Mail Thread Index

• Date Index

• [FD] Apache Struts2 JSON Plugin Insecure Deserialisation -- Object Deserialisation Element-Count Limit Bypass, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 REST Plugin Untrimmed `Accept` Header Tokens Break Content Negation Fallback, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 REST Plugin Fails to Properly Parse Chunked Requests, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide Path, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core Integer Overflow, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Spring Plugin Uses a Previously Closed Resource, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core TokenHelper Token Cryptographic Timing Side-Channel, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape, Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Multiple Heap Buffer Overflows, Underflows, and Over-Reads, Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Multiple Races, Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Rude Truncation via Narrowing Conversion Causes Out-of-Bounds `memcpy`, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Tiles Plugin <=7.4.0 and >=6.3.0 Preparer Cache Vulnerabilities, Daniel Owens via Fulldisclosure
• [FD] SEC Consult SA-20261104-0 :: Improper device certificate validation enables AiTM attacks in Siemens SICAM Toolbox II device communication, SEC Consult Vulnerability Lab via Fulldisclosure
• [FD] Update: CVE-2025-68624 (N-able Mail Assure cross-tenant spoofing): fix declared by the vendor, Alessandro Bertoldi BCS via Fulldisclosure
• [FD] Postecert FIRMAOK! - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-9661), Intilangelo, Andrea
• [FD] 0day Rubbish batch 17 - 12 advisories (3 unauthenticated) in closed-source products, disclosure via Fulldisclosure
• [FD] unixODBC <=2.3.14 Multiple Stack Buffer Overflows, Daniel Owens via Fulldisclosure
• [FD] Apache Struts2 Core and Plugins <=7.4.0 Multiple Null Pointer Exceptions, Daniel Owens via Fulldisclosure
• [FD] unixODBC <=2.3.14 Input Validation Causes Downstream Assertion Failure, Daniel Owens via Fulldisclosure
• [FD] [Security Advisory] Takeover of unconfigured VMware VCF Operations, k8x9p2m7 via Fulldisclosure
• [FD] AI Source Code Analysis Detection Evasion Techniques, E. Kellinis
• [FD] [REVIVE-SA-2026-004] Revive Adserver Vulnerabilities, Matteo Beccati
• [FD] APPLE-SA-11-09-2026-1 iOS 27.2.1 and iPadOS 27.2.1, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-2 iOS 26.7.3 and iPadOS 26.7.3, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-3 iOS 18.7.12 and iPadOS 18.7.12, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-4 macOS Golden Gate 27.2.1, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-5 macOS Tahoe 26.7.3, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-6 macOS Sequoia 15.8.3, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-7 watchOS 27.2.1, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-8 watchOS 26.6.1, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-09-2026-9 visionOS 27.2.1, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-11-12-2026-1 HomeView Software Version 27.2, Apple Product Security via Fulldisclosure
• [FD] Open WebUI: the Windows installer mints the master key from the install second — CVE-2025-15603 was rejected; here is the measurement, theknell--- via Fulldisclosure
• [FD] InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds, theknell--- via Fulldisclosure
• [FD] Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven), theknell--- via Fulldisclosure