I don't know how to place a $ value on these beyond noting that Googling "security vulnerabilities" gives about 1,000,000 results with plenty of sponsored links - and "vulnerabilities" returns 21,000,000 with everything on the first page also strictly related to computer security - but with less sponsored links for the broader term.
The plural works okay in this context (though more results and sponsored links returned from search on the singular form). The ".info" extension is probably fine for a techie audience - safe bet enough will remember it and possibly be more naturally inclined to check out a ".info" site before a .com in this context ... (Compare with relative success of "insecure.org" for instance).
Computer security always has been a lucrative business but I think it is an especially urgent subject for many companies this year dealing with pressure from the credit card industry to bring practices up to minimum standard under pain of increased liability for data theft. (Google "PCI compliance" and "TJ Maxx" for the back story there). Many companies have put security on the back burner until faced with more serious consequences - now they are scrambling to hire consultants or even "just buy a solution" if they haven't already ramped up in-house efforts to avoid getting hammered with higher credit card transaction rates and potential fines for non-compliance etc.
So from that point of view, can see a good domain name such as vulnerabilities . info having potentially high $xxxx or more value to an end user - may be reasonable to expect at least mid $xxx reseller price based on that analysis.