WP Statistics SQL Injection vulnerability

Security experts at Sucuri have discovered a SQL Injection vulnerability in WP Statistics, one of the most popular WordPress plugins, that is currently installed on over 300,000 websites. The SQL Injection vulnerability in WP Statistics could be exploited by attackers, with at least a subscriber...

Someone leaked 32TB of Windows 10 internal builds and source code

By Waqas It looks like Microsoft is in trouble again. This time not for its critical vulnerabilities in Windows operating system but for a massive data leak in which 32TB of highly sensitive Windows 10 related data has been dumped online. According to a report from TheRegister, it is believed tha...

Internet Bug Bounty: 4 severe remote + several minor OpenVPN vulnerabilities

CVE-2017-7521 Remote server crashes/double-free/memory leaks in certificate processing CVE-2017-7520 Remote including MITM client crash, data leak CVE-2017-7508 Remote server crash forced assertion failure CVE-2017-7522 Crash mbed TLS/PolarSSL-based server no cve Remote/mitm Null-pointer...

S-CMS V3.0 build20170601 has an arbitrary file download vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS V3.0 build20170601 '/admin/download.asp' page has an arbitrary file download vulnerability, allowing attackers to exploit the vulnerability to download database information...

SQL injection vulnerability in the create_share.php page of TreeHole's external link system

Treehole external chain system is a free and open source PHP external chain network disk system, support for seven cattle, local, remote three kinds of storage methods, support for multi-user system. Treehugger createshare.php page SQL injection vulnerability , because the program fails to filter...

Oracle Social Network Information Disclosure Vulnerability

Oracle Fusion Middleware is a comprehensive middleware portfolio of SOA and middleware products. A security vulnerability exists in Oracle Social Network versions prior to 11.1.12.0.0, which can be exploited by attackers to compromise confidentiality...

SQL Injection Vulnerability in Ranchi OA System Version 4.2 Order Parameters

Ranzhi OA system is a collaborative office system for small and medium-sized enterprises, which includes functional modules such as customer management crm, sales tracking, daily office and other functions OA office system, bookkeeping software and knowledge management system. A SQL injection...

CVE-2017-7589

OpenIDM prior to 4.5.0 (4.0.0–pre-4.5.0) exposes an info endpoint vulnerability: an anonymous user can trigger information disclosure via the info/login.js path due to a missing access-control check. Reports indicate responses may be 200 OK containing JSON with IP addresses, indicating partial co...

Gratipay: Transferring incorrect data to the http://gip.rocks/v1 endpoint with correct Content-Type leads to local paths disclosure through the error message

Description Hi. I found the way to raise 500 Internal Server Error with some sensitive information disclosure some local paths of the python installation. The issue is not critical, however, you can prevent this information leak. Request: POST /v1 HTTP/1.1 Host: gip.rocks Cache-Control: max-age=0...

CVE-2017-2479

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers ...

CVE-2017-2450

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "CoreText" component. It allows remote attackers to obtain sensitive information or cause a denial...

CVE-2017-2418

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Hypervisor" component. It allows guest OS users to obtain sensitive information from the CR8 control register via unspecified vectors...

Mozilla Firefox Buffer Overflow Read Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. Mozilla Firefox suffers from a buffer overflow read vulnerability that could allow an attacker to read a buffer overflow...

Database of 1.4 Billion Records leaked from World’s Biggest Spam Networks

A database of 1.4 billion email addresses combined with real names, IP addresses, and often physical address has been exposed in what appears to be one the largest data breach of this year. What's worrisome? There are high chances that you, or at least someone you know, is affected by this latest...

Cloudbleed Triggered 1.2M Times, Damage Kept to Minimum

Having had more than a week to digest Cloudbleed’s causes and impact, Cloudflare CEO Matthew Prince assessed the damage yesterday in a lengthy post-mortem as relatively low. Prince said there is no evidence the vulnerability, which leaked customer data from memory, was exploited by attackers. The...

Code injection

Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR...

Cloudbleed Bug Leaks Sensitive Cloudflare Customer Data

The Cloudflare content delivery network for months has been leaking customer data, everything from private messages to encryption keys and credentials belonging to users of some of the Internet’s biggest properties. The vulnerability has been addressed, Cloudflare CTO John Graham-Cumming said, bu...

CVE-2016-4613

An issue was discovered in certain Apple products. Safari before 10.0.1 is affected. iCloud before 6.0.1 is affected. iTunes before 12.5.2 is affected. tvOS before 10.0.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a craft...

CVE-2017-2603

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

CVE-2016-5949

CVE-2016-5949 affects IBM Kenexa LCMS Premier on Cloud. An authenticated user could obtain sensitive user data via a specially crafted HTTP request. IBM's bulletin indicates the issue is addressed in LCMS Premier 10.1, with affected versions listed as 9.1–10.1. Remediation is to upgrade to the fi...