Chinese Hackers Used Facebook to Hack Uighur Muslims Living Abroad

Facebook may be banned in China, but the company on Wednesday said it has disrupted a network of bad actors using its platform to target the Uyghur community and lure them into downloading malicious software that would allow surveillance of their devices. "They targeted activists, journalists and...

Chinese Hackers Used Facebook to Hack Uighur Muslims Living Abroad

Facebook may be banned in China, but the company on Wednesday said it has disrupted a network of bad actors using its platform to target the Uyghur community and lure them into downloading malicious software that would allow surveillance of their devices. "They targeted activists, journalists and...

Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the plugin were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved. CSRF to XSS alert0" / alert0" / alert0" / CSRF to Dele...

WordPress Facebook for WordPress plugin <= 2.2.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by WordFence in WordPress Facebook for WordPress plugin versions = 2.2.2. Solution Update the WordPress Facebook for WordPress plugin to the latest available version at least 3.0.0...

WordPress Facebook for WordPress plugin <= 3.0.3 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Facebook for WordPress plugin versions 3.0.0 – 3.0.3. Solution Update the WordPress Facebook for WordPress plugin to the latest available version at least 3.0.4...

Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the plugin were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved. PoC CSRF to XSS CSRF to Delete settings...

Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain

The runaction function of the plugin deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution. PoC Step 1: Use the nonce...

Facebook Moves Against ‘Evil Eye’ Hackers Targeting Uyghurs

The company’s investigation into a Chinese espionage campaign took researchers beyond Facebook’s own platforms...

How to enable Facebook’s hardware key authentication for iOS and Android

Since 2017 desktop users have had the opportunity to use physical security keys to log in to their Facebook accounts. Now iOS and Android users have the same option too. Physical security keys are a more secure option for two-factor authentication 2FA than SMS which is vulnerable to SIM swap...

CopperStealer malware stealing Facebook, Apple, Google passwords

By Waqas The credential-stealing malware was found in keygen and Cracks' website to circumvent licensing restrictions to legit software. This is a post from HackRead.com Read the original post: CopperStealer malware stealing Facebook, Apple, Google passwords...

[SECURITY] Fedora 34 Update: gnome-online-miners-3.34.0-8.fc34

GNOME Online Miners provides a set of crawlers that go through your online content and index them locally in Tracker. It has miners for Facebook, Flic kr, Google, OneDrive and Nextcloud...

[SECURITY] Fedora 34 Update: gnome-online-accounts-3.39.92-1.fc34

GNOME Online Accounts provides interfaces so that applications and libraries in GNOME can access the user's online accounts. It has providers for Google, Nextcloud, Facebook, Flickr, Foursquare, Microsoft Account, Microsoft Exchange, IMAP/SMTP and Kerberos...

Fedora: Security Advisory for gnome-online-miners (FEDORA-2021-303f6623fa)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for gnome-online-accounts (FEDORA-2021-303f6623fa)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CopperStealer Malware Targets Facebook and Instagram Business Accounts

A malware that until now has gone undocumented has been quietly hijacking online accounts of advertisers and users of Facebook, Apple, Amazon, Google and other web giants since July 2019 and then using them for nefarious activity, researchers have found. Dubbed CopperStealer, the malware acts...

Facebook's ‘Red Team X’ Hunts Bugs Outside the Social Network

The internal hacking team has spent the last year looking for vulnerabilities in the products the company uses, which could in turn make the whole internet safer...

Facebook Proxygen 安全漏洞

Facebook Proxygen is a set of open source C++ HTTP libraries from Facebook, Inc. in the United States. A security vulnerability exists in proxygen versions prior to v2021.03.15.00, which originates from a crash via a failed assertion...

Facebook Gameroom Code Execution Vulnerability

Facebook Gameroom is a software of Facebook Inc. It is used for watching videos, playing games, and sharing content. A security vulnerability exists in versions prior to Facebook Gameroom v1.26.0 that stems from the fbgames protocol handler not properly referencing parameters passed to the...

CVE-2021-24030

The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0...

CVE-2021-24030

The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0...