail server: Write heap overflow in mailbot tool and out of bounds heap read in imap folder parser Hanno Böck
CollabNet Subversion Edge Hook Script Privilege Escalation Oliver-Tobias Ripka
CollabNet Subversion Edge Password Hash Leak Oliver-Tobias Ripka
CollabNet Subversion Edge downloadHook local file inclusion Oliver-Tobias Ripka
CollabNet Subversion Edge show local file inclusion Oliver-Tobias Ripka
CollabNet Subversion Edge tail local file inclusion Oliver-Tobias Ripka
CollabNet Subversion Edge insecure password change Oliver-Tobias Ripka
CollabNet Subversion Edge missing brute force protection Oliver-Tobias Ripka
CollabNet Subversion Edge autocomplete on Oliver-Tobias Ripka
CollabNet Subversion Edge missing clickjacking protection Oliver-Tobias Ripka
CollabNet Subversion Edge weak password policy Oliver-Tobias Ripka
CollabNet Subversion Edge missing XSRF protection Oliver-Tobias Ripka
CollabNet Subversion Edge weak password storage mechanism Oliver-Tobias Ripka
CollabNet Subversion Edge missing single login restriction Oliver-Tobias Ripka
CollabNet Subversion Edge index local file inclusion Oliver-Tobias Ripka
XXE Injection in NetIQ Access MustLive

Tuesday, 30 June

ManageEngine Password Manager Pro 8.1 SQL Injection vulnerability Blazej Adamczyk
CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP Fernando Muñoz
Siemens, Climatix BACnet/IP communication module, Vulnerabilities Fran
Broken, Abandoned, and Forgotten Code, Part 9 Zach C
Google Chrome Address Spoofing (Request For Comment) David Leo
Re: Google Chrome Address Spoofing (Request For Comment) Big Whale
Re: Google Chrome Address Spoofing (Request For Comment) Roney Gomes
DAVOSET v.1.2.5 MustLive

Previous period

Next period