1335 matches found
CVE-2024-45607 whatsapp-api-js fails to validate message's signature
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...
CVE-2024-45607 whatsapp-api-js fails to validate message's signature
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...
CVE-2024-45607 whatsapp-api-js fails to validate message's signature
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...
CVE-2024-45607
CVE-2024-45607 affects whatsapp-api-js, a TypeScript server-agnostic WhatsApp Official API framework. The issue is improper validation of request signatures in WhatsAppAPI.verifyRequestSignature, allowing incorrect access control by manipulating the signature verification process and potentially ...
PT-2024-31706 · Unknown · Whatsapp-Api-Js
Name of the Vulnerable Software and Affected Versions: whatsapp-api-js versions prior to 4.0.3 Description: The issue concerns Incorrect Access Control in the whatsapp-api-js framework, impacting anyone using the post or verifyRequestSignature methods to handle messages. It is possible to check t...
whatsapp-api-js 数据伪造问题漏洞
whatsapp-api-js is a TypeScript server-agnostic official API framework for Whatsapp by Tomás Raiti Personal Developer. A data forgery issue vulnerability exists in versions of whatsapp-api-js prior to 4.0.3, which stems from incorrectly returning false for a valid signature when using the...
A week in security (August 26 – September 1)
Last week on Malwarebytes Labs: Iranian cybercriminals are targeting WhatsApp users in spear phishing campaign Fake Canva home page leads to browser lock Telegram CEO Pavel Durov charged with allowing criminal activity CODAC Behavioral Healthcare, US Marshalls are latest ransomware targets SMS...
Iranian cybercriminals are targeting WhatsApp users in spear phishing campaign
An Iranian state-sponsored group often referred to as Iran’s Islamic Revolutionary Guard Corps IRGC is making headlines again this season as Meta disclosed that the cybercriminals targeted WhatsApp users in Israel, Palestine, Iran, the UK, and the US. Other names for this group—depending on the...
Meta Exposes Iranian Hacker Group Targeting Global Political Figures on WhatsApp
Meta Platforms on Friday became the latest company after Microsoft, Google, and OpenAI to expose the activities of an Iranian state-sponsored threat actor, who it said used a set of WhatsApp accounts that attempted to target individuals in Israel, Palestine, Iran, the U.K., and the U.S. The...
New Phishing Scam Uses Google Drawings and WhatsApp Shortened Links
Cybersecurity researchers have discovered a novel phishing campaign that leverages Google Drawings and shortened links generated via WhatsApp to evade detection and trick users into clicking on bogus links designed to steal sensitive information. "The attackers chose a group of the best-known...
CVE-2024-3113
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...
CVE-2024-3113 FormFlow < 2.12.2 - Admin+ Stored XSS
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...
CVE-2024-3113
The CVE CVE-2024-3113 affects the FormFlow – WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin (pre-2.12.2). The Red Hat advisory and CVE details indicate this issue stems from inadequate sanitisation/escaping of certain plugin settings, enabling Stored XSS by h...
GuardZoo Malware Targets Over 450 Middle Eastern Military Personnel
Military personnel from Middle East countries are the target of an ongoing surveillanceware operation that delivers an Android data-gathering tool called GuardZoo. The campaign, believed to have commenced as early as October 2019, has been attributed to a Houthi-aligned threat actor based on the...
Malicious code in Whatsapp.API (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in icon-reactjs (npm)
This package is considered malicious because it contains code to spam Telegram channels and Whatsapp channels with fake payment confirmations...
MAL-2024-1603 Malicious code in icon-reactjs (npm)
This package is considered malicious because it contains code to spam Telegram channels and Whatsapp channels with fake payment confirmations...
WhatsApp cryptocurrency scam goes for the cash prize
This weekend a scammer tried his luck by reaching out to me on WhatsApp. It’s not that I don’t appreciate it, but trust me, it’s bad for your business. I received one message from a number hailing from the Togolese Republic. WhatsApp message from an unknow sender “Jay, your financial account has...
WhatsApp Engineers Fear Encryption Flaw Exposes User Data, Memo
By Deeba Ahmed Is your WhatsApp privacy a myth? New reports reveal a vulnerability that could expose who you message to government agents. This is a post from HackRead.com Read the original post: WhatsApp Engineers Fear Encryption Flaw Exposes User Data, Memo...
