Adobe Flash Player Information Disclosure Vulnerability (CNVD-2017-21200)

Adobe Flash Player is a cross-platform, browser-based multimedia player product from Adobe. The product supports cross-screen and browser viewing of applications, content and videos. An information disclosure vulnerability exists in Adobe Flash Player. An attacker could exploit this vulnerability...

Cisco DPC3939 Firmware Information Disclosure Vulnerability (CNVD-2017-27790)

Cisco DPC3939 is a wireless voice gateway product from Cisco USA. The Cisco DPC3939 firmware has a security vulnerability. Allows a remote attacker to discover a hidden home security wi-fi network by exploiting the embedding of DNS hostnames with MTA/VoIP MAC addresses...

elektronik-kompendium.de XSS vulnerability

Vulnerable URL: https://www.elektronik-kompendium.de/shop/kasse/adressen Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 53560 VIP website status:| No Check elektronik-kompendium.de...

NTP Vulnerability

The Network Time Protocol NTP library has been found to contain a vulnerability CVE-2017-6460. Palo Alto Networks software makes use of the vulnerable library and may be affected. This issue only affects the management plane of the firewall. Ref PAN-76130 / CVE-2017-6460 Successful exploitation o...

macOS Fruitfly Backdoor Analysis Renders New Spying Capabilities

LAS VEGAS—The FruitFly backdoor became a known entity in January, but it’s a good bet that for years it had been in the wild, undetected by analysts and security software. The macOS and OS X malware has a number of insidious spying capabilities that would make anyone uneasy, and a variant recentl...

OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067)

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers...

OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067)

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers...

Grab: Blind stored xss [parcel.grab.com] > name parameter

Hi, my previously reported blind xss is fixed but i found same type of xss in diffrent area with more impact. Steps to repro: 1. create new account with name " here https://parcel.grab.com/ 2. afftected page is https://app.detrack.com/a/ where admin can see all the user's of application and this ...

Modified Versions of Nukebot in Wild Since Source Code Leak

Some opportunistic criminals have put the leaked source code for the Nukebot banking Trojan to use, targeting banks in the United States and France with variants of the malware, while another group has adapted it to steal mail client and browser passwords. The leak was disclosed in early March wh...

CVE-2017-11435

The Humax Wi-Fi Router model HG100R- 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. The bug is exploitable remotely when the router is configured to expose the management console. The router is not validating the session token...

Adobe Flash Player Information Disclosure Vulnerability (CNVD-2017-15120)

Adobe Flash Player is a cross-platform, browser-based multimedia player product from Adobe. The product supports cross-screen and browser viewing of applications, content and videos. An information disclosure vulnerability exists in Adobe Flash Player. An attacker could exploit this vulnerability...

Ubuntu: Security Advisory (USN-3349-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The Slippery Slope Starts with "Get 2 Free Airline Tickets"

Written by Or Katz and Raviv Perets A widespread phishing scam that offers free airline tickets has been spotted in the wild by Akamai's Enterprise Threat Protector ETP security research team. The campaign uses a number of social engineering techniques to trick people into providing their private...

Humax Wi-Fi Router HG100R Authentication Bypass Vulnerability

Humax Wi-Fi Router HG100R is a router device from Humax Digital, Korea. An authentication bypass vulnerability exists in the Humax Wi-Fi Router HG100R version 2.0.6. An attacker can exploit the vulnerability by sending a specially crafted request to the management console to retrieve sensitive...

HUMAX WiFi Router HG-100R DNS Hijacking Vulnerability

The HG-100R is a router. A DNS hijacking vulnerability exists in the HUMAX WiFi Router HG-100R. The vulnerability is caused by first constructing a special request to bypass the authentication of the management console. The vulnerability is due to the router failing to validate the session token...

CVE-2017-11110

The oleinit function in ole.c in catdoc 0.95 allows remote attackers to cause a denial of service heap-based buffer underflow and application crash or possibly have unspecified other impact via a crafted file, i.e., data is written to memory addresses before the beginning of the tmpBuf buffer...

CVE-2017-11110

The oleinit function in ole.c in catdoc 0.95 allows remote attackers to cause a denial of service heap-based buffer underflow and application crash or possibly have unspecified other impact via a crafted file, i.e., data is written to memory addresses before the beginning of the tmpBuf buffer...

[SECURITY] Fedora 26 Update: bind-9.11.1-2.P2.fc26

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

WakaTime: Blocking users to sign up on the site

Dear sir, This may be a low priority issue,but has the importance to resolve at your priority.I request you to think over this report,because this vulnerability is not a spam on many other sites. URL:- https://wakatime.com/signup https://wakatime.com/login Vulnerability:- -Attacker can block user...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...