Sponsored Content

Full Disclosure Mailing List

A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

List Archives

Latest Posts

CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series Thomas Weber | CyberDanube via Fulldisclosure (Aug 29)
CyberDanube Security Research 20260611-0
-------------------------------------------------------------------------------
title| Multiple Denial of Service
product| Dahua DH-IPC-HFW Series
vulnerable version| <=V3.142.0000000.8.R.250826
fixed version| Versions build including and after 2026-03-26.
CVE number| CVE-2026-29115, CVE-2026-29116
impact| High
homepage| https://www.dahuasecurity.com/
found| 20.10.2025
by| T. Weber, S. Eisenreich-Dietz...

Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293) t.preissl via Fulldisclosure (Aug 29)
-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling
Author: Timo Preißl <t.preissl () proton me>
Date: 2026-02-11
CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
Affected: Denx U-Boot <= v2026.01-rc4
Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot
bootloader's filesystem handling code...

[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293) t.preissl via Fulldisclosure (Aug 29)
-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling
Author: Timo Preißl <t.preissl () proton me>
Date: 2026-02-11
CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
Affected: Denx U-Boot <= v2026.01-rc4
Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot
bootloader's filesystem handling code...

JSON Deserialiser Unconstrained Resource Consumption Proof of Concept Daniel Owens via Fulldisclosure (Aug 29)
On 26 October 2025 we published "Struts2 and Related Framework Array/Collection DoS", which was followed up on 07 March
2026 by "JSON Deserialiser Unconstrained Resource Consumption Quick Overview". Today we are publishing a proof of
concept that we have been using for more than 15 years against Struts2, Newtonsoft JSON, JSON.org, and various other
JSON parsers. We are publishing, in part, because of the theft of our...

Dovecot Security Advisory 3/2026 Aki Tuomi (Aug 29)
Hi!

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. This advisory will also be published at
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html

---

Classification: TLP:GREEN

Internal reference: DOV-8476
Type: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor...

FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS) Evan Tang (Aug 26)
https://blog.evan.lat/posts/CVE-2026-65053/

the blog talks about two vulns that are chainable together. for the sake of
brevity ill write up on the stored xss one.

in lib/Mime/Status.php, we see a pretty viable xss sink:

$out .= '<tr><td>' . $val . '</td></tr>';

xrefing this we see that most impls are sanitized with the exception of
lib/Mime/Viewer/Appledouble.php:

$data_name =...

[NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File advisories (Aug 26)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0013
----------------------------------------------------------------------------

[-] Summary:
Eval injection in the Kenwood ITM file format driver of CHIRP, an
open-source application for programming amateur radios, allows an attacker
who can persuade a user to open a crafted radio file to execute arbitrary
Python code with the...

[NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records advisories (Aug 26)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0012
----------------------------------------------------------------------------

[-] Summary:
kamalpanse18 EmpManageX, a Flask-based employee management application,
ships hard-coded administrative credentials in its authentication logic.
The username admin and the plaintext password admin123 are module-level
constants in app.py,...

[NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service advisories (Aug 26)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0011
----------------------------------------------------------------------------

[-] Summary:
Nmap 7.99 and earlier contain a loop with an unreachable exit condition in
the Packet:parse_options() method of nselib/packet.lua. A remote host that
is the target of a scan can exhaust the memory of the scanning Nmap process
and terminate it by...

[NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM advisories (Aug 26)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0010
----------------------------------------------------------------------------

[-] Summary:
Barrier 2.4.0 for Windows contains a local privilege escalation vulnerability
in the IPC command interface exposed by the barrierd.exe service on
127.0.0.1:24801. The IPC server accepts local TCP clients and processes a
command line together...

[NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write advisories (Aug 26)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0009
----------------------------------------------------------------------------

[-] Summary:
NitroShare Desktop 0.3.4 contains a path traversal vulnerability in its LAN
file transfer receive path. The transfer service is reachable from the local
network on TCP port 40818 and processes incoming transfer metadata without
authentication in...

Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure Ron E (Aug 26)
An unauthenticated remote debugger vulnerability exists in Escargot
v4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER
support and the debug server is enabled using --start-debug-server. The
debugger accepts client connections without authentication or authorization
and provides access to privileged debugger functionality.

An attacker capable of reaching the debugger interface can establish a
debugger session and...

Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path Ron E (Aug 26)
An OS command injection vulnerability exists in the Escargot
v4.3.0-214-gfaee4437 crash handler due to an executable/module path being
incorporated into an addr2line shell command without quoting or escaping.
The resulting command is executed using system(), causing shell
metacharacters contained within the path to be interpreted as command
syntax.

By launching Escargot using a crafted executable path containing shell
metacharacters and...

Escargot v4.3.0-214-gfaee4437 Debugger WebSocket Off-by-One Stack Buffer Overflow Ron E (Aug 26)
Escargot contains a remotely triggerable one-byte stack-based out-of-bounds
write in the WebSocket message handling logic used by the debugger.

When Escargot::DebuggerTcp::receive() receives a binary WebSocket payload
that completely fills the caller-provided stack buffer, the function
successfully copies the payload into the available buffer space but
subsequently appends an additional NUL byte without verifying that space
remains for the...

UltraJSON v5.13.0-6-g733f9e1 Length-Boundary Violation Causes Out-of-Bounds Read During Incomplete JSON Parsing Ron E (Aug 26)
UltraJSON contains an out-of-bounds read in its native C JSON decoder when
processing certain incomplete JSON values supplied through an explicitly
length-bounded input buffer.

The affected native entry point, JSON_DecodeObject(), accepts both a buffer
pointer and an explicit buffer length:

JSON_DecodeObject(
JSONObjectDecoder *dec,
const char *buffer,
size_t cbBuffer
)

The decoder establishes cbBuffer as the logical boundary of...

More Lists

Dozens of other network security lists are archived at SecLists.Org.