Full Disclosure Mailing List

A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

List Archives

Latest Posts

Quorum onQ OS - 6.0.0.5.2064 | Reflected Cross Site Scripting (XSS) | CVE-2024-44449 Shaikh Shahnawaz (Jan 29)
[+] Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC
[+] twitter.com/_striv3r_

[Vendor]
https://quorum.com/about/

[Product]
Quorum onQ OS - 6.0.0.5.2064

Vulnerability Type]
Reflected Cross Site Scripting (XSS)

[Affected Component]
Login page get parameter 'msg' is vulnerable to Reflected Cross site
scripting

[CVE Reference]
CVE-2024-44449

[Security Issue]
Cross Site Scripting vulnerability in Quorum onQ OS...

Deepseek writes textbook insecure code in 2025-01-28 Georgi Guninski (Jan 29)
Asking Deepseek on Jan 28 09:33:11 AM UTC 2025:

Write a python CGI which takes as an argument string NAME and outputs
"Hello"+NAME

The Deepseek AI [3] returned:

====
name = form.getvalue('NAME', 'World') # Default to 'World' if NAME is
not provided
# Output the HTML response
print(f"<html><body><h1>Hello, {name}!</h1></body></html>")

*For security reasons,...

Text injection on https://www.google.com/sorry/index via ?q parameter (no XSS) David Fifield (Jan 29)
The page https://www.google.com/sorry/index is familiar to Tor and VPN
users. It is the one that says "Our systems have detected unusual
traffic from your computer network. Please try your request again
later." You will frequently be redirected to this page when using Tor
Browser, when you do a search on a Google site such as www.youtube.com
or scholar.google.com. The text of the page reports the client IP
address, a timestamp of the...

APPLE-SA-01-27-2025-9 Safari 18.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-9 Safari 18.3

Safari 18.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122074.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Passwords
Available for: macOS Ventura and macOS Sonoma
Impact: A malicious app may be able to bypass browser extension
authentication...

APPLE-SA-01-27-2025-8 tvOS 18.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-8 tvOS 18.3

tvOS 18.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122072.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AirPlay
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker on the local network may be able to cause unexpected...

APPLE-SA-01-27-2025-7 watchOS 11.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-7 watchOS 11.3

watchOS 11.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122071.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AirPlay
Available for: Apple Watch Series 6 and later
Impact: An attacker on the local network may be able to cause unexpected
system...

APPLE-SA-01-27-2025-6 macOS Ventura 13.7.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-6 macOS Ventura 13.7.3

macOS Ventura 13.7.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122070.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleMobileFileIntegrity
Available for: macOS Ventura
Impact: An app may be able to access sensitive user data...

APPLE-SA-01-27-2025-5 macOS Sonoma 14.7.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-5 macOS Sonoma 14.7.3

macOS Sonoma 14.7.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122069.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AirPlay
Available for: macOS Sonoma
Impact: A remote attacker may cause an unexpected application
termination or...

APPLE-SA-01-27-2025-4 macOS Sequoia 15.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-4 macOS Sequoia 15.3

macOS Sequoia 15.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122068.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AirPlay
Available for: macOS Sequoia
Impact: An attacker on the local network may be able to cause unexpected
system...

APPLE-SA-01-27-2025-3 iPadOS 17.7.4 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-3 iPadOS 17.7.4

iPadOS 17.7.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122067.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AirPlay
Available for: iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch,
and iPad 6th generation
Impact: A remote attacker may...

APPLE-SA-01-27-2025-2 iOS 18.3 and iPadOS 18.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-2 iOS 18.3 and iPadOS 18.3

iOS 18.3 and iPadOS 18.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122066.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accessibility
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch
3rd generation and...

APPLE-SA-01-27-2025-1 visionOS 2.3 Apple Product Security via Fulldisclosure (Jan 27)
APPLE-SA-01-27-2025-1 visionOS 2.3

visionOS 2.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122073.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AirPlay
Available for: Apple Vision Pro
Impact: An attacker on the local network may be able to cause unexpected
system termination or...

AutoLib Software Systems OPAC Version.20.10 | Exposure of Sensitive Information | CVE-2024-48310 Shaikh Shahnawaz (Jan 27)
[+] Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC
[+] twitter.com/_striv3r_

[Vendor]
Autolib-india
http://autolib-india.net/products.php

[Product]
AutoLib Software Systems OPAC Version.20.10

[Affected Component]
main.js file

[CVE Reference]
CVE-2024-48310

[Security Issue]
AutoLib Software Systems OPAC v20.10 was discovered to have multiple API
keys exposed within the source code. Attackers may use these keys to...

SEC Consult SA-20250127-0 :: Weak Password Hashing Algorithms in Wind River Software VxWorks RTOS SEC Consult Vulnerability Lab via Fulldisclosure (Jan 27)
SEC Consult Vulnerability Lab Security Advisory < 20250127-0 >
=======================================================================
title: Weak Password Hashing Algorithms
product: Wind River Software VxWorks RTOS
vulnerable version: >= VxWorks 6.9
fixed version: not available
CVE number: no CVE assigned by Wind River
impact: High
homepage:...

Host Header Injection - atutorv2.2.4 Andrey Stoykov (Jan 27)
# Exploit Title: Host Header Injection - atutorv2.2.4
# Date: 01/2025
# Exploit Author: Andrey Stoykov
# Version: 2.2.4
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2025/01/friday-fun-pentest-series-18-host.html

Description:

- It was found that the application had a Host Header Injection
vulnerability.

Host Header Injection #1:

Steps to Reproduce:

1. Visit specific page of the application
2. Intercept the HTTP GET/POST...

More Lists

Dozens of other network security lists are archived at SecLists.Org.