Russia Wants to Label Meta an ‘Extremist Organization’

Plus: A satellite hack, ransomware extradition, and more of the week’s top security news...

Here's How to Find if WhatsApp Web Code on Your Browser Has Been Hacked

Meta Platforms' WhatsApp and Cloudflare have banded together for a new initiative called Code Verify to validate the authenticity of the messaging service's web app on desktop computers. Available in the form of a Chrome and Edge browser extension, the open-source add-on is designed to...

Meta blocks Russia-Ukraine disinformation campaigns on Facebook, Instagram

Meta says it has detected and removed two disinformation campaigns regarding the current Russia-Ukraine war. These campaigns, it says, were run by groups in Russia and Ukraine to target Ukraine users. In the post, Nathaniel Gleicher, Metas head of security policy, and David Agranovich, Metas...

WordPress SheetPress – Manage WordPress Meta data with Google Sheets plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SheetPress – Manage WordPress Meta data with Google Sheets plugin versions = 1.1. Solution No patched version available...

WordPress SheetPress – Manage WordPress Meta data with Google Sheets plugin <= 1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SheetPress – Manage WordPress Meta data with Google Sheets plugin versions = 1.1. Solution No patched version available...

WordPress WP Meta and Date Remover plugin < 1.9.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Meta and Date Remover plugin versions 1.9.6. Solution Update the WordPress WP Meta and Date Remover plugin to the latest available version at least 1.9.6...

[SECURITY] Fedora 34 Update: kernel-5.16.11-100.fc34

The kernel meta package...

[SECURITY] Fedora 35 Update: kernel-5.16.11-200.fc35

The kernel meta package...

[SECURITY] Fedora 35 Update: kernel-5.16.10-200.fc35

The kernel meta package...

CVE-2021-44610

Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...

permit() without updating nonce can result in replay attacks

Lines of code Vulnerability details Impact In PermitAndMulticall.sol the permit is called on the permitToken which allows you to sign the meta-transaction while someone else can submit it to the blockchain on your behalf. The problem is that a valid signature might be used several times in other...

Facebook sued for siphoning facial recognition data without consent

Ken Paxton, the Attorney General of Texas, recently filed a lawsuit against Facebooks parent company, Meta, for harvesting the facial recognition data of millions of Texan residents—for a decade. Paxton filed the lawsuit on Monday in the states Harrison County District Court. The suit contains...

WordPress Seo 301 Meta plugin <= 1.9.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress Seo 301 Meta plugin versions = 1.9.1. Solution Deactivate and delete. This plugin has been closed as of February 15, 2022 and is not available for download. This closure is temporary, pending a full review...

SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Request or Destination settings of the plugin: "...

[SECURITY] Fedora 34 Update: kernel-5.16.9-100.fc34

The kernel meta package...

Facebook Agrees to Pay $90 Million to Settle Decade-Old Privacy Violation Case

Meta Platforms has agreed to pay $90 million to settle a lawsuit over the company's use of cookies to allegedly track Facebook users' internet activity even after they had logged off from the platform. In addition, the social media company will be required to delete all of the data it illegally...

Debian DSA-5075-1 : minetest - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5075 advisory. Several vulnerabilities have been discovered in Minetest, a sandbox video game and game creation system. These issues may allow attackers to manipulate game...

France Rules That Using Google Analytics Violates GDPR Data Protection Law

French data protection regulators on Thursday found the use of Google Analytics a breach of the European Union's General Data Protection Regulation GDPR laws in the country, almost a month after a similar decision was reached in Austria. To that end, the National Commission on Informatics and...

Injection Vulnerability

Minetest is vulnerable to injection vulnerability. An attacker is able to exploit the vulnerability by adding or modifying arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection...

PT-2022-36818

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a stack-buffer-overflow crash, specifically a WRITE 1 type. The crash occurs in the decompress rNUMBER, read rNUMBER meta data, an...