PT-2015-4265

Name of the Vulnerable Software and Affected Versions cardoza-facebook-like-box plugin versions prior to 2.8.3 for WordPress Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of...

CVE-2014-9524: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...

Facebook HipHop Virtual Machine crypgraphic protection mechanism bypass vulnerability

Facebook HipHop Virtual Machine is a HipHop virtual machine developed by Facebook Inc. that significantly improves PHP performance for loading dynamic pages. A crypgraphic protection mechanism bypass vulnerability exists in Facebook HipHop Virtual Machine versions prior to 3.3.0. The vulnerabilit...

Facebook HipHop Virtual Machine Information Disclosure Vulnerability

Facebook HipHop Virtual Machine is a HipHop virtual machine developed by Facebook Inc. that significantly improves PHP performance for loading dynamic pages. An information disclosure vulnerability exists in versions of Facebook HipHop Virtual Machine prior to 3.3.0, which allows remote attackers...

Facebook HipHop Virtual Machine CRLF Injection Vulnerability

Facebook HipHop Virtual Machine is a HipHop virtual machine developed by Facebook Inc. that significantly improves PHP performance for loading dynamic pages. A CRLF injection vulnerability exists in versions of Facebook HipHop Virtual Machine prior to 2.4.2, which allows remote attackers to execu...

Facebook HipHop Virtual Machine Expected Access Restriction Bypass Vulnerability

Facebook HipHop Virtual Machine is a HipHop virtual machine developed by Facebook Inc. that significantly improves PHP performance for loading dynamic pages. Facebook HipHop Virtual Machine versions prior to 3.1.0 suffer from an Expected Access Restriction Bypass vulnerability that allows remote...

Facebook Careers Page XXE Vulnerability Patched

A vulnerability was discovered and patched in a third-party service that handles resumes on Facebook’s careers page. The discovery was worth more than $6,000 in a bounty paid out by Facebook to researcher Mohamed Ramadan of Egypt, who published some details of the vulnerability and exploit on his...

Steal Facebook user information: using Android same origin policy vulnerability a malicious application is found-vulnerability warning-the black bar safety net

A few months ago we studied the Android same origin policy（SOP）of vulnerability, however recently there has been a use of this vulnerability to Facebook user attack a malicious application, which utilizes code based on the disclosed Metasploit test code. myhack58 science: the same-origin policy...

Hacking Facebook Accounts Using Android 'Same Origin Policy' Vulnerability

A serious security vulnerability has been discovered in the default web browser of the Android OS lower than 4.4 running on a large number of Android devices that allows an attacker to bypass the Same Origin Policy SOP. The Android Same Origin Policy SOP vulnerability CVE-2014-6041 was first...

CVE-2014-2209

Facebook HipHop Virtual Machine HHVM before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory...

CVE-2014-2208

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

CVE-2014-2208

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

CVE-2014-2209

Facebook HipHop Virtual Machine HHVM before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory...

CVE-2014-2208

The vulnerability CVE-2014-2208 affects Facebook HHVM prior to version 2.4.2. A CRLF injection in the LightProcess protocol implementation (hphp/util/light-process.cpp) allows remote attackers to cause arbitrary command execution by injecting a newline character before the end of a string. Affect...

CVE-2014-2209

CVE-2014-2209: HHVM before 3.1.0 fails to drop supplemental group memberships in hphp/util/capability.cpp and hphp/util/light-process.cpp, enabling remote attackers to bypass access restrictions by abusing file/directory group permissions. Affected: Facebook HipHop Virtual Machine (HHVM) prior to...

CVE-2014-5386

CVE-2014-5386 affects Facebook HHVM: the mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp does not seed the random number generator before HHVM 3.3.0, which enables remote attackers to defeat cryptographic protections by reusing a single initialization vector. Root cause is lac...

CVE-2014-2209: Undefined Security Weakness

Facebook HipHop Virtual Machine HHVM before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory...

CVE-2014-5386: Undefined Security Weakness

The mcryptcreateiv function in hphp/runtime/ext/mcrypt/extmcrypt.cpp in Facebook HipHop Virtual Machine HHVM before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single...

CVE-2014-2208: Improper Control of Generation of Code

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

CVE-2014-6229: Exposure of Sensitive Information to an Unauthorized Actor

The HashContext class in hphp/runtime/ext/exthash.cpp in Facebook HipHop Virtual Machine HHVM before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...