CVE-2019-14319

The TikTok formerly Musical.ly application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker to extract private sensitive information by sniffing network traffic...

CVE-2019-5980

Cross-site request forgery CSRF vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5980

Cross-site request forgery CSRF vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5980

The CVE-2019-5980 entry concerns the WordPress plugin “Related YouTube Videos.” A CSRF vulnerability exists in versions prior to 1.9.9 that can allow remote attackers to hijack administrator authentication via unspecified vectors. Affected product: WordPress Related YouTube Videos plugin (versions

Beware! Playing Untrusted Videos On VLC Player Could Hack Your Computer

If you use VLC media player on your computer and haven't updated it recently, don't you even dare to play any untrusted, randomly downloaded video file on it. Doing so could allow hackers to remotely take full control over your computer system. That's because VLC media player software versions...

WordPress Plugin "Related YouTube Videos" vulnerable to cross-site request forgery

Overview WordPress Plugin "Related YouTube Videos" provided by Chris Doerr contains a cross-site request forgery vulnerability CWE-352. Shoichiro Ishikawa of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University directly reported this vulnerability...

JVN#31406910: WordPress Plugin "Related YouTube Videos" vulnerable to cross-site request forgery

WordPress Plugin "Related YouTube Videos" provided by Chris Doerr contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the information...

WordPress Related YouTube Videos Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Related YouTube Videos plugin is a plugin used to embed YouTube videos in pages. A cross-site request forgery vulnerability exists in...

WordPress Related YouTube Videos plugin <= 1.9.8 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Related YouTube Videos plugin versions = 1.9.8. Solution Update the WordPress Related YouTube Videos plugin to the latest available version at least 1.9.9...

Supra Smart Cloud TV Remote File Containment Vulnerability

Zoran Supra Smart Cloud TV is a smart TV from Zoran USA. A security vulnerability exists in the 'openLiveURL' function in Zoran Supra Smart Cloud TV. A local attacker can exploit this vulnerability to broadcast fake videos without authentication via /remote/mediacontrol?action=setUri&uri= URI...

FBI Releases Article on Protected Voices Campaign

The Federal Bureau of Investigation FBI has released an article on the Protected Voices initiative designed to mitigate the risk of cyber influence operations targeting U.S. elections. As part of the initiative, FBI offices are coordinating with political campaigns at the local, state, and federa...

Supra Smart Cloud TV Remote File Inclusion

Exploit Title: Remote file inclusion Date: 03-06-2019 Exploit Author: Dhiraj Mishra Vendor Homepage: https://supra.ru Software Link: https://supra.ru/catalog/televizory/televizorsuprastvlc40lt0020f/ CVE: CVE-2019-12477 References: https://nvd.nist.gov/vuln/detail/CVE-2019-12477...

Free Training: New Certified Learning Paths

The Qualys Training team is eager to share all of the recent additions to our free training program, as well as provide insight into what is coming in 2019. You can expect to see regular updates as we continue to improve our training offerings! It is our mission to help Qualys customers and...

Videos and Links from the Public-Interest Technology Track at the RSA Conference

Yesterday at the RSA Conference, I gave a keynote talk about the role of public-interest technologists in cybersecurity. Video here. I also hosted a one-day mini-track on the topic. We had six panels, and they were all great. If you missed it live, we have videos: How Public Interest Technologist...

How the Dark Web Data Bazaar Fuels Enterprise Attacks

It seems every aspect of our lives is available to be found somewhere on the internet. And the information available isn’t simply embarrassing browsing histories but ranges from our medical histories to the logon credentials we use to access many of our online services. This is certainly a privac...

FTC Hits TikTok With Record $5.7 Million Fine Over Children’s Privacy

The social media app will pay $5.7 million to settle the allegations, and be required to delete videos uploaded by anyone under 13...

Robert Bosch Smart Camera App for Android Privilege Permission and Access Control Vulnerability

Robert Bosch Smart Camera App for Android is an Android-based smart camera management application from Robert Bosch, Germany. A privilege-granting and access control vulnerability exists in versions of the Bosch Smart Camera App for Android prior to 1.3.1, which stems from a failure to set securi...

How to Recover Lost or Deleted Files?

Have you ever lost your important files, like memories or official documents, accidentally or maliciously? Adding more... when you even do not have any backup for the same. Unfortunate, right? We've all been there. Just last week I formatted my computer and later found that I didn't have any back...

A week in security (January 21 – 27)

Last week on the Malwarebytes Labs blog, we took a look at Modlishka, the latest hurdle in two-factor authentication 2FA, the potential for abuse of push notifications, a malware-phishing combo by the name of CryTekk ransomware, and why we detect PUPs, but enforce the power of users' choice. We...

Fedora 28 : webkit2gtk3 (2018-509fc4a5c8)

This update addresses the following vulnerability : - CVE-2018-4345 This update brings the following changes : - Many improvements and fixes for video playback with media source extensions MSE, which improve the user experience across the board, and in particular for playback of WebM videos. - Fi...