516 matches found
TikTok: Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products
The "Search Product" function in the TikTok Shop Seller API contained a vulnerability that allowed access to inactive or suspended products by manipulating the "live" parameter in the API request. The vulnerability was reported to the team and remediated...
TikTok: Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone Verification
The authentication bypass vulnerability on the TikTok Seller signup process allowed account creation without phone verification...
TikTok: RXSS on TikTok endpoints
A cross-site scripting vulnerability was discovered in two TikTok incentive endpoints due to improper output encoding of user-supplied data. This allowed JavaScript code injection into the affected endpoints...
SAHU TikTok Pixel for E-Commerce <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The SAHU TikTok Pixel for E-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
The Bin Laden Letter Is Being Weaponized by the Far Right
Far-right influencers and right-wing lawmakers are using the spread of Osama bin Laden’s “Letter to America” to call for a TikTok ban and boost decades old conspiracies...
CVE-2023-46642
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin = 1.2.2 versions...
CVE-2023-46642
A vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce sahu-tiktok-pixel.This issue affects SAHU TikTok Pixel for E-Commerce: from n/a through = 1.2.2...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin = 1.2.2 versions...
CVE-2023-46642
CVE-2023-46642 affects the SAHU TikTok Pixel for E-Commerce WordPress plugin up to version 1.2.2. The issue is a stored Cross-Site Scripting (XSS) vulnerability that requires an authenticated admin-level (admin+) user to trigger. Root cause is insufficient input sanitization/output escaping in th...
CVE-2023-46642 WordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin = 1.2.2 versions...
WordPress Plugin SAHU TikTok Pixel for E-Commerce Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin SAHU TikTo...
TikTok Streamers Are Staging ‘Israel vs. Palestine’ Live Matches to Cash In on Virtual Gifts
TikTokkers are using a little-known livestreaming feature to falsely represent Israelis and Palestinians—and the company is taking a cut of costly in-app gifts viewers give to participants...
WordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software SAHU TikTok Pixel for E-Commerce Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46642 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7f22eacc059a Credits Rio...
TikTok: Multiple Open Redirect on TikTok domains
An open redirect vulnerability was discovered in the login process on TikTok Seller domains. This could have allowed takeover of a TikTok Seller account. The issue was reported privately and has been resolved...
TikTok: Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is Known
The branded hashtag feature on TikTok allowed users partnered with an account manager to view videos uploaded by private accounts if the video ID was known. This vulnerability has been remediated...
A week in security (October 2 - October 8)
Last week on Malwarebytes Labs: Multi-factor authentication has proven it works, so what are we waiting for? Amazon Prime email scammer snatches defeat from the jaws of victory 2023 MITRE ATT&CK® Evaluation results: Malwarebytes earns high marks for detection, blocks initial malware executions...
Meta and TikTok consider charging users for ad-free experience
According to a report from the Wall Street Journal, Meta is considering charging its European users around $14 a month if they don't agree to personalized ads on Facebook and Instagram. On mobile devices, the price for a single account would be higher because Meta would factor in commissions...
Where to find Opera’s Privacy and Security team online
Security Where to find Opera’s Privacy and Security team online Share September 27th, 2023 Hello everyone! Through this blog, we strive to offer timely updates and important information about Opera and our products. This helps us maintain an open line of communication with our users, particularly...
TikTok flooded with fake celebrity nude photo Temu referrals
Sites and apps frequently gamify their products and experiences to grow their user base. Its a relatively easy way to have their customers become more involved thanks to whatever incentives may be on offer. A game here, a rewards program there, and everyone is happy. Well, almost everyone. If...