Full Disclosure: by date

89 messages starting Dec 01 17 and ending Dec 26 17
Date index | Thread index | Author index

Friday, 01 December

: Asterisk Security Team
AST-2017-013: DOS Vulnerability in Asterisk chan_skinny Asterisk Security Team
Mist Server v2.12 Unauthenticated Persistent XSS CVE-2017-16884 hyp3rlinx
Artica Web Proxy v3.06 Remote Code Execution / CVE-2017-17055 hyp3rlinx
Abyss Web Server < v2.11.6 Memory Heap Corruption hyp3rlinx
Announcing NorthSec 2018 CFP + Reg - Montreal, May 14-20 Pierre-David Oriol - Northsec Conference
aws-cfn-bootstrap local code execution as root [CVE-2017-9450] Harry Sintonen
Symantec Encryption Desktop & Endpoint Encryption Local Privilege Escalation - Exploiting an Arbitrary Hard Disk Read/Write Vulnerability Over NTFS Kyriakos Economou
Axis Communications MPQT/PACS Heap Overflow and Information Leakage bashis
ZKTime Web Software 2.0.1.12280 CVE-2017-17056 Cross Site Request Forgery Himanshu Mehta
ZKTime Web Software 2.0.1.12280 CVE-2017-17057 Cross Site Scripting Himanshu Mehta
APPLE-SA-2017-11-29-1 Security Update 2017-001 Apple Product Security
APPLE-SA-2017-11-29-2 Security Update 2017-001 Apple Product Security
AMD's buddies for Intel's FDIV bug: _llrem and _ullrem yield wrong remainders! Stefan Kanthak

Saturday, 02 December

SEC Consult SA-20171129-0 :: FortiGate SSL VPN Portal XSS Vulnerability SEC Consult Vulnerability Lab
SEC Consult SA-20171130-0 :: Critical CODESYS vulnerabilities in WAGO PFC 200 Series SEC Consult Vulnerability Lab
SEC Consult SA-20171130-1 :: OS Command Injection & Reflected Cross Site Scripting in OpenEMR SEC Consult Vulnerability Lab

Tuesday, 05 December

Re: Edward Snowden free speech at JBFone - Future, Data Security & Privacy Vulnerability Lab
[CFP] BSides San Francisco - April 2018 BSidesSF CFP via Fulldisclosure
CVE-2017-15357 Local root privesc in Arq Backup <= 5.9.6 Mark Wadham
CVE-2017-16895 Local root privesc in Arq Backup <= 5.9.7 Mark Wadham
Owning VirtualBox via MITM Mark Wadham
SSD Advisory – Coredy CX-E120 Repeater Multiple Vulnerabilities Maor Shwartz
Amazon Audible Software CVE-2017-17069 Privilege Escalation Vulnerability Himanshu Mehta
CVE-2017-16930 - Claymore's Dual Ethereum Miner unauth stack buffer overflow in remote management interface oststrom (public)

Friday, 08 December

macOS High Sierra 10.13.1 insecure cron system Mark Wadham
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan Apple Product Security
APPLE-SA-2017-12-6-2 iOS 11.2 Apple Product Security
APPLE-SA-2017-12-6-3 watchOS 4.2 Apple Product Security
APPLE-SA-2017-12-6-4 tvOS 11.2 Apple Product Security
Follow-up on CVE-2017-8769 - WhatsApp Issues with Media Files Nightwatch Cybersecurity Research

Tuesday, 12 December

Meinberg LANTIME Web Configuration Utility - Arbitrary File Read Jakub Palaczynski
Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload Jakub Palaczynski
Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Jakub Palaczynski
Sony PS4 Remote Play - DLL Hijack vulnerability Maelstrom Security via Fulldisclosure
SSD Advisory – QNAP QTS Unauthenticated Remote Code Execution Maor Shwartz
Re: Follow-up on CVE-2017-8769 - WhatsApp Issues with Media Files Jeffrey Walton
CVE-2017-15944: Palo Alto Networks firewalls remote root code execution Philip Pettersson
APPLE-SA-2017-12-12-1 AirPort Base Station Firmware Update 7.6.9 Apple Product Security
APPLE-SA-2017-12-12-2 AirPort Base Station Firmware Update 7.7.9 Apple Product Security
Qualys Security Advisory - Buffer overflow in glibc's ld.so Qualys Security Advisory
ESA-2017-153: EMC Isilon OneFS Privilege Escalation Vulnerability EMC Product Security Response Center
Three exploits for Zivif Web Cameras (may impact others) Silas

Wednesday, 13 December

SEC Consult SA-20171213-0 :: VPN credentials disclosure in Fortinet FortiClient SEC Consult Vulnerability Lab
AST-2017-012: Remote Crash Vulnerability in RTCP Stack Asterisk Security Team

Friday, 15 December

SyncBreeze <= 10.2.12 - Denial of Service Manuel Garcia Cardenas
[CONVISO-17-002] - Zoom Linux Client Stack-based Buffer Overflow Vulnerability Gabriel Quadros
[CONVISO-17-003] - Zoom Linux Client Command Injection Vulnerability (RCE) Gabriel Quadros
CVE-2017-17670: vlc: type conversion vulnerability Hans Jerry Illikainen
Re: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read Jakub Palaczynski
SSD Advisory – vBulletin routestring Unauthenticated Remote Code Execution Maor Shwartz
SSD Advisory – vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion Maor Shwartz
0-day: Remote Stack Format String in 'nsd' binary from multiple OEM bashis
APPLE-SA-2017-12-13-1 iOS 11.2.1 Apple Product Security
APPLE-SA-2017-12-13-2 tvOS 11.2.1 Apple Product Security
APPLE-SA-2017-12-13-3 iCloud for Windows 7.2 Apple Product Security
APPLE-SA-2017-12-13-4 iTunes 12.7.2 for Windows Apple Product Security
APPLE-SA-2017-12-13-5 Safari 11.0.2 Apple Product Security
APPLE-SA-2017-12-13-6 Additional information for APPLE-SA-2017-12-6-2 iOS 11.2 Apple Product Security
APPLE-SA-2017-12-13-7 Additional information for APPLE-SA-2017-12-6-4 tvOS 11.2 Apple Product Security
Re: [oss-security] CVE-2017-17670: vlc: type conversion vulnerability Stiepan

Tuesday, 19 December

[CFP] Security BSides Ljubljana 0x7E2 Andraz Sraka
CVE-2017-6094 - Genexis GAPS Access Control Vulnerability Antoine Neuenschwander
[CVE-2017-17704] Broken Cryptography in iStar Ultra & IP ACM by Software House David Tomaschik via Fulldisclosure
DefenseCode ThunderScan SAST Advisory: WordPress Top-10 Plugin SQL Injection Security Vulnerability DefenseCode
DefenseCode ThunderScan SAST Advisory: WordPress Clean Up Optimizer Plugin Security Vulnerability DefenseCode
DefenseCode ThunderScan SAST Advisory: WordPress Booking Calendar Multiple Security Vulnerabilities DefenseCode
Re: CVE-2017-15944: Palo Alto Networks firewalls remote root code execution Fernando A. Lagos Berardi
Re: [oss-security] CVE-2017-17670: vlc: type conversion vulnerability Hans Jerry Illikainen
Multiple Vulnerabilities in TP-Link TL-SG108E - CVE-2017-17745, CVE-2017-17746, CVE-2017-17747 James McLean
Google supported XSS kit aka AdExchange iframe buster kit Zmx
Re: Google supported XSS kit aka AdExchange iframe buster kit Zmx
SSD Advisory – Huawei P8 wkupccpu debugfs Kernel Buffer Overflow Maor Shwartz
SSD Advisory – Ichano AtHome IP Cameras Multiple Vulnerabilities Maor Shwartz
[SYSS-2017-027] Microsoft Windows Hello Face Authentication - Authentication Bypass by Spoofing (CWE-290) Matthias Deeg
[CVE-2017-17719] Cross-Site Scripting (XSS) vulnerability in WordPress Concours Plugin nicolas.buzy-debat
[CVE-2017-17744] Cross-Site Scripting (XSS) vulnerability in Custom Map WordPress Plugin nicolas.buzy-debat
[CVE-2017-17753] Multiple Cross-Site Scripting (XSS) vulnerabilities in CSV Import-Export Wordpress Plugin nicolas.buzy-debat
ESA-2017-161: EMC Isilon OneFS NFS Export Security Setting Fallback Vulnerability EMC Product Security Response Center
ESA-2017-157: EMC Data Domain DD OS Memory Overflow Vulnerability EMC Product Security Response Center

Thursday, 21 December

[CORE-2017-0008] - Trend Micro Smart Protection Server Multiple Vulnerabilities Core Security Advisories Team

Friday, 22 December

AST-2017-014: Crash in PJSIP resource when missing a contact header Asterisk Security Team

Saturday, 23 December

[CVE-2017-17752] Cross-Site Scripting (XSS) vulnerability in Ability Mail Server 3.3.2 Aloyce J. Makalanga
[CVE-2016-6914] Ubiquiti UniFi Video v3.7.3 (Windows) Local Privileges Escalation via Insecure Directory Permissions Julien Ahrens
Re: Google supported XSS kit aka AdExchange iframe buster kit Zmx
Vitek RCE and Information Disclosure (and possible other OEM) bashis
Re: [CVE-2017-17719] Cross-Site Scripting (XSS) vulnerability in WordPress Concours Plugin Ryan Dewhurst
ESA-2017-155: EMC VNX1 and VNX2 Family Reflected Cross Site Scripting Vulnerability in VNX Control Station EMC Product Security Response Center

Tuesday, 26 December

SSD Advisory – Trustwave SWG Unauthorized Access Maor Shwartz

Previous period

Next period