WordPress Plugin "Related YouTube Videos" vulnerable to cross-site request forgery

Overview WordPress Plugin "Related YouTube Videos" provided by Chris Doerr contains a cross-site request forgery vulnerability CWE-352. Shoichiro Ishikawa of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University directly reported this vulnerability...

WordPress Related YouTube Videos Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Related YouTube Videos plugin is a plugin used to embed YouTube videos in pages. A cross-site request forgery vulnerability exists in...

JVN#31406910: WordPress Plugin "Related YouTube Videos" vulnerable to cross-site request forgery

WordPress Plugin "Related YouTube Videos" provided by Chris Doerr contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the information...

WordPress Related YouTube Videos plugin <= 1.9.8 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Related YouTube Videos plugin versions = 1.9.8. Solution Update the WordPress Related YouTube Videos plugin to the latest available version at least 1.9.9...

WordPress Related YouTube Videos plugin <= 1.9.8 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress Related YouTube Videos plugin versions = 1.9.8. Solution Update the WordPress Related YouTube Videos plugin to the latest available version at least 1.9.9...

Cross site scripting

Multiple stored cross-site scripting XSS in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: 1 Title, 2 Favicon, 3 Meta Description, 4 Subscribe Form Name field label, Last name field label, Email...

Okadminfinder3 - Admin Panel Finder / Admin Login Page Finder

OKadminFinder is an Apache2 Licensed utility, rewritten in Python 3.x , for admins/pentesters who want to find admin panel of a website. There are many other tools but not as effective and secure. Yeah, Okadminfinder has the the ability to use tor and hide your identity. Requirements Linux sudo a...

Scranos: New Rapidly Evolving Rootkit-Enabled Spyware Discovered

A new powerful rootkit-enabled spyware operation has been discovered wherein hackers are distributing multifunctional malware disguised as cracked software or trojanized app posing as legitimate software like video players, drivers and even anti-virus products. While the rootkit malware—dubbed...

Top 10 Best Anime Movie Sites 2019

By Zehra Ali Are you a fan of anime movies? Look no further, here is a list of best anime movie sites. Entertainment is a major part of our lives and the Internet is the biggest source for it these days. There are several websites such as YouTube, DailyMotion, and Vimeo, etc. offering movies and ...

A week in security (March 25 – 31)

Last week, we looked at plugin vulnerabilities, location tracking app problems, and talked about plain text password woes. We also looked at federal data privacy regulation and took a deep dive into BatMobi Adware. Other cybersecurity news Poisoned software update headache for ASUS Source: The...

PewDiePie ransomware forcing users to subscribe him on YouTube

By Waqas T-Series - PewDiePie Battle Takes an Ugly Turn- PewDiePie Fans Launching PewDiePie ransomware to Get Followers. The battle between T-Series and PewDiePie for the top slot on YouTube is getting more fierce and dramatic day by day. Where T-Series fans are supporting the Indian music compan...

Timing Attack

github.com/youtube/vitess is vulnerable to timing attack. The usage of an insecure password comparison function entry.Password == password in vitess/go/mysql/authserverstatic.go allows a remote attacker to determine a user's password by analyzing the server response. This is due to early aborting...

A week in security (February 18 – 24)

Last week on Malwarebytes Labs, we explored the world of crack hunting, gave you a 101 on the world of bots and their threats and advantages, and took a look at some clever phishing scams. We also explained how a Mac fends off malware, posted a handy “lazy person's guide to cybersecurity,” and du...

EI-Tube 3 SQL Injection

Exploit Title: PHP EI-Tube Script - Sql Injection Date: 2019-02-21 Exploit Author: Meisam Monsef - [email protected] Vendor Homepage: https://codecanyon.net/item/eitube-youtube-api-v3-site-builder/22722912?srank=17 Version: 3 Tested on: ubuntu special thanks : Alireza Noorkazemi - A-H - Akhzari...

EI-Tube 3 - SQL Injection

EI-Tube 3 - SQL Injection Exploit Title: PHP EI-Tube Script - Sql Injection Date: 2019-02-21 Exploit Author: Meisam Monsef - [email protected] Vendor Homepage: https://codecanyon.net/item/eitube-youtube-api-v3-site-builder/22722912?srank=17 Version: 3 Tested on: ubuntu special thanks : Alireza...

Joomla HWDVideoShare 1.5 Bypass / Database Disclosure / SQL Injection

Exploit Title : Joomla HWDVideoShare Components 1.5 SQL Injection / Database Disclosure / Incorrect Authorization Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 30/01/2019 Vendor Homepage : joomla.org hwdmediashare.co.uk Software Download Link :...

A week in security (January 21 – 27)

Last week on the Malwarebytes Labs blog, we took a look at Modlishka, the latest hurdle in two-factor authentication 2FA, the potential for abuse of push notifications, a malware-phishing combo by the name of CryTekk ransomware, and why we detect PUPs, but enforce the power of users' choice. We...

Urban Dictionary: Users able to set video url for unpublished words and able to see the name of unpublished words

Summary Users will be able to set youtube video URL to unpublished words and will be able to see names of an unpublished word. Description Once a user publishes a word and later unpublish it, others user still would be able to set the youtube video URL for it and will be able to see the name of t...

Courts Hand Down Hard Jail Time for DDoS

Seldom do people responsible for launching crippling cyberattacks face justice, but increasingly courts around the world are making examples of the few who do get busted for such crimes. On Friday, a 34-year-old Connecticut man received a whopping 10-year prison sentence for carrying out...

Crashcast-Exploit - This Tool Allows You Mass Play Any YouTube Video With Chromecasts Obtained From Shodan.io

This tool allows you to mass play any YouTube video with Chromecasts obtained from Shodan.io Author: @037 Prerequisites The only thing you need installed is Python 3.x sudo apt-get install python3 You also require to have cURL installed sudo apt-get install curl You also require Shodan python...