PT-2021-23164

Name of the Vulnerable Software and Affected Versions Roblox-Purchasing-Hub versions 1.0.1 and prior Description A security risk in Roblox-Purchasing-Hub allowed individuals with access to someone's API URL to obtain product files without an API key. Recommendations For versions 1.0.1 and prior,...

Roblox-Purchasing-Hub security vulnerability

Roblox-Purchasing-Hub is a Roblox product purchasing center. A security vulnerability exists in Roblox-Purchasing-Hub that stems from a security risk in Roblox-Purchasing-Hub version 1.0.1 and earlier versions that allows someone with someone's API URL to obtain product files without an API key...

I played the free online games your kids are playing and here’s what happened

“Throat kill! Throat kill!” “I need a dad.” These are just some of the things I heard a six-year-old boy shout at his iPad while I was babysitting one evening. I was disturbed, yet compelled to learn more. Babysitting is always a puzzling experience for me. Why are their hands always sticky? Who...

A week in security (August 17 – 23)

Last week on Malwarebytes Labs, we looked at the impact of COVID-19 on healthcare cybersecurity, dug into some pandemic stats in terms of how workforces coped with going remote, and served up a crash course on malware detection. Our most recent Lock and Code podcast explored the safety of parenta...

Hackers hit Reddit; deface 70+ Subreddits with Pro-Trump messages

By Sudais Asif Before Reddit, in June 2020, more than 1,150 Roblox accounts were also hacked with pro-Trump content. This is a post from HackRead.com Read the original post: Hackers hit Reddit; deface 70+ Subreddits with Pro-Trump messages...

Hackers deface Roblox accounts with pro-Trump messages

By Sudais Asif Roblox has over 100 million registered users but only a handful of accounts were compromised. As the US presidential election is nearby, voters across the 50 state empire are betting on their candidates in light of the proposals they offer. However, some are going far enough to tak...

Roblox: Insecure redirect rule results in bypassing ban redirect on certain pages

Description Account bans on Roblox work via redirect rules. If an user attempts go to a page that's outside a whitelisted set of rules, they'll be redirected back to the ban page. After researching, I've found that the following rules are whitelisted and bypass this redirect: - Any URLs ending in...

Roblox: Malformed string sent through FireServer leads to server freezing/hanging

This was found an hour ago so if I get any information wrong, please comment and I'll get back to you! A cheater/exploiter can hang any Roblox gameserver due to a 5 line script which sends a big malformed string through SayMessageRequest resulting in the server to hang itself. This works in any...

Roblox: Reflected XSS through multiple inputs in the issue collector on Jira

Note I put this as Medium because that's what the CVE is. This vulnerability is known and it's classified under CVE-2018-5230. Here's a link to the thread on it by Atlassian: https://jira.atlassian.com/browse/JRASERVER-67289 Description --------------------- I noticed when testing that your Jira...

blog.roblox.com XSS vulnerability

Open Bug Bounty ID: OBB-318419 Description| Value ---|--- Affected Website:| blog.roblox.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Roblox: Subdomain Takeover at creatorforum.roblox.com

Hello. A few days ago, I was looking at Roblox subdomains, and I noticed an unusual one called creatorforum.roblox.com. Upon further investigation, I visited it and saw that creatorforum.roblox.com's CNAME was a nonexistant Discourse website. I immediately reported to [email protected], and...

A week in security (June 19 – June 25)

Last week, we expanded on all the different technologies that Malwarebytes uses to break the attack chain and our Incident Response solution. We also warned you about a Roblox Robux generator scam and a phish targeting customers of Barclays Bank. Below are notable news stories and security-relate...

The Roblox Robux generator is too good to be true

Roblox is an enormously popular MMORPG title for kids available on both PC and console, and it suffers no end of scammers trying to fleece its players as a result. While the game tries to block and filter text/URLs and comes with additional security features, potentially dubious sites also bounce...

ROBLOX - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application ROBLOX published at the 'play' market has multiple vulnerabilities...