CVE-2019-9920

CVE-2019-9920 affects Harmis JE Messenger component version 1.2.2 for Joomla!. The issue is an access-control weakness that allows performing an action in the context of another user’s account. Documents consistently describe the vulnerable component and version, but do not provide concrete techn...

CVE-2019-9919

CVE-2019-9919 affects Harmis JE Messenger component for Joomla! (version 1.2.2). The issue is a cross-site scripting (XSS) vulnerability where crafted messages can cause JavaScript to execute in the recipient’s browser when opened. The available sources consistently describe the vulnerability but...

CVE-2019-9919

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a way that JavaScript gets executed on the side of the receiving user when the message is opened, aka XSS...

CVE-2019-9918

CVE-2019-9918 affects Harmis JE Messenger for Joomla! v1.2.2. The root cause is unvalidated input and poorly written queries, enabling arbitrary SQL statements in the database. Exploitation details are not provided in the documents. A remediation patch/version is not specified in the given materi...

CVE-2019-9918

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and queries are not written in a way to prevent SQL injection. Therefore arbitrary SQL-Statements can be executed in the database...

PT-2019-19934 · Joomla · Harmis Je Messenger

Name of the Vulnerable Software and Affected Versions: Harmis JE Messenger component version 1.2.2 for Joomla! Description: The issue allows for the execution of arbitrary SQL statements in the database due to a lack of input validation and improper query writing, making it susceptible to SQL...

PT-2019-19936 · Harmis · Harmis Je Messenger

Name of the Vulnerable Software and Affected Versions: Harmis JE Messenger component version 1.2.2 Description: An issue was discovered in the Harmis JE Messenger component for Joomla!, allowing an action to be performed within the context of another user's account. Recommendations: For version...

PT-2019-19935 · Joomla · Harmis Je Messenger

Name of the Vulnerable Software and Affected Versions: Harmis JE Messenger component version 1.2.2 Description: An issue was discovered in the Harmis JE Messenger component for Joomla!. It is possible to craft messages in a way that JavaScript gets executed on the side of the receiving user when...

PT-2019-19938 · Joomla · Harmis Je Messenger

Name of the Vulnerable Software and Affected Versions: Harmis JE Messenger component version 1.2.2 for Joomla! Description: An issue allows Directory Traversal, which enables read access to arbitrary files. Recommendations: For Harmis JE Messenger component version 1.2.2, update to a version that...

PT-2019-19937 · Joomla · Harmis Je Messenger

Name of the Vulnerable Software and Affected Versions: Harmis JE Messenger component version 1.2.2 Description: An issue in the Harmis JE Messenger component for Joomla allows reading information that should only be accessible by a different user. Recommendations: For version 1.2.2, update to a...

Open redirect

Open Whisper Signal aka Signal-Desktop through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if for example Latin...

CVE-2019-9970

Open Whisper Signal aka Signal-Desktop through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if for example Latin...

CVE-2019-9970

Open Whisper Signal aka Signal-Desktop through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if for example Latin...

CVE-2019-9970

Open Whisper Signal (Signal-Desktop) up to version 1.23.1 and Signal Private Messenger for Android up to 4.35.3 are vulnerable to an IDN homograph attack when displaying messages that contain URLs. The root cause is that the app renders a clickable link even when the domain contains mixed Latin/C...

Telegram Gained 3 Million New Users During WhatsApp, Facebook Outage

WhatsApp, Facebook, and Instagram faced a widespread outage yesterday with users from around the world reporting issues with sending messages on WhatsApp and Messenger, posting feeds on Facebook and accessing other features on the three Facebook-owned platforms. While the outage was quite troubli...

Mapping Communication Between Facebook Accounts Using a Browser-Based Side Channel Attack

A now-patched vulnerability in the web version of Facebook Messenger allowed any website to expose who you have been messaging with. In a previous post, I showed how your Facebook likes, location history, and other metadata could have been extracted from your Facebook account using a side-channel...

CVE-2018-11820

creationtimestamp| type| source ---|---|--- 2019-02-26 00:58:19+00:00| seen| https://t.me/cibsecurity/2723...

Rietspoof malware distributes ransomware via messaging apps

By Waqas A malware strain dubbed as Rietspoof has been under the radar of researchers at Avast since last August. Reportedly, researchers suspect that the malware is on the rise and it is being distributed via Skype, Facebook Messenger, and other messaging apps. Researchers maintain that the...

A week in security (February 4 – 8)

Last week on Malwarebytes Labs, we took a closer look at the technical and reputational challenges for Facebook as it tries to integrate secure messaging across Messenger, WhatsApp, and Instagram. We explored Google’s latest attempts to change how the public sees—literally—web browser URLs, gave...

Merging Facebook Messenger, WhatsApp, and Instagram: a technical, reputational hurdle

Secure messaging is supposed to be just that—secure. That means no backdoors, strong encryption, private messages staying private, and, for some users, the ability to securely communicate without giving up tons of personal data. So, when news broke that scandal-ridden, online privacy pariah...