Experts Warn Too Often AWS S3 Buckets Are Misconfigured, Leak Data

A rash of misconfigured Amazon Web Services storage servers leaking data to the internet have plagued companies recently. Earlier this week, data belonging to anywhere between six million and 14 million Verizon customers were left on an unprotected server belonging to a partner of the...

ALPINE-CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request...

DEBIAN-CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request...

UBUNTU-CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request...

XSS Vulnerability in OTCMSV2.56

OTCMS is a website article management system. OTCMSV2.56 suffers from an XSS vulnerability. An attacker can exploit this vulnerability to obtain sensitive information such as administrator cookies...

WP Statistics SQL Injection vulnerability

Security experts at Sucuri have discovered a SQL Injection vulnerability in WP Statistics, one of the most popular WordPress plugins, that is currently installed on over 300,000 websites. The SQL Injection vulnerability in WP Statistics could be exploited by attackers, with at least a subscriber...

Someone leaked 32TB of Windows 10 internal builds and source code

By Waqas It looks like Microsoft is in trouble again. This time not for its critical vulnerabilities in Windows operating system but for a massive data leak in which 32TB of highly sensitive Windows 10 related data has been dumped online. According to a report from TheRegister, it is believed tha...

Internet Bug Bounty: 4 severe remote + several minor OpenVPN vulnerabilities

CVE-2017-7521 Remote server crashes/double-free/memory leaks in certificate processing CVE-2017-7520 Remote including MITM client crash, data leak CVE-2017-7508 Remote server crash forced assertion failure CVE-2017-7522 Crash mbed TLS/PolarSSL-based server no cve Remote/mitm Null-pointer...

S-CMS V3.0 build20170601 has an arbitrary file download vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS V3.0 build20170601 '/admin/download.asp' page has an arbitrary file download vulnerability, allowing attackers to exploit the vulnerability to download database information...

SQL injection vulnerability in the create_share.php page of TreeHole's external link system

Treehole external chain system is a free and open source PHP external chain network disk system, support for seven cattle, local, remote three kinds of storage methods, support for multi-user system. Treehugger createshare.php page SQL injection vulnerability , because the program fails to filter...

Oracle Social Network Information Disclosure Vulnerability

Oracle Fusion Middleware is a comprehensive middleware portfolio of SOA and middleware products. A security vulnerability exists in Oracle Social Network versions prior to 11.1.12.0.0, which can be exploited by attackers to compromise confidentiality...

SQL Injection Vulnerability in Ranchi OA System Version 4.2 Order Parameters

Ranzhi OA system is a collaborative office system for small and medium-sized enterprises, which includes functional modules such as customer management crm, sales tracking, daily office and other functions OA office system, bookkeeping software and knowledge management system. A SQL injection...

CVE-2017-7589

OpenIDM prior to 4.5.0 (4.0.0–pre-4.5.0) exposes an info endpoint vulnerability: an anonymous user can trigger information disclosure via the info/login.js path due to a missing access-control check. Reports indicate responses may be 200 OK containing JSON with IP addresses, indicating partial co...

Gratipay: Transferring incorrect data to the http://gip.rocks/v1 endpoint with correct Content-Type leads to local paths disclosure through the error message

Description Hi. I found the way to raise 500 Internal Server Error with some sensitive information disclosure some local paths of the python installation. The issue is not critical, however, you can prevent this information leak. Request: POST /v1 HTTP/1.1 Host: gip.rocks Cache-Control: max-age=0...

CVE-2017-2479

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers ...

CVE-2017-2450

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "CoreText" component. It allows remote attackers to obtain sensitive information or cause a denial...

CVE-2017-2418

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Hypervisor" component. It allows guest OS users to obtain sensitive information from the CR8 control register via unspecified vectors...

Mozilla Firefox Buffer Overflow Read Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Thunderbird is a mail tool adapted from the mail widget of the Mozilla browser. Mozilla Firefox suffers from a buffer overflow read vulnerability that could allow an attacker to read a buffer overflow...

Database of 1.4 Billion Records leaked from World’s Biggest Spam Networks

A database of 1.4 billion email addresses combined with real names, IP addresses, and often physical address has been exposed in what appears to be one the largest data breach of this year. What's worrisome? There are high chances that you, or at least someone you know, is affected by this latest...

Cloudbleed Triggered 1.2M Times, Damage Kept to Minimum

Having had more than a week to digest Cloudbleed’s causes and impact, Cloudflare CEO Matthew Prince assessed the damage yesterday in a lengthy post-mortem as relatively low. Prince said there is no evidence the vulnerability, which leaked customer data from memory, was exploited by attackers. The...