QIWI: [z.tochka.com] Unlimited file uploads lead to malware executed

Привет Нашел File Upload при загрузке изображения в чате поддержки банка Малварь загружается на z.tochka.com а значит он доверен 1. Заходим в чат 2. Загружаем малварь, можем его закриптовать, или просто загрузить .bat файл который будет выполнять какие либо действия на устройствах сотрудников 3...

WordPress The Official Facebook Chat Plugin <= 1.5 - Authenticated Options Change vulnerability

Authenticated Options Change vulnerability discovered by WordFence in WordPress The Official Facebook Chat Plugin versions = 1.5. Solution Update the WordPress The Official Facebook Chat Plugin to the latest available version at least 1.6...

The Official WordPress Facebook Chat Plugin < 1.6 - Authenticated Options Change to Chat Takeover

This flaw made it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. PoC Obtain PageID from a test Facebook Page found under page - about - pageID. Use...

The Official WordPress Facebook Chat Plugin < 1.6 - Authenticated Options Change to Chat Takeover

This flaw made it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. Obtain PageID from a test Facebook Page found under page - about - pageID. Use this...

Telegram Message Client

This module can be used to send a document and/or message to multiple chats on telegram. Please refer to the module documentation for info on how to retrieve the bot token and corresponding chat ID values. Module Options msf use auxiliary/client/telegram/sendmessage msf auxiliarysendmessage show...

EncroChat system eavesdropped on by law enforcement

Due to the level of sophistication of the attack, and the malware code, we can no longer guarantee the security of your device. This text caused a lot of aggravation, worries, and sleepless nights. No one wants to hear the security of their device has been compromised by a malware attack. The goo...

WP-Live Chat by 3CX < 8.2.0 - Authenticated Stored Cross-Site Scripting

There is a Stored Cross-Site Scripting XSS in WP-Live Chat by 3CX v. 8.1.9 By 3CX within the Quick Response function. Due to the nature of this vulnerability, a malicious attack with access to a WordPress multisite and permissions to this plugin can craft a malformed JavaScript payload. PoC...

WP-Live Chat by 3CX < 8.2.0 - Authenticated Stored Cross-Site Scripting

There is a Stored Cross-Site Scripting XSS in WP-Live Chat by 3CX v. 8.1.9 By 3CX within the Quick Response function. Due to the nature of this vulnerability, a malicious attack with access to a WordPress multisite and permissions to this plugin can craft a malformed JavaScript payload...

WordPress 3CX Live Chat plugin <= 8.1.9 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by Chevon Phillip in WordPress 3CX Live Chat plugin versions = 8.1.9. Solution Update the WordPress 3CX Live Chat plugin to the latest available version at least 8.2.0...

EFF's 30th Anniversary Livestream

It's the EFF's 30th birthday, and the organization is having a celebratory livestream today from 3:00 to 10:00 pm PDT. There are a lot of interesting discussions and things. I am having a fireside chat at 4:10 pm PDT to talk about the Crypto Wars and more. Stop by. And thank you for supporting EF...

Wise Chat < 2.8.4 - CSV Injection

It could allow an unauthenticated or low privileges user to inject a command in chat messages that will be included in the exported CSV file via message backup, leading to possible code execution...

WordPress Wise Chat plugin <= 2.8.3 - CSV Injection vulnerability

CSV Injection vulnerability found by Vishnupriya Ilango Fortinet's FortiGuard Labs in WordPress Wise Chat plugin versions = 2.8.3. Solution Update the WordPress Wise Chat plugin to the latest available version at least 2.8.4...

[SECURITY] Fedora 31 Update: ngircd-26-3.fc31

ngIRCd is a free open source daemon for Internet Relay Chat IRC, developed under the GNU General Public License GPL. It's written from scratch and is not based upon the original IRCd like many others...

Police Arrested Hundreds of Criminals After Hacking Into Encrypted Chat Network

In a joint operation, European and British law enforcement agencies recently arrested hundreds of alleged drug dealers and other criminals after infiltrating into a global network of an encrypted chatting app that was used to plot drug deals, money laundering, extortions, and even murders. Dubbed...

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...

Debian DLA-2252-1 : ngircd security update

It was discovered that there was an out-of-bounds access vulnerability in the server-server protocol in the ngircd Internet Relay Chat IRC server. For Debian 8 'Jessie', this issue has been fixed in ngircd version 22-2+deb8u1. We recommend that you upgrade your ngircd packages. NOTE: Tenable...

CVE-2020-6110

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs ...

CVE-2020-6110

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs ...

CVE-2020-6109

An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to send a...

CVE-2020-6109

An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to send a...