CVE-2021-36207: Improper Privilege Management

Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator...

Rogue ads phishing for cryptocurrency: Are you secure?

Bad ads are at it again. Rogue Google ads caused no end of misery for cryptocurrency enthusiasts, costing them roughly $4.31 million between the 12th and the 21st of April. This is an astonishing slice of cryptocurrency cash to lose for the sake of clicking on something in a search engine. The...

TikTok: DOM XSS on ads.tiktok.com

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via the "settings" parameter, caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. We thank @0x7 for reporting this to our team...

Reddit: Able to approve admin approval and change effective status without adding payment details .

Summary: In https://ads.reddit.com/ you can create campaign under which you can create ads , once you create new campaign , it is on pending stage and will not be delivered unless you add payment details and is reviewed by admin and approved according to what it says here...

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware

As announced today, Microsoft took action against the ZLoader trojan by working with telecommunications providers around the world to disrupt key ZLoader infrastructure. We used our research into this threat to enrich our protection technologies and ensure this infrastructure could no longer be...

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware

As announced today, Microsoft took action against the ZLoader trojan by working with telecommunications providers around the world to disrupt key ZLoader infrastructure. We used our research into this threat to enrich our protection technologies and ensure this infrastructure could no longer be...

WordPress Wbcom Designs – BuddyPress Ads plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Ads plugin versions = 1.3.0. Solution Update the WordPress Wbcom Designs – BuddyPress Ads plugin to the latest available version at least 1.3.1...

TikTok: CSRF in Changing User Verification Email

A Cross-Site Request Forgery CSRF was found on a TikTok Ads endpoint, which could have resulted in a malicious user adding a new user verification email address. We thank @fm for reporting this to our team...

Experts Shed Light on BlackGuard Infostealer Malware Sold on Russian Hacking Forums

A previously undocumented "sophisticated" information-stealing malware named BlackGuard is being advertised for sale on Russian underground forums for a monthly subscription of $200. "BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP...

ads-immo.com Cross Site Scripting vulnerability OBB-2462156

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

TikTok: IDOR on TikTok Ads Endpoint

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Ads endpoint, which could have resulted in an unauthorized user adding products into another user's catalogue. We thank @sinayeganeh for reporting this to our team...

Researchers Expose Mars Stealer Malware Campaign Using Google Ads to Spread

A nascent information stealer called Mars has been observed in campaigns that take advantage of cracked versions of the malware to steal information stored in web browsers and cryptocurrency wallets. "Mars Stealer is being distributed via social engineering techniques, malspam campaigns, maliciou...

Online Safety Bill’s provisions for “legal but harmful” content described as “censor’s charter”

The UKs Online Safety Bill, a landmark piece of legislation that that aims to regulate the countrys online content, has just been introduced into Parliament after undergoing significant revisions. The bill has been in progress for about five years and its main objective is to regulate online...

TikTok: XSS and iframe injection on tiktok ads portal using redirect params

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via the "redirect" parameter. We thank @cancerz for reporting this to our team...

TikTok: Privilege Escalation on TikTok for Business

An IDOR Insecure Direct Object Reference vulnerability was found on the "orgid" and "accountid" parameters on a Business.TikTok.com endpoint, which could have resulted in an authenticated user with "Analyst" level permissions to close another user's ads accounts. We thank @naaash for reporting th...

WordPress Add Pinterest conversion tags for Pinterest Ads + Site verification plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Add Pinterest conversion tags for Pinterest Ads + Site verification plugin versions = 1.2.2. Solution Update the Add Pinterest conversion tags for Pinterest Ads + Site verification plugin to the latest available version at lea...

WordPress Add Linkedin insight tags for Linkedin ads plugin <= 1.2.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Add Linkedin insight tags for Linkedin ads plugin versions = 1.2.3. Solution Update the WordPress Add Linkedin insight tags for Linkedin ads plugin to the latest available version at least 1.2.4...

WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin <= 1.7.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin versions = 1.7.9. Solution Update the WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin to the latest available version at least 1.7.91...

WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin <= 1.7.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin versions = 1.7.9. Solution Update the WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin to the latest available version at least 1.7.91...

WordPress WP Relevant Ads plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Relevant Ads plugin versions = 1.0.0. Solution No patched version available...