Full Disclosure Mailing List

A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

List Archives

Latest Posts

SEC Consult SA-20261104-0 :: Improper device certificate validation enables AiTM attacks in Siemens SICAM Toolbox II device communication SEC Consult Vulnerability Lab via Fulldisclosure (Nov 04)
SEC Consult Vulnerability Lab Security Advisory < 20261104-0 >
=======================================================================
title: Improper device certificate validation enables AiTM attacks
product: Siemens SICAM Toolbox II device communication
vulnerable version: <V07.11
      fixed version: V07.11
         CVE number: CVE-2024-31853, CVE-2024-31854
           impact: High...

Apache Struts2 Tiles Plugin <=7.4.0 and >=6.3.0 Preparer Cache Vulnerabilities Daniel Owens via Fulldisclosure (Nov 04)
The Apache Struts2 Tiles plugin version <=7.4.0 (and >=6.3.0) codebase includes a `ViewPreparer` construct, replete
with multiple ViewPreparer factories, that contains several important vulnerabilities including unsynchronised,
unbounded caches. The lack of proper synchronisation means that certain factories will create caches that race,
risking lost cache entries, corrupted internal bucket states under load (this can result in infinite...

unixODBC <=2.3.14 Rude Truncation via Narrowing Conversion Causes Out-of-Bounds `memcpy` Daniel Owens via Fulldisclosure (Nov 04)
unixODBC versions <=2.3.14 contain a rude truncation of a 64-bit `SQLLEN` `buffer_length` to a 32-bit `int` without
verifying that it produces a valid, positive value. The result is later passed to `memcpy`, causing the information
system to crash or, if carefully chosen, enabling attackers to write adjacent memory under certain circumstances (e.g.,
a buffer length that wraps to a small positive integer or triggers an undersized allocation...

unixODBC <=2.3.14 Multiple Races Daniel Owens via Fulldisclosure (Nov 04)
The unixODBC driver manager library contains multiple races of importance / interest, including a set of data races in
the connection-pooling configuration state data that can cause one thread to read a half-written pool-size or timeout
value, which can lead to a variety of harmful effects, as well as a race between teardown and error-handling
functionality that can result in double-frees and use-after-frees. Other races exist within the...

unixODBC <=2.3.14 Multiple Heap Buffer Overflows, Underflows, and Over-Reads Daniel Owens via Fulldisclosure (Nov 04)
unixODBC versions 2.3.14 and below contain multiple heap buffer overflows, underflows, and over-reads. Attackers who
can influence various arguments passed thereto can trigger the heap-based buffer overflows inside of the unixODBC
driver manager itself, potentially corrupting the shared heap state across connections, crash the driver manager
(thereby causing denial of service conditions, multi-tenant data loss, and such related issues,...

Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape Daniel Owens via Fulldisclosure (Nov 01)
Description
Apache Struts2 Core version 7.4.0 and below attempt to prevent arbitrary code execution via Object-Graph Navigation
Language (OGNL) through several different mechanisms but only in a cursory fashion -- the libraries only guard against
immediate calls evaluated by the OGNL engine via `SecurityMemberAccess`, but an allowed call that, instead, accepts
nested arguments and, itself, invokes reflection internally executes outside of the...

Apache Struts2 Core TokenHelper Token Cryptographic Timing Side-Channel Daniel Owens via Fulldisclosure (Nov 01)
Description
The Apache Struts2 Core 7.4.0 and below performs session token comparisons cryptographically insecure early-exit
comparison functions (e.g., `!=`, `memcmp`, byte-by-byte loops with `break`) that return as soon as the first
mismatched byte is encountered. The execution time of the comparison is therefore proportional to the number of
leading bytes that match, creating a measurable timing side-channel. Importantly, this...

Apache Struts2 Spring Plugin Uses a Previously Closed Resource Daniel Owens via Fulldisclosure (Nov 01)
Description
The Apache Struts2 Spring Plugin opens a Spring `ApplicationContex` via a try-with-resources block and, outside of said
block, then continues to use the closed resource, resulting in an uncaught `IllegalStateException`. This particular
issue prevents proper functionality and indicates poor code quality and code review standards and processes, while not
being, itself, otherwise excessively meaningful for a production environment...

