Mail Index

• Thread Index

• [FD] Apache Struts2 JSON Plugin Insecure Deserialisation -- Object Deserialisation Element-Count Limit Bypass
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 REST Plugin Untrimmed `Accept` Header Tokens Break Content Negation Fallback
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 REST Plugin Fails to Properly Parse Chunked Requests
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide Path
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core Integer Overflow
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Spring Plugin Uses a Previously Closed Resource
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core TokenHelper Token Cryptographic Timing Side-Channel
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape
  • From: Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Multiple Heap Buffer Overflows, Underflows, and Over-Reads
  • From: Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Multiple Races
  • From: Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Rude Truncation via Narrowing Conversion Causes Out-of-Bounds `memcpy`
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Tiles Plugin <=7.4.0 and >=6.3.0 Preparer Cache Vulnerabilities
  • From: Daniel Owens via Fulldisclosure
• [FD] SEC Consult SA-20261104-0 :: Improper device certificate validation enables AiTM attacks in Siemens SICAM Toolbox II device communication
  • From: SEC Consult Vulnerability Lab via Fulldisclosure
• [FD] Update: CVE-2025-68624 (N-able Mail Assure cross-tenant spoofing): fix declared by the vendor
  • From: Alessandro Bertoldi BCS via Fulldisclosure
• [FD] Postecert FIRMAOK! - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-9661)
  • From: Intilangelo, Andrea
• [FD] 0day Rubbish batch 17 - 12 advisories (3 unauthenticated) in closed-source products
  • From: disclosure via Fulldisclosure
• [FD] unixODBC <=2.3.14 Multiple Stack Buffer Overflows
  • From: Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core and Plugins <=7.4.0 Multiple Null Pointer Exceptions
  • From: Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Input Validation Causes Downstream Assertion Failure
  • From: Daniel Owens via Fulldisclosure
• [FD] [Security Advisory] Takeover of unconfigured VMware VCF Operations
  • From: k8x9p2m7 via Fulldisclosure
• [FD] AI Source Code Analysis Detection Evasion Techniques
  • From: E. Kellinis
• [FD] [REVIVE-SA-2026-004] Revive Adserver Vulnerabilities
  • From: Matteo Beccati
• [FD] APPLE-SA-11-09-2026-1 iOS 27.2.1 and iPadOS 27.2.1
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-2 iOS 26.7.3 and iPadOS 26.7.3
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-3 iOS 18.7.12 and iPadOS 18.7.12
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-4 macOS Golden Gate 27.2.1
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-5 macOS Tahoe 26.7.3
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-6 macOS Sequoia 15.8.3
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-7 watchOS 27.2.1
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-8 watchOS 26.6.1
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-9 visionOS 27.2.1
  • From: Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-12-2026-1 HomeView Software Version 27.2
  • From: Apple Product Security via Fulldisclosure
• [FD] Open WebUI: the Windows installer mints the master key from the install second — CVE-2025-15603 was rejected; here is the measurement
  • From: theknell--- via Fulldisclosure
• [FD] InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds
  • From: theknell--- via Fulldisclosure
• [FD] Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
  • From: theknell--- via Fulldisclosure