CVE-2022-31164

CVE-2022-31164 affects Tovy, a staff management system for Roblox groups. In versions prior to 0.7.51, the authentication/authorization flow allows a user to log in as another user, including privileged accounts, enabling impersonation. The issue is resolved by upgrading to version 0.7.51 or late...

Roblox breached: Internal documents posted online by unknown attackers

A data compromise situation has impacted Roblox Corporation, the developers of the massive smash-hit video game Roblox. An as-yet unknown attacker has breached an employee account, and is in the process of exposing the data theyve collected. Nobody knows if theyve exhausted their newly-plundered...

Malicious code in free-roblox-robux-codes-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85b4eb2412fd3ecd6a02ea953676f5672d1607ef55be3715fc83b5d56e3e376d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3186 Malicious code in free-roblox-robux-codes-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85b4eb2412fd3ecd6a02ea953676f5672d1607ef55be3715fc83b5d56e3e376d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in roblox-es6-migration-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e6744d30670c11b6c78c162fbf812373252b628ed5af3977d02003b1d7711c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5833 Malicious code in roblox-es6-migration-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e6744d30670c11b6c78c162fbf812373252b628ed5af3977d02003b1d7711c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Russia Was Behind DDoS Attacks Against Ukraine, US Officials Say

Plus: A crypto crime crackdown, Roblox ripoffs, and more of the week’s top security news...

Roblox Beamers steal items from kids

Roblox gamers are once again being warned to be on their guard against scammers plundering valuable digital items. Most multiplayer titles are all about customization. You won’t find many popular games where digital items aren’t up for grabs. Some games lock the items, such as outfits, weapons, o...

Bogus JS libraries become sustained ransomware threat for Roblox gamers

If your kids play Roblox, you may wish to warn them of ransomware perils snapping at their heels. A very smart, and determined attack has been taking place for a little while now. Although initially dismissed as a form of prank, the developers under fire now disagree. Whether prank or malicious...

CVE-2021-41191

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add @requireapikey in BOT/lib/cogs/website.p...

CVE-2021-41191

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add @requireapikey in BOT/lib/cogs/website.p...

CVE-2021-41191

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add @requireapikey in BOT/lib/cogs/website.p...

Code injection

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add @requireapikey in BOT/lib/cogs/website.p...

CVE-2021-41191

Summary of CVE-2021-41191 Roblox-Purchasing-Hub (open-source) had a vulnerability in versions 1.0.1 and earlier allowing someone who has another user’s API URL to obtain product files without an API key. The issue has been fixed in version 1.0.2. A workaround mentioned in the sources is to add an...

CVE-2021-41191 API giving out files without key

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add @requireapikey in BOT/lib/cogs/website.p...

Roblox-Purchasing-Hub 安全漏洞

Roblox-Purchasing-Hub is a Roblox product purchasing center. A security vulnerability exists in Roblox-Purchasing-Hub that stems from a security risk in Roblox-Purchasing-Hub version 1.0.1 and earlier versions that allows someone with someone's API URL to obtain product files without an API key...

CVE-2021-41191: Improper Encoding or Escaping of Output

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add @requireapikey in BOT/lib/cogs/website.p...

I played the free online games your kids are playing and here’s what happened

“Throat kill! Throat kill!” “I need a dad.” These are just some of the things I heard a six-year-old boy shout at his iPad while I was babysitting one evening. I was disturbed, yet compelled to learn more. Babysitting is always a puzzling experience for me. Why are their hands always sticky? Who...

A week in security (August 17 – 23)

Last week on Malwarebytes Labs, we looked at the impact of COVID-19 on healthcare cybersecurity, dug into some pandemic stats in terms of how workforces coped with going remote, and served up a crash course on malware detection. Our most recent Lock and Code podcast explored the safety of parenta...

Hackers hit Reddit; deface 70+ Subreddits with Pro-Trump messages

By Sudais Asif Before Reddit, in June 2020, more than 1,150 Roblox accounts were also hacked with pro-Trump content. This is a post from HackRead.com Read the original post: Hackers hit Reddit; deface 70+ Subreddits with Pro-Trump messages...