TikTok: Reflected XSS in TikTok endpoints

Cross site scripting vulnerability was found in few TikTok endpoints using the region parameter. We thank @sh1yo for reporting this to our team...

TikTok: HTML Injection on tiktoktutorials via firstName parameter

HTML injection was found in tiktoktutorials endpoint which could have potentially allowed attackers to modify the content of the email and trick users into visiting malicious sites. We thank @siratsami for reporting this to our team...

TikTok: BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOS

A vulnerability was identified in TikTok comments which could have potentially allowed users to bypass the commenting restriction by responding to existing comments via video message. We thank @boynamedboy for reporting this to our team and confirming the resolution...

Experts Uncover Mobile Spyware Attacks Targeting Kurdish Ethnic Group

Cybersecurity researchers on Tuesday released new findings that reveal a year-long mobile espionage campaign against the Kurdish ethnic group to deploy two Android backdoors that masquerade as legitimate apps. Active since at least March 2020, the attacks leveraged as many as six dedicated Facebo...

A week in security (August 30 – September 5)

Last week on Malwarebytes Labs ProxyToken: another nail-biter from Microsoft Exchange Macs turn on apps signed by Symantec, treat them as malware Google Play sign-ins can be abused to track another person’s movements FTC bans SpyFone and its CEO from continuing to sell stalkerware BrakTooth...

TikTok: Incorrect authorization to the intelbot service leading to ticket information

An authentication bypass and site wide stored XSS cross-site scripting vulnerability was found on TikTok Ads as JWT JSON Web Token was not verified properly. We thank @johnstone for reporting this to our team and confirming its resolution...

TikTok: XSS on tiktok.com

A cross site scripting vulnerability was found in a TikTok endpoint using the returnurl parameter. We thank @@arifmkhls for reporting this to our team and confirming the resolution...

TikTok: Multiple IDORs in family pairing api

An IDOR Insecure Direct Object Reference vulnerability was found on a TikTok Family Pairing endpoint which could have been used to disable various features. We thank @s3c for reporting this to our team and confirming the fix. Write up...

Another Hacker Arrested for 2020 Twitter Hack and Massive Bitcoin Scam

A U.K. citizen has been arrested in the Spanish town of Estepona over his alleged involvement in the July 2020 hack of Twitter, resulting in the compromise of 130 high-profile accounts. Joseph O'Connor, 22, has been charged with intentionally accessing a computer without authorization and obtaini...

CVE-2020-24143

Directory traversal in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter...

CVE-2020-24142

Server-side request forgery in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hos...

CVE-2020-24143

Directory traversal in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter...

Server side request forgery (ssrf)

Server-side request forgery in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hos...

CVE-2020-24143

Directory traversal in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter...

CVE-2020-24143

CVE-2020-24143 describes a directory traversal vulnerability in the WordPress plugin “Video Downloader for TikTok” (aka downloader-tiktok), version 1.3. An attacker can access files outside the web root via the njt-tk-download-video parameter. Public details in the connected Red Hat advisory corr...

CVE-2020-24142

Server-side request forgery in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hos...

CVE-2020-24142

CVE-2020-24142 involves the WordPress plugin Video Downloader for TikTok (aka downloader-tiktok) up to version 1.3. The Red Hat and NVD entries confirm a server-side request forgery (SSRF) in the njt-tk-download-video parameter that allows an attacker to cause the vulnerable web app to issue craf...

TikTok: CSRF Account Takeover

A Cross-Site Request Forgery CSRF vulnerability was found on a TikTok endpoint which could have resulted in a full account takeover. We thank @s3c for reporting this to our team and confirming its resolution...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Ninja Team Video Downloader for TikTok that allows an...

WordPress 路径遍历漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A path traversal vulnerability exists in WordPress Ninja Team Video Downloader for TikTok, which ste...