Home › Security News › Sources

Full Disclosure

Syndicate content
A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.
URL: http://seclists.org/#fulldisclosure
Updated: 14 min 39 sec ago

Multiple Reflected Cross-site Scripting Vulnerabilities in Coppermine 1.5.46

25 January, 2019 - 14:36

Posted by Daniel Bishtawi on Jan 25

Hello,

We are glad to inform you about the vulnerabilities we reported in
Coppermine 1.5.46.

Here are the details:

Advisory by Netsparker
Name: Multiple Reflected Cross-site Scripting in Coppermine 1.5.46
Affected Software: Coppermine
Affected Versions: 1.5.46
Homepage: http://coppermine-gallery.net/
Vulnerability: Reflected Cross-site Scripting
Severity: High
Status: Fixed
CVE-ID: 2018-14478
CVSS Score (3.0):...

Cross-site Scripting Vulnerability in Abantecart 1.2.12

25 January, 2019 - 14:36

Posted by Daniel Bishtawi on Jan 25

Hello,

We are glad to inform you about the vulnerabilities we reported in
Abantecart 1.2.12.

Here are the details:

Advisory by Netsparker
Name: Reflected Cross-site Scripting in Abantecart 1.2.12
Affected Software: Abantecart
Affected Versions: 1.2.12
Homepage: http://www.abantecart.com/
Vulnerability: Cross-site Scripting
Severity: High
Status: Fixed
CVE-ID: CVE-2018-20141
CVSS Score (3.0): AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Netsparker...

Cross-site Scripting via XML Vulnerability in DNN 9.1

25 January, 2019 - 14:36

Posted by Daniel Bishtawi on Jan 25

Hello,

We are glad to inform you about the vulnerabilities we reported in DNN 9.1.

Here are the details:

Advisory by Netsparker
Name: Cross-site Scripting via XML Vulnerability in DNN 9.1
Affected Software: DNN
Affected Versions: 9.1
Homepage: http://dnnsoftware.com
Vulnerability: Cross-site Scripting via XML Vulnerability
Severity: High
Status: Not Fixed
CVE-ID: 2018-14486
CVSS Score (3.0): CVSS:3.0/VA:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N...

Microsoft Windows .CONTACT File / HTML Injection Mailto: Remote Code Execution

25 January, 2019 - 14:11

Posted by hyp3rlinx on Jan 25

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt
[+] ISR: ApparitionSec
[+] Zero Day Initiative Program
[+] ZDI-CAN-7591

[Vendor]
www.microsoft.com

[Product]
Microsoft .CONTACT File

A file with the CONTACT file extension is a Windows Contact file. They're
used in Windows...

SEC Consult SA-20190124-0 :: Cross-site scripting in CA Automic Workload Automation Web Interface (AWI)

24 January, 2019 - 17:57

Posted by SEC Consult Vulnerability Lab on Jan 24

SEC Consult Vulnerability Lab Security Advisory < 20190124-0 >
=======================================================================
title: Cross-site scripting
product: CA Automic Workload Automation Web Interface (AWI)
(formerly Automic Automation Engine, UC4)
vulnerable version: 12.0, 12.1, 12.2
fixed version: 12.0.6 HF2, 12.1.3 HF3, 12.2.1 HF1
CVE number: CVE-2019-6504...

RVAsec 2019 Call for Presentations (CFP)

24 January, 2019 - 08:48

Posted by Sullo on Jan 24

RVAsec is a Richmond, VA based security convention that brings top industry
speakers to the Mid-Atlantic region. In its seventh year, RVAsec 2018
attracted over 650 security professionals from across the country. For
2019, the conference is a two day and three track format, with a mixed
focus on technical and management/business presentations.

Note: this year we are introducing a 3rd track focused on intro level "101"
talks....

[RT-SA-2018-004] Cisco RV320 Command Injection

24 January, 2019 - 04:38

Posted by RedTeam Pentesting GmbH on Jan 24

Advisory: Cisco RV320 Command Injection

RedTeam Pentesting discovered a command injection vulnerability in the
web-based certificate generator feature of the Cisco RV320 router.

Details
=======

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15 and later
Fixed Versions: since 1.4.2.20
Vulnerability Type: Remote Code Execution
Security Risk: medium
Vendor URL:...

[RT-SA-2018-003] Cisco RV320 Unauthenticated Diagnostic Data Retrieval

24 January, 2019 - 04:38

Posted by RedTeam Pentesting GmbH on Jan 24

Advisory: Cisco RV320 Unauthenticated Diagnostic Data Retrieval

RedTeam Pentesting discovered that the Cisco RV320 router exposes
sensitive diagnostic data without authentication through the device's
web interface.

Details
=======

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15, 1.4.2.17
Fixed Versions: since 1.4.2.19
Vulnerability Type: Information Disclosure
Security Risk: high
Vendor URL:...

[RT-SA-2018-002] Cisco RV320 Unauthenticated Configuration Export

24 January, 2019 - 04:38

Posted by RedTeam Pentesting GmbH on Jan 24

Advisory: Cisco RV320 Unauthenticated Configuration Export

RedTeam Pentesting discovered that the configuration of a Cisco RV320
router may be exported without authentication through the device's web
interface.

Details
=======

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15, 1.4.2.17
Fixed Versions: since 1.4.2.19
Vulnerability Type: Information Disclosure
Security Risk: high
Vendor URL:...