Purple Fox rootkit now bundled with Telegram installer

The Purple Fox rootkit is being spread as an installer for the popular Telegram instant messaging app for Windows, according to researchers. Its not clear how the installer in this case was distributed, although it seems like at least some were delivered via email. Common distribution methods for...

Beware of Fake Telegram Messenger App Hacking PCs with Purple Fox Malware

Trojanized installers of the Telegram messaging application are being used to distribute the Windows-based Purple Fox backdoor on compromised systems. That's according to new research published by Minerva Labs, describing the attack as different from intrusions that typically take advantage of...

This Week in Security News - December 17, 2021

This week, read on Purple Fox’s infection chain observed by Trend Micro’s Managed XDR. Also, learn about the Log4j vulnerability that has the potential to cause ‘incalculable’ damage...

A Look Into Purple Fox’s Server Infrastructure

By examining Purple Fox’s routines and activities, both with our initial research and the subject matter we cover in this blog post, we hope to help incident responders, security operation centers SOCs, and security researchers find and weed out Purple Fox infections in their network...

fox-sports.nl Improper Access Control vulnerability OBB-2241603

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-24157

Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfilteredhtml capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be maliciou...

CVE-2021-24158

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

CVE-2021-24158

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

CVE-2021-24157

Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfilteredhtml capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be maliciou...

Code injection

Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfilteredhtml capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be maliciou...

Default configuration

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

CVE-2021-24157 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting

Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfilteredhtml capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be maliciou...

CVE-2021-24158 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

CVE-2021-24158

CVE-2021-24158 affects Orbit Fox by ThemeIsle (WordPress plugin). Vulnerability: a registration form feature integrated with Elementor and Beaver Builder allows a lower-privileged user to supply the user_role parameter and set the default role for new registrations, despite the field being hidden...

CVE-2021-24157

The CVE-2021-24157 issue affects Orbit Fox by ThemeIsle WordPress plugin. Affected component: the header/footer script injection feature in Orbit Fox; root cause: no validation of user capabilities (unfiltered_html) before saving script tags, enablingAuthenticated users with lower privileges to i...

WordPress Orbit Fox 安全漏洞

WordPress Orbit Fox is an open source application for WordPress. A user-centered plugin with an easy-to-use admin panel. A security vulnerability exists in Orbit Fox by ThemeIsle, which can be exploited by an attacker to update the registered default role by submitting the user role parameter...

WordPress Orbit Fox 跨站脚本漏洞

WordPress Orbit Fox is an open source application for WordPress. A user-centered plugin with an easy-to-use admin panel. A security vulnerability exists in Orbit Fox by ThemeIsle that allows low-level users to inject potentially malicious scripts...

PT-2021-15703 · Themeisle · Orbit Fox

Name of the Vulnerable Software and Affected Versions: Orbit Fox by ThemeIsle affected versions not specified Description: The issue concerns a registration form feature in Orbit Fox by ThemeIsle that integrates with Elementor and Beaver Builder page builders. Administrators can set a default use...

Hackers Hosed by Google Were a Counterterrorism Operation

Plus: Fox News gets sued for its election coverage again, a record ransomware attack, and more of the week’s top security news...

Perkiler malware turns to SMB brute force to spread

Researchers at Guardicore have identified a new infection vector being used by the Perkiler malware where internet-facing Windows machines are breached through SMB password brute force. Perkiler is a complex Windows malware with rootkit components that is dropped by the Purple Fox exploit kit EK...