CVE-2016-6875

Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors...

CVE-2016-6872

CVE-2016-6872 involves an integer overflow in StringUtil::implode in Facebook HHVM prior to 3.15.0. The vulnerability has a high/severe impact profile (CVSS v3.0: CRITICAL, 9.8; v2.0: HIGH, 7.5) with network attack vector and no authentication required. The reports state that the overflow could e...

CVE-2016-6873

Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors...

CVE-2016-6871

Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow...

CVE-2016-6870

CVE-2016-6870 affects Facebook HHVM prior to 3.15.0. The vulnerability is an out-of-bounds write in the third-party/multibyte-related functions: mb_detect_encoding, mb_send_mail, and mb_detect_order, leading to unspecified impact through unknown vectors. The provided public documents do not speci...

Drupal Facebook Pull Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Facebook Pull is one of the modules. A cross-site scripting vulnerability exists in the Drupal Facebook Pull module. This vulnerability can be exploited to execute arbitrary script code...

Joomla Spider Facebook 1.6.1 SQL Injection

Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy: https://extensions.joomla.org/extensions/extension/social-web/social-display/spider-facebook/ Demo:...

Joomla! Component Spider Facebook 1.6.1 - SQL Injection

Joomla! Component Spider Facebook 1.6.1 - SQL Injection Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy:...

Joomla Spider Facebook 1.6.1 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy:...

Joomla! Component Spider Facebook 1.6.1 - SQL Injection

Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy: https://extensions.joomla.org/extensions/extension/social-web/social-display/spider-facebook/ Demo:...

Tiger Post Facebook Auto Post Multi Pages/Groups/Profiles 3.0.1 SQL Injection

Exploit Title: Tiger Post - Facebook Auto Post Multi Pages/Groups/Profiles v3.0.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://vtcreators.com/ Software Buy: https://codecanyon.net/item/tiger-post-facebook-auto-post-multi-pagesgroupsprofiles/15279075 Demo:...

Tiger Post 3.0.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Tiger Post - Facebook Auto Post Multi Pages/Groups/Profiles v3.0.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://vtcreators.com/ Software Buy:...

Cross-site Request Forgery (CSRF)

facebook-sdk is vulnerable to cross-site request forgery CSRF. It does not support the state property in auth urls for CSRF detection, allowing CSRF attacks based on state mutation...

Facebook Pull - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-011

This module enables you to add integration with Facebook API. The module doesn't sufficiently sanitize incoming data from Facebook. This vulnerability is mitigated by the fact that an attacker must have be able to successfully pass malicious code through Facebook API or alter facebooks DNS and...

Zomato: Unauthorised Access to Anyone's User Account

When we do Login with Facebook on the Zomato app, you're doing zero authentication of the user. I'm able to hack into the targeted user's accounts by just using the Facebook ID. Affected API raw request: POST...

I got emails - G Suite Vulnerability

After recent finding about Uber and SendGrid bug, I decided to check other third party applications that were also used for similar cases. During the investigation, some third party applications were found to be vulnerable including G Suite. The initial research of this vulnerability started when...

Uber: Chained Bugs to Leak Victim's Uber's FB Oauth Token

The Facebook OAuth application was misconfigured to allow any URL that followed the https://auth.uber.com/login? format to be provided as a redirecturi. By taking advantage of this, @ngalog was able to discover that the nexturl parameter could be added to the redirecturi allowing it to be chained...

Facebook Unveils 'Delegated Recovery' to Replace Traditional Password Recovery Methods

How do you reset the password for your Facebook account if your primary email account also gets hacked? Using SMS-based security code or maybe answering the security questions? Well, it's 2017, and we are still forced to depend on insecure and unreliable password reset schemes like email-based or...

Facebook Tackles Account Recovery with Delegated Recovery Protocol

Account recovery, the second fiddle to authentication, still largely hinges on insecure schemes such as security questions or email-based verification for password resets and the like. Facebook today at the Enigma Conference in Oakland, Calif., offered a more modern solution called Delegated...

Facebook Adds FIDO U2F Security Keys Feature For Secure Logins

Hacking password for a Facebook account is not easy, but also not impossible. We have always been advising you to enable two-factor authentication — or 2FA — to secure your online accounts, a process that requires users to manually enter, typically a six-digit secret code generated by an...