YTStealer targets YouTube content creators

Researchers are reporting the discovery of malware targeting YouTub content creators. The aim is to compromise accounts and then take over the victims channels completely. The malware, dubbed YTStealer, has one game plan: Grabbing authentication cookies. A site gives you an authentication cookie...

New YTStealer Malware is Hijacking YouTube Channels

By Deeba Ahmed YTStealer is a new info-stealer on the block targeting YouTube content creators to steal authentication tokens and take… This is a post from HackRead.com Read the original post: New YTStealer Malware is Hijacking YouTube Channels...

New YTStealer Malware Aims to Hijack Accounts of YouTube Content Creators

Cybersecurity researchers have documented a new information-stealing malware that targets YouTube content creators by plundering their authentication cookies. Dubbed "YTStealer" by Intezer, the malicious tool is likely believed to be sold as a service on the dark web, with it distributed using fa...

Stripo Inc: Non-revoked API Key Information disclosure via Stripo_report()

Talking about 983331 reports where a security researcher reported secret API key leakage vulnerability in a JavaScript file at Stripo. This report is disclosed on HackerOne, and the team at Stripo have forgotten to blur the API keys from the report before disclosing it to the public. The API keys...

MAL-2022-1155 Malicious code in ati-youtube-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8344c7e8dda880657242cbad08566311c1065e3fa7f85af4c2e7365849aae601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ati-youtube-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8344c7e8dda880657242cbad08566311c1065e3fa7f85af4c2e7365849aae601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spring Tips: Learn Spring for GraphQL (parts 3 and 4 of an ongoing series)

Hi, Spring fans! In thi^^^ these installments, we continue our series introducing the Spring for GraphQL project. This series features Spring for GraphQL lead Rossen Stoyanchev @rstoya05 - whose work you may know from basically everything in the wide and wonderful world of Springdom having to do...

This Week in Spring - June 7th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Ive just landed in tantalizing Toronto, Canada, for the SpringOne Tour Toronto show. Im so excited to be here, at long last, after so long away from one of my favorite countries. Ill be doing two talks - my usual, Kubernetes...

[Security Nation] Omer Akgul and Richard Roberts on YouTube VPN Ads

!\Security Nation\ Omer Akgul and Richard Roberts on YouTube VPN Adshttps://blog.rapid7.com/content/images/2022/05/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with academics Omer Akgul and Richard Roberts about their recent paper, “Investigating Influencer VPN Ads ...

This Week in Spring - May 24th, 2022

Hi, Spring fans! Im in Spain for business and not just a little pleasure. Yesterday, my partner, her mother, and I went to Formentera, Spain, a little island off of Ibiza, Spain. It was amazing. Were now in Ibiza, Spain, which is a little island not far from Barcelona, Spain, on the mainland of...

CVE-2022-1334

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1334

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1334

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1334

The CVE-2022-1334 entry concerns the WordPress WP YouTube Live plugin (versions before 1.8.3). The vulnerability stems from insufficient validation, sanitization, and escaping of multiple settings, enabling Cross-Site Scripting (XSS) by high-privilege users (e.g., admins), even when unfiltered_ht...

WordPress plugin WP YouTube Live 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress WP YouTube Lives plugin prior to 1.8.3,...

Moodle vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 Flash Video aka FLV files and 2 YouTube...

Cisco RV340 SSL VPN Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco RV340 SSL VPN Unauthenticated Remote Code Execution', 'Description' = %q This module exploits a stack buffer overflow in the Cisco RV serie...

BlackBasta Ransom Code Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/998022b70d83c6de68e5bdf94e0f8d71.txt Contact: [email protected] Media: twitter.com/malvuln Threat: BlackBasta Ransom Vulnerability: Code Execution Description: BlackBasta looks for and loads a DLL...

“Reject All” cookie consent button is coming to European Google Search and YouTube

Google will soon be giving European countries a "Reject All" button in the Search and YouTube cookie consent banner. This change, which was revealed by Googles Product Manager for Privacy, Safety & Security Sammit Adhya in a blog post, has already been rolled out in France and will be cascaded to...

WordPress plugin WP YouTube Live cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. WordPress plugin WP YouTube Live 1.7.21 and previous versions are vulnerable to a cross-site scripting vulnerability, which stems from the plugin being vulnerable to a reflected cross-site scripting attack via POST data in the...