TikTok: IDOR in family pairing API

Vulnerability description not provided...

CVE-2022-28799

CVE-2022-28799 affects the TikTok Android app prior to version 23.7.3. A crafted unvalidated deeplink could cause the app’s WebView (com.zhiliaoapp.musically) to load an arbitrary website, enabling an attached JavaScript interface to be exploited and potentially take over a user account. The root...

CVE-2022-28799

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...

PT-2022-19245 · Bytedance +1 · Tiktok +1

Name of the Vulnerable Software and Affected Versions: TikTok application before 23.7.3 for Android Description: The issue allows account takeover through a crafted URL that can force the com.zhiliaoapp.musically WebView to load an arbitrary website, potentially leveraging an attached JavaScript...

TikTok: Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.com

A blind stored Cross-Site Scripting XSS vulnerability was found on a TikTok Ads domain via uploaded file. We thank @mrzheev for reporting this to our team...

TikTok: Internal Employee informations Disclosure via TikTok Athena api

A vulnerability was found where internal employee email address could be disclosed on a TikTok Ads endpoint API by adding an "employeeemail" value to the "metrics" field/array in the request body. We thank @heinthant for reporting this to our team...

TikTok: Create product discounts of any shop

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok seller endpoint, which could have resulted in any user to create product discounts for shops they did not own. We thank @datph4m for reporting this to our team...

TikTok: TikTok Account Creation Date Information Disclosure

A vulnerability was found where the date of a user's account creation would be able to be obtained without logging into that account. We thank @f15 for reporting this to our team...

TikTok: disclosure the live_analytics information of any livestream.

A possible disclosure of the liveanalytics information for any livestream was found by accessing the roomid parameter via devtools. We thank @datph4m for reporting this to our team...

TikTok: Email address disclosure via invite token validatiion

The possibility of email address disclosure was found on a Business.TikTok.com endpoint as no rate limit was implemented on the invite token. We thank @noobbutcut3 for reporting this to our team...

TikTok: IDOR in report download functionality on ads.tiktok.com

An IDOR Insecure Direct Object Reference vulnerability was found on a TikTok Ads endpoint within the report download functionality. We thank @fm for reporting this to our team...

TikTok: IDOR on Tagged People

An Insecure Direct Object Reference IDOR vulnerability was found on the TikTok app where a user was able to tag any other user on videos that don't belong to them. We thank @apapedulimu for reporting this to our team. Write-Up:...

TikTok: XSS Payload on TikTok Seller Center endpoint

Stored Cross-Site Scripting XSS was found on the "Edit Product" page of a TikTok Seller Center endpoint via the "Product Name" field. We thank @aidilarf2000 for reporting this to our team...

TikTok: DOM XSS on ads.tiktok.com

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via the "settings" parameter, caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. We thank @0x7 for reporting this to our team...

TikTok reset account password Exploit

Exploit can reset password and get full control any TikTok account. You can change target mobile phone without any problems, because exploit use bypass 2fa vulnerability...

TikTok: CSRF protection bypass on TikTok Webcast Endpoints

Vulnerability description not provided...

TikTok: Stored XSS on TikTok Live Form

A Cross-Site Scripting XSS vulnerability was found on a restricted endpoint by an authenticated user inputting a payload in the "Description" form when creating a LIVE event on the TikTok mobile app. We thank @aidilarf2000 for reporting this to our team...

TikTok: Stored XSS Payload when sending videos

A Cross-Site Scripting XSS payload was found via the text used when sending videos to a friend, which could have resulted in session hijacking, user impersonation, or client-side attacks. We thank aidilarf2000 for reporting this to our team. Don't forget Vacation and Have Fun.. Write up :...

TikTok: CSRF in Changing User Verification Email

A Cross-Site Request Forgery CSRF was found on a TikTok Ads endpoint, which could have resulted in a malicious user adding a new user verification email address. We thank @fm for reporting this to our team...

TikTok: IDOR on TikTok Ads Endpoint

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Ads endpoint, which could have resulted in an unauthorized user adding products into another user's catalogue. We thank @sinayeganeh for reporting this to our team...