Apache Struts2 Core Integer Overflow Daniel Owens via Fulldisclosure (Nov 01)
Description
Apache Struts2 Core version 7.4.0 and below fails to properly prevent integer overflows, causing wrap-arounds and other
issues on a downstream forced casting into types smaller than `BigInteger`. Importantly, this finding underscores why
all applications using Struts and other such platforms should perform their own input validation checks and not blindly
assume that the upstream Struts2 code has done as such, but the finding also...

Apache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide Path Daniel Owens via Fulldisclosure (Nov 01)
Description
Apache Struts2 Core version 7.4.0 and below's `FetchMetadataInterceptor`, `CoepInterceptor`, and `CoopInterceptor` each
compare their `exemptedPaths` configuration -- a per-interceptor-reference, administrator-supplied set of paths
intended to exempt specific actions from the corresponding cross-origin protection -- against
`HttpServletRequest.getContextPath()`. `getContextPath()` is fixed for the entire deployed web...

Apache Struts2 REST Plugin Fails to Properly Parse Chunked Requests Daniel Owens via Fulldisclosure (Nov 01)
Description
The Apache Struts2 REST Plugin's (version 7.4.0 and below) `ContentTypeInterceptor.intercept(ActionInvocation)` only
deserialises a request body and enforces the `struts.rest.content.maxLength` bound when
`HttpServletRequest#getContentLength()` returns a positive value. `getContentLength()` returns `-1` whenever the
`Content-Length` header is absent, which normal and appropriate for any Hypertext Transfer Protocol (HTTP)...

Apache Struts2 REST Plugin Untrimmed `Accept` Header Tokens Break Content Negation Fallback Daniel Owens via Fulldisclosure (Nov 01)
Description
The Apache Struts2 REST Plugin's `DefaultContentTypeHandlerManager.getHandlerForResponse(HttpServletRequest,
HttpServletResponse)` splits the `Accept` header on commas and passes each resulting token directly to
`findHandler(String)` without trimming leading or trailing whitespace. `findHandler(String)` only retries a trimmed
lookup when a token contains a semicolon (`;`), so a token that merely carries a leading space has no...

Apache Struts2 JSON Plugin Insecure Deserialisation -- Object Deserialisation Element-Count Limit Bypass Daniel Owens via Fulldisclosure (Nov 01)
As of the current versions of the Apache Struts2 JSON Plugin (e.g., version 7.4.0 and the 7.5.0 snapshot dated 28
October 2026), attackers can bypass the element-count limit purported to protect Object deserialisation added to said
code as part of the WW-5618 and S2-072 "hardening controls". Please note that this vulnerability and the attack string
is different than the previously reported bypass against the JSON array...

[0day-rubbish] NETGEAR RAX120 V1.2.5.18 authenticated SOAP InstallApp OS command injection to root-configured web-stack execution (6.8 Medium; conditionally 7.2 High with management exposure) disclosure via Fulldisclosure (Oct 28)
0day Rubbish Research Team is publicly disclosing a vulnerability in NETGEAR
RAX120 (Nighthawk AX12) firmware V1.2.5.18, the WiFi 6 consumer router from
NETGEAR (United States), built on the Qualcomm IPQ8074 platform. The
administrative web plane of this firmware generation is a lighttpd server
fronting the vendor's DNI-framework CGI handler /usr/sbin/net-cgi (an
aarch64, musl, stripped image; the handler binary measures 1,042,120 bytes
and...

[0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8) disclosure via Fulldisclosure (Oct 28)
0day Rubbish Research Team is publicly disclosing a vulnerability in the
Raritan PX3 PDU G4, firmware version 4.3.14, the intelligent rack power
distribution unit from Raritan, a Legrand company (United States). A
low-privilege authenticated session converts one diagnostics request into
operating-system command execution in the product's web-service context,
because the hostname validation that is supposed to gate the ping and
traceroute...

More Lists

Dozens of other network security lists are archived at SecLists.Org.