Information disclosure

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the pharparsepharfile function in ext/phar/phar.c...

Automated posting on Vkontakte public pages using VK API and Python

Vk.com Vkontakte is the most popular social network Russia and Ex-USSR with 430+ million users. Originally it was a Facebook clone. But now, after 10 years of development, these two services are quite different from each other. Traditional advantages of vk.com - huge amount of free music and vide...

CVE-2017-10731

IrfanView version 4.44 32bit allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d80."...

CVE-2017-10730

IrfanView version 4.44 32bit allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d96."...

malco.com XSS vulnerability

Vulnerable URL: http://malco.com/cinemainfo.php?thisid=1"...

SQL injection vulnerability in the id parameter of the news_info.php file of Dongyunchuangda Enterprise CMS

Dongyun Tronda Enterprise CMS is an enterprise website building system. A SQL injection vulnerability exists in the id parameter of the newsinfo.php file of the Dongyuntranda Enterprise CMS. An attacker can exploit this vulnerability to obtain database information...

leagueofsocialdarters.com XSS vulnerability

Vulnerable URL: http://leagueofsocialdarters.com/contactinfo.asp?Former=1"...

customrulers.net XSS vulnerability

Vulnerable URL: http://customrulers.net/Moreinfo.asp?equipment=1"...

birdseyeviews.org XSS vulnerability

Vulnerable URL: http://www.birdseyeviews.org/zoom.php?city=Austin=1887info=1"...

izhevsk.ru5.info XSS vulnerability

Vulnerable URL: http://izhevsk.ru5.info///search.php?txt=%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E=0=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown ...

epfoservices.in XSS vulnerability

Vulnerable URL: http://www.epfoservices.in/claimstatusinfo-newlogic.php?officename=1"...

elektronik-info.ru XSS vulnerability

Vulnerable URL: http://elektronik-info.ru/search/%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 20.09.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6171749 VIP website...

guidancedirect.com XSS vulnerability

Vulnerable URL: https://guidancedirect.com/LinkTemp/fLinkTop.asp?BackTitle=/%27%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E Details: Description| Value ---|--- Patched:| Yes, at 26.11.2017 Latest check for patch:| 26.11.2017 15:12 GMT Vulnerability type:| XSS Vulnerability...

CVE-2017-9868

In Mosquitto through 1.4.12, mosquitto.db aka the persistence file is world readable, which allows local users to obtain sensitive MQTT topic information...

Mozilla: Out-of-bounds read in WebGL with ImageInfo object (MFSA 2017-16)

An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

radare2 'libr/core/cmd_info.c' remote denial of service vulnerability

radare2 is a set of libraries and tools for working with binary files. A security vulnerability exists in the 'cmdinfo' function in the libr/core/cmdinfo.c file in radare2 version 1.5.0. A remote attacker can exploit this vulnerability to cause a denial of service reuse after release and...

Pornhub: pornhub.com/user/welcome/basicinfo nickname field is vulnerable on xss

The researcher discovered a stored XSS in the user's basic info page...

CVE-2015-7732

The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext...

CVE-2017-1379

IBM API Connect 5.0.0.0–5.0.7.1 is affected by CVE-2017-1379, an information disclosure vulnerability caused by improper handling of Developer Portal requests. Remote attacker could obtain sensitive information. IBM’s bulletin lists affected versions and provides remediation via iFixes containing...

Design/Logic Flaw

KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network...