WordPress Add Tiktok Pixel for Tiktok ads (+Woocommerce) plugin <= 1.2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin versions = 1.2.1. Solution Update the WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin to the latest available version at least 1.2.2...

WordPress WP Relevant Ads plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Relevant Ads plugin versