CVE-2017-16541

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected...

WordPress Plugin JTRT Responsive Tables 4.1 - SQL Injection

WordPress Plugin JTRT Responsive Tables 4.1 - SQL Injection Exploit Title: JTRT Responsive Tables 4.1 – WordPress Plugin – Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/jtrt-responsive-tables/ Software Link:...

Directory traversal

An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Directory Utility" component. It allows local users to discover the Apple ID of the computer's owner...

CVE-2015-9231

iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new default feature was added to iTerm2 version 3.0.0 and unreleased 2.9.x versions such as 2.9.20150717 that resulted in a potential information disclosure. In an attempt to see whether the text under...

Sn1per - Automated PenTest Recon Scanner

Sn1per is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. DEMO VIDEO: FEATURES: Automatically collects basic recon ie. whois, ping, DNS, etc. Automatically launches Google hacking queries against a target domain Automatically enumerates...

CVE-2017-9477

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST and DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to discover the CM MAC address by connecting to the device's xfinitywifi hotspot...

CVE-2017-9484

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST and DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to discover a CM MAC address by sniffing Wi-Fi traffic and performing simple arithmetic...

Devil's Ivy vulnerability(CVE-2017-9765)

When we began a security analysis of remote configuration services last year, we had no idea it would lead us to uncover vulnerabilities that affect so many users. We have been studying the prevalence and nature of the vulnerabilities that arise in remote configuration services, so when we...

Elasticsearch Kibana cross-site scripting vulnerability (CNVD-2017-11643)

Elasticsearch Kibana formerly known as elasticsearch-dashboard is a suite of open-source, browser-based analytics and search Elasticsearch dashboard tools from the Dutch company Elasticsearch. A cross-site scripting vulnerability exists in the Discover page in Elasticsearch Kibana versions 5.3 an...

Cross site scripting

Starting in version 5.3.0, Kibana had a cross-site scripting XSS vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

CVE-2017-8440

Starting in version 5.3.0, Kibana had a cross-site scripting XSS vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

CVE-2017-8440

Kibana 5.3.0+ includes a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information or perform destructive actions on behalf of other Kibana users. The issue is confirmed across multiple vendor/security sources for Elastic Kibana. Th...

CVE-2017-2397

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Accounts" component. It allows physically proximate attackers to discover an Apple ID by reading an iCloud authentication prompt on the lock screen...

Discover Forever - Customized SSL, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Discover Forever published at the 'play' market has multiple vulnerabilities...

portal.discover.com XSS vulnerability

Vulnerable URL: https://portal.discover.com/customersvcs/universalLogin/acmain?userID="// Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check portal.discover.com...

CVE-2016-5976

The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.51089.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.52249.0.2A FP3 allows remote authenticated users to discover compone...

CVE-2016-4749

Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file...

CVE-2016-5134

net/proxy/proxyservice.cc in the Proxy Auto-Config PAC feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to...

Design/Logic Flaw

net/PacProxySelector.java in the Proxy Auto-Config PAC feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by...

CVE-2016-0287

CVE-2016-0287 (IBM i Access for Windows, Release 7.1) is a local information-disclosure vulnerability where a local attacker could obtain IBM i user passwords from the Windows registry via unspecified vectors. The IBM advisory confirms affected product/version and notes the issue affects IBM i Ac...