A week in security (August 7 - August 13)

Last week on Malwarebytes Labs: Zoom clarifies user consent requirement when training its AI Several hospitals still counting the cost of widespread ransomware attack Old exploit kits still kicking around in 2023 YouTube makes sweeping changes to tackle spam on Shorts videos Googles "browse...

YouTube makes sweeping changes to tackle spam on Shorts videos

YouTube is rolling out unclickable links. Video portals like YouTube have had to deal with spam comments and bogus links for many years. With new additions to a platform come new places for scammers to go about their business. YouTube is now cracking down on links posted to the comments section o...

GitLab: Information Disclosure - Pvt Gitlab Issue Disclosing Through GitLab Unfiltered YouTube channel.

A private issue report containing sensitive information was inadvertently disclosed through a video on the GitLab Unfiltered YouTube channel. The video showcased specific URLs, code snippets, and vulnerability descriptions, posing a potential security risk. Immediate action was recommended to...

CVE-2023-25475

Cross-Site Request Forgery CSRF vulnerability in Vladimir Prelovac Smart YouTube PRO plugin = 4.3 versions...

CVE-2023-25475

Cross-Site Request Forgery CSRF vulnerability in Vladimir Prelovac Smart YouTube PRO plugin = 4.3 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Vladimir Prelovac Smart YouTube PRO plugin = 4.3 versions...

CVE-2023-25475

CVE-2023-25475 : CSRF vulnerability in the WordPress plugin Smart YouTube PRO (Vladimir Prelovac) affecting versions

CVE-2023-25475 WordPress Smart YouTube PRO Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Vladimir Prelovac Smart YouTube PRO plugin = 4.3 versions...

WordPress YouTube Embed - YouTube Gallery, Vimeo Gallery - Wordpress Plugin Plugin <= 10.3 is vulnerable to Cross Site Scripting (XSS)

Software YouTube Embed - YouTube Gallery, Vimeo Gallery - Wordpress Plugin Type Plugin Vulnerable versions = 10.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Plugin Smart YouTube PRO 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Video Player for YouTube Plugin < 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Video Player for YouTube Type Plugin Vulnerable versions 1.5.3 Fixed in 1.5.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3d6bf7dd95eb Credits Rafie Muhammad Patchstack...

WordPress YouTube Easy Embed (Wall/Rail) Plugin < 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software YouTube Easy Embed Wall/Rail Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b0d95fa5dab1 Credits Rafie Muhammad...

WordPress StreamWeasels YouTube Integration Plugin < 1.1.4 is vulnerable to Cross Site Scripting (XSS)

Software StreamWeasels YouTube Integration Type Plugin Vulnerable versions 1.1.4 Fixed in 1.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4670ce2ab82b Credits Rafie Muhammad...

WordPress YouTube Responsive Gallery Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software YouTube Responsive Gallery Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 53d93d2b0d34 Credits Rafie Muhammad Patchstack...

WordPress Automatic YouTube Gallery Plugin < 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Automatic YouTube Gallery Type Plugin Vulnerable versions 2.3.3 Fixed in 2.3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ed4d7f0ef45b Credits Rafie Muhammad Patchstac...

Bazaar Social Listing Shopping Web PHP Template 2.3.2 Privilege Escalation

==================================================================================================================================== | Title : Bazaar | Social Listing Shopping Web PHP Template v2.3.2 Privilege Escalation Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.P...

Unveiling New Big Head Ransomware Variants and Their Stealthy Tactics

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The emergence of Big Head ransomware and its variants suggests a shared source, distributed through deceptive Windows update and Word installer disguises. The threat actor engages via email and Telegram,...

youtube service is vulnerable to XSS vulnerability

Description If an attacker is able to insert a div with attributes on a page where the youtube service is enabled, they can craft a width attribute that would allow them to execute arbitrary JS on the page. Other attributes like theme or controls are also vulnerable to this. Proof of Concept html...

Now’s not the time to take our foot off the gas when it comes to fighting disinformation online

Welcome to this weeks edition of the Threat Source newsletter. In the wake of the 2016 and 2020 presidential elections, it seemed like big tech companies were taking the fight against disinformation seriously. Social media outlets set up new fact-checking procedures and got more aggressive about...

Sneaky DogeRAT Trojan Poses as Popular Apps, Targets Indian Android Users

A new open source remote access trojan RAT called DogeRAT targets Android users primarily located in India as part of a sophisticated malware campaign. The malware is distributed via social media and messaging platforms under the guise of legitimate applications like Opera Mini, OpenAI ChatGPT, a...