Survey: APIs a Growing Cybersecurity Risk

Like a lot of people, your mobile phone number is probably easily accessible to anyone with a bit of searching. Imagine if someone could take this number and your name and gain access to your mobile phone account including billing, email address and phone IMSI. Or maybe someone hacked into one of...

CVE-2018-5711

creationtimestamp| type| source ---|---|--- 2018-01-22 12:56:46+00:00| published-proof-of-concept| https://t.me/news4hack/31 2024-11-14 06:07:44+00:00| seen| MISP/a57f7f1a-11dd-462d-81cd-6cf385407046 2026-07-26 00:00:11+00:00| seen| Telegram/bNjb-vyQBQI1oInEWRCRvDmKkFJUwtCpxCihTDPD4pQKrg 2026-07-...

CVE-2017-14869

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while performing update of FOTA partition, uninitialized data can be pushed to storage...

Cisco Jabber for Windows Information Disclosure Vulnerability (CNVD-2017-36124)

Cisco Jabber for Windows is the United States Cisco Cisco company's set of unified communications client solutions for the Windows platform. The program provides online status display, instant messaging, voice and other functions. An information disclosure vulnerability exists in Cisco Jabber for...

Design/Logic Flaw

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

Apple macOS High Sierra APFS is vulnerable

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.APFS is one of the file system components for Apple devices. A security vulnerability exists in the APFS component of Apple macOS High Sierra versions prior to 10.13.1. The vulnerability can be exploite...

Array data injection vulnerability in activerecord

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ backslash character...

CVE-2017-15199

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description...

kernel: Incorrect overwrite check in __ip6_append_data()

The ip6appenddata function in net/ipv6/ip6output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service system crash via crafted system calls...

IBM Sterling B2B Integrator Security Bypass Vulnerability (CNVD-2017-15934)

IBM Sterling B2B Integrator supports highly secure integration of complex B2B processes with diverse partner communities. A security bypass vulnerability exists in IBM Sterling B2B Integrator version 5.2 that stems from the program failing to properly restrict user requests. An attacker could...

CVE-2017-0263

creationtimestamp| type| source ---|---|--- 2017-05-09 18:26:18+00:00| seen| MISP/59120865-27e0-4e6d-9b74-4a9f950d210f 2017-05-20 11:22:46+00:00| seen| https://t.me/canyoupwnme/1426 2018-02-21 07:47:18+00:00| seen| MISP/5a8d2377-208c-4330-908f-4818950d210f 2018-04-13 13:08:50+00:00|...

MGASA-2017-0093 Updated putty packages fix security vulnerability

In PuTTY before 0.68, if SSH agent forwarding is enabled, local attackers that are also able to connect to the UNIX domain socket could have overwritten heap data CVE-2017-6542...

Unspecified Vulnerability in Oracle Virtualization VM VirtualBox Component

Oracle Virtualization Oracle VirtualBox is a virtual machine component of Oracle's virtualization solution. A local security vulnerability exists in the Core subcomponent of the Oracle VM VirtualBox component of Oracle Virtualization, versions prior to 5.0.28 and versions prior to 5.1.8. An...

Unspecified Vulnerability in Oracle Sun Systems Products 'SMB Users' Subpart

Oracle Sun Systems Products Suite is a Sun Systems Products Suite from Oracle USA. A security vulnerability exists in the Oracle Sun Systems Products 'SMB Users' subcomponent. A local attacker could exploit the vulnerability to read data, compromising the confidentiality and integrity of the data...

CVE-2016-0929

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...

CVE-2016-3893

The wcdcalhwdepioctlshared function in sound/soc/codecs/wcdcal-hwdep.c in the Qualcomm sound codec in Android before 2016-09-05 on Nexus 6P devices does not properly copy firmware data, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug...

barrons.com XSS vulnerability

Open Bug Bounty ID: OBB-180088 Description| Value ---|--- Affected Website:| barrons.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediatio...

SUSE-SU-2016:2000-1 Security update for Linux Kernel Live Patch 4 for SLE 12 SP1

This update for the Linux Kernel 3.12.57-6035 fixes the several issues. These security issues were fixed: - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

Red Hat Network Satellite Cross-Site Scripting Vulnerability

Red Hat Network Satellite RHN Satellite, Red Hat Network Satellite is a set of system management platforms from the American company Red Hat Red Hat. The platform can be used to extend the Linux infrastructure and provide system management functions such as administration, configuration and...

Design/Logic Flaw

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute...