Moodle 3.10.3 - (label) Persistent Cross Site Scripting Vulnerability

Exploit Title: Moodle 3.10.3 - 'label' Persistent Cross Site Scripting Author: Vincent666 ibn Winnie Software Link: https://moodle.org/ Tested on: Windows 10 Web Browser: Mozilla Firefox Google Dorks: inurl:/lib/editor/atto/plugins/managefiles/ or calendar/view.php?view=month Choose a role :...

Moodle 3.10.3 - 'label' Persistent Cross Site Scripting

Exploit Title: Moodle 3.10.3 - 'label' Persistent Cross Site Scripting Date: 25.03.2021 Author: Vincent666 ibn Winnie Software Link: https://moodle.org/ Tested on: Windows 10 Web Browser: Mozilla Firefox Google Dorks: inurl:/lib/editor/atto/plugins/managefiles/ or calendar/view.php?view=month...

Zoom 5.4.3 (54779.1115) / 5.5.4 (13142.0301) Information Disclosure Vulnerability

Manufacturer: Zoom Video Communications, Inc. Affected Versions: 5.4.3 54779.1115 5.5.4 13142.0301 Tested Versions: 5.4.3 54779.1115 5.5.4 13142.0301 Vulnerability Type: Exposure of Resource to Wrong Sphere CWE-668 Risk Level: Medium Solution Status: Open Manufacturer Notification: 2020-12-02...

A Bird-Feed Seller Beat a Chess Master. Then It Got Ugly

Twitch and YouTube chess star Levy Rozman has faced over a week of sustained harassment after calling out an alleged cheater...

Froala 3.2.6-1 Cross Site Scripting Vulnerability

Exploit Title: Stored XSS and Html Code Injection Editor Froala Version 3.2.6-1 Author: Vincent666 ibn Winnie Software Link: https://froala.com/wysiwyg-editor/ Tested on: Windows 10 Web Browser: Mozilla Firefox My Youtube Channel: https://www.youtube.com/channel/UCZOWpC2dW9sipPq5z63C2rQ PoC: In t...

Joomla Matukio Events 7.0.5 Cross Site Scripting Vulnerability

Exploit Title:Joomla Matukio Events 7.0.5 Stored XSS Author: Vincent666 ibn Winnie Software Link: https://matukio.compojoom.com/ Tested on: Windows 10 Web Browser: Mozilla Firefox My Youtube Channel : https://www.youtube.com/channel/UCZOWpC2dW9sipPq5z63C2rQ Google Dorks: inurl:option=commatukio...

Joomla Matukio Events 7.0.5 Cross Site Scripting

Exploit Title:Joomla Matukio Events 7.0.5 Stored XSS Date:08.03.2021 Author: Vincent666 ibn Winnie Software Link: https://matukio.compojoom.com/ Tested on: Windows 10 Web Browser: Mozilla Firefox My Youtube Channel : https://www.youtube.com/channel/UCZOWpC2dW9sipPq5z63C2rQ Google Dorks:...

Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations

Cybersecurity researchers today unwrapped a new campaign aimed at spying on vulnerable Tibetan communities globally by deploying a malicious Firefox extension on target systems. "Threat actors aligned with the Chinese Communist Party's state interests delivered a customized malicious Mozilla...

Experts Find a Way to Learn What You're Typing During Video Calls

A new attack framework aims to infer keystrokes typed by a target user at the opposite end of a video conference call by simply leveraging the video feed to correlate observable body movements to the text being typed. The research was undertaken by Mohd Sabra, and Murtuza Jadliwala from the...

CVE-2021-21286 Authorization Bypass in AVideo Platform

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

North Korea Targets Security Researchers in Elaborate 0-Day Campaign

Hackers linked to North Korea are targeting security researchers with an elaborate social-engineering campaign that sets up trusted relationships with them — and then infects their organizations’ systems with custom backdoor malware. That’s according to Google’s Threat Analysis Group TAG, which...

A week in security (January 11 – January 17)

Last week on Malwarebytes Labs, we looked at IoT problems, Microsoft’s Patch Tuesday, and how cybercriminals want access to your cloud services. We also explored how VPNs can protect your privacy, and asked if MSPs have picked the right PSA. Other cybersecurity news Hot phishing targets: Some...

chewb-server (>=0.0.1, <=0.0.20), video-dash-uploader (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2020-28436 via google-cloudstorage-commands (0.0.1)

google-cloudstorage-commands NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on google-cloudstorage-commands and may be impacted: - chewb-server =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2020-28436 Source advisory:...

Google, YouTube, Gmail service suffered major outage worldwide

By Deeba Ahmed Google states that the problem is fixed now, and all services are back online for most users. Let us know if these services are back in your area. This is a post from HackRead.com Read the original post: Google, YouTube, Gmail service suffered major outage worldwide...

The Christchurch Shooter and YouTube’s Radicalization Trap

The platform has gotten better about stamping out extremist content. But researchers say its policies and algorithms are still too opaque...

Hackers hiding skimming malware behind social media sharing icons

By Sudais Asif According to researchers, the malware hides behind icons from top networks such as Facebook, Instagram, Twitter, Google, YouTube, and Pinterest. This is a post from HackRead.com Read the original post: Hackers hiding skimming malware behind social media sharing icons...

Stripo Inc: Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo

Summary: Can you imagine discovering an API key disclosure vulnerability in a disclosed API key disclosure report? The same thing is what I came across while going through the disclosed reports at Stripo Inc. Plus, the disclosed API key isn't even revoked, and therefore I am still able to use the...

Logitech: One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com

Summary Hello Team I have found a bypass to the this report. 1039749 Steps To Reproduce: 1. Login to attacker's account and go to settings -- account settings. 2. Intercept the request in burp suite and click on merge twitch account. 3. Allow twitch access and once you see a get request in burp...

PT-2020-21540

Name of the Vulnerable Software and Affected Versions lazysizes versions prior to 5.2.1-rc1 Description The issue affects the video-embed plugin of lazysizes, which fails to properly sanitize certain attributes, including data-vimeo, data-vimeoparams, data-youtube, and data-ytparams. This oversig...

Data scraping firm leaks 235m Instagram, TikTok, YouTube user records

By Sudais Asif According to researchers, the trove of data was left for public access without any security authentication. This is a post from HackRead.com Read the original post: Data scraping firm leaks 235m Instagram, TikTok, YouTube user records...