Vortex - VPN Overall Reconnaissance, Testing, Enumeration And eXploitation Toolkit

VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit Overview A very simple Python framework, inspired by SprayingToolkit, that tries to automate most of the process required to detect, enumerate and attack common O365 and VPN endpoints like Cisco, Citrix, Fortinet, Pulse,...

TikTok: XSS and iframe injection on tiktok ads portal using redirect params

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via the "redirect" parameter. We thank @cancerz for reporting this to our team...

TikTok: IDOR on TikTok Seller

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Seller endpoint via the "promotionid" parameter, which could have resulted in a promotion being remover from a user's account. We thank @aidilarf2000 for reporting this to our team...

TikTok: Privilege Escalation on TikTok for Business

An IDOR Insecure Direct Object Reference vulnerability was found on the "orgid" and "accountid" parameters on a Business.TikTok.com endpoint, which could have resulted in an authenticated user with "Analyst" level permissions to close another user's ads accounts. We thank @naaash for reporting th...

TikTok: Impersonation of tiktok account via Broken Link in TikTok Newsroom

A broken link was found on TikTok Newsroom, which could have allowed an attacker to claim the associated username and hijack the link. We thank @bushidobrown200 for reporting this to our team and confirming its resolution...

TikTok: Stored XSS on TikTok Ads

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via a SVG file containing an xss payload. We thank @sinayeganeh for reporting this to our team...

TikTok: One Click Account Hijacking via Unvalidated Deeplink

A WebView Hijacking vulnerability was found on the TikTok Android application via an un-validated deeplink on an un-sanitized parameter. This could have resulted in account hijacking through a JavaScript interface. We thank @fr4via for reporting this to our team...

TikTok: View thumbnail of any private video (friends or followers only) of Private/Public account

Vulnerability description not provided...

WordPress Easy Tiktok Feed plugin <= 1.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Tiktok Feed plugin versions = 1.1.0. Solution Update the WordPress Easy Tiktok Feed plugin to the latest available version at least 1.1.1...

WordPress Add Tiktok Pixel for Tiktok ads (+Woocommerce) plugin <= 1.2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin versions = 1.2.1. Solution Update the WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin to the latest available version at least 1.2.2...

WordPress Add Tiktok Pixel for Tiktok ads (+Woocommerce) plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin versions = 1.2.1. Solution Update the WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin to the latest available version at least 1.2.2...

WordPress Floating Tiktok button (Tiktok Follow button)+ Tikcode (QrCode) for Tiktok followers plugin <= 1.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Floating Tiktok button Tiktok Follow button+ Tikcode QrCode for Tiktok followers plugin versions = 1.0.4. Solution Update the WordPress Floating Tiktok button Tiktok Follow button+ Tikcode QrCode for Tiktok followers plugin to...

WordPress Floating Tiktok button (Tiktok Follow button)+ Tikcode (QrCode) for Tiktok followers plugin <= 1.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Floating Tiktok button Tiktok Follow button+ Tikcode QrCode for Tiktok followers plugin versions = 1.0.4. Solution Update the WordPress Floating Tiktok button Tiktok Follow button+ Tikcode QrCode for...

WordPress Easy Tiktok Feed plugin <= 1.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Tiktok Feed plugin versions = 1.1.0. Solution Update the WordPress Easy Tiktok Feed plugin to the latest available version at least 1.1.1...

TikTok: HTML Injection via Email Share

A HTML injection was found on a TikTok endpoint via the "nameofowner" parameter. We thank @lu3ky-13 for reporting this to our team...

TikTok: Information Leakage via TikTok Ads Web Cache Deception

A theoretical web cache deception vulnerability was found on TikTok Ads, that could have resulted in information leakage if clicked on by an authenticated user. We thank @arifmkhls for reporting this to our team and confirming its resolution...

If Russia Invades Ukraine, TikTok Will See It Up Close

As troops amass on Ukraine’s border, civilians capture it all on camera. Online sleuths are now unpacking the details...

TikTok: Instance Page DOS within Organization on TikTok Ads

A vulnerability was found on the Instance Page service of TikTok Ads, which would allow an Operator to perform a Denial of Service DoS on the Front End of only their own organization. We thank @arsenelupin for reporting this to our team...

TikTok: IDOR delete any Tickets on ads.tiktok.com

An IDOR Insecure Direct Object Reference vulnerability was found on TikTok ads, through the "draftorderid" parameter which could have allowed an attacker to delete the support tickets of other users. We thank @datph4m for reporting this to our team and confirming its resolution...

TikTok: Reflected xss on ads.tiktok.com using `from` parameter.

A XSS cross-site scripting vulnerability was found on a TikTok ads endpoint using the "from" parameter. We thank @imrannisar for reporting this to our team and confirming its resolution...