apostrophe-tumblr (>=0.5.1, <=0.5.13), http-teapot-comment (0.1.0) +1 more potentially affected by CVE-2016-1000237 via sanitize-html (>=1.1.4, <=1.4.2)

sanitize-html NPM version =1.1.4, =0.5.1, =0.5.13 - http-teapot-comment 0.1.0 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: OSV:GHSA-3J7M-HMH3-9JMP...

Automattic: Follow by email allows for following by unverified emails

The initial report outlined being able to add any email to a Tumblr account without verifying it first which is expected behavior that does not pose a security risk. However, the reporter also reported that these unverified emails were able to be used in our “follow by email” feature which we did...

Automattic: Rate Limit Misconfiguration on tumblr login .

Summary: The Rate Limit should always be on the login endpoint and have an acceptable limit, for example, 20 rate limit, but when there is no limit or the limit is huge, for example, 5000, this is certainly dangerous because it is a Rate Limit Misconfiguration, for example . -------------- PoC :...

Cross site request forgery (csrf)

The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php...

To bypass Tumblr user registration process in the reCAPTCHA validation-vulnerability warning-the black bar safety net

Hello everyone, this article share it is the author by Tumblr user registration process, found the Tumblr of“human body parts validation”mechanism for reCAPTCHA there is a defect, it can be easily bypassed. This bypasses the formation of the security risk is that a malicious attacker can perform ...

A week in security (November 19 – 25)

Last week on Malwarebytes Labs, we took a look at a devastating business email compromise attack, web skimming antics, and the fresh perils of Deepfakes. We also checked out some Chrome bug issues, and took the deepest of deep dives into DNA testing. Other cybersecurity news Adobe Flash bug—get...

apostrophe-tumblr (>=0.5.1, <=0.5.13) potentially affected by CVE-2017-16017 via sanitize-html (1.1.4)

sanitize-html NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - apostrophe-tumblr =0.5.1, =0.5.13 Source cves: CVE-2017-16017 Source advisory: OSV:GHSA-WG96-3933-J2W5...

Tumblr Privacy Bug Could Have Exposed Sensitive Account Data

Tumblr on Wednesday disclosed it had fixed a vulnerability that could have exposed sensitive account information including usernames/passwords and individual IP addresses. However, the company stressed there’s no evidence that any data was exposed. The bug existed in the “Recommended Blogs” featu...

Tumblr Patches A Flaw That Could Have Exposed Users' Account Info

Tumblr today published a report admitting the presence of a security vulnerability in its website that could have allowed hackers to steal login credentials and other private information for users' accounts. The affected information included users email addresses, protected hashed and salted...

Tumblr Patches A Flaw That Could Have Exposed Users' Account Info

Tumblr today published a report admitting the presence of a security vulnerability in its website that could have allowed hackers to steal login credentials and other private information for users' accounts. The affected information included users email addresses, protected hashed and salted...

Shopify: [ux.shopify.com] Subdomain takeover

The subdomain ux.shopify.com points to domains.tumblr.com, but this subdomain is not used by anyone on Tumblr. Any user can register his blog for this subdomain. ux.shopify.com. 3600 IN CNAME domains.tumblr.com. F176574 As an PoC, I registered a blog for this subdomain. It is available only with...

Hacker Selling Over 1 Million Decrypted Gmail and Yahoo Passwords On Dark Web

Hardly a day goes without headlines about any significant data breach. In past year, billions of accounts from popular sites and services, including LinkedIn, Tumblr, MySpace, Last.FM, Yahoo!, VK.com were exposed on the Internet. Now, according to the recent news, login credentials and other...

Fedora 24 : shotwell (2017-ddee871dd1)

This release turns on HTTPS encyption all over the publishing plugins. Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade. Users of Picasa and Youtube publishing are strongly advised to...

Fedora 25 : shotwell (2017-8c3c43cc4f)

This release turns on HTTPS encyption all over the publishing plugins. Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade. Users of Picasa and Youtube publishing are strongly advised to...

FreeBSD : shotwell -- failure to encrypt authentication (5a9b3d70-48e2-4267-b196-83064cb14fe0)

Jens Georg reports : I have just released Shotwell 0.24.5 and 0.25.4 which turn on HTTPS encryption all over the publishing plugins. Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade. Users of...

shotwell -- failure to encrypt authentication

Jens Georg reports: I have just released Shotwell 0.24.5 and 0.25.4 which turn on HTTPS encryption all over the publishing plugins. Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade. Users of...

DailyMotion Hack Leaks Emails, Passwords of 87M Users

DailyMotion, a popular video sharing website, said Tuesday it recently suffered an “external security problem” resulting in the compromise of an unspecified number of its users’ data. LeakedSource.com, a repository of breached data, added DailyMotion to its list of “Hacked Sites” on Monday. The...

Breaking — Russian Hacker Responsible for LinkedIn Data Breach Arrested by FBI

The alleged Russian hacker arrested by the FBI in collaboration with the Czech police is none other than the hacker who was allegedly responsible for massive 2012 data breach at LinkedIn, which affected nearly 117 Million user accounts. Yevgeniy N, 29-year-old Russian hacker was arrested in Pragu...

Snapchat: Subdomain takeover of blog.snapchat.com

Overview The ANAME for blog.snapchat.com, which redirects to snapchat-blog.com, was pointing to tumblr for Snapchat's blog. This blog had been expired or had removed the CNAME claim. Adding "snapchat-blog.com" to the custom domain setting on tumblr allowed takeover of this subdomain. Repro Steps ...

makeuptumblr.chanel.com XSS vulnerability

Vulnerable URL: http://makeuptumblr.chanel.com/contents/thematics/0007/index.php?disk=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E=/home=false Details: Description| Value ---|--- Patched:| Yes, at 20.07.2017 Latest check for patch:| 20.07.2017 12:49 GMT Vulnerability type:| XSS Vulnerabilit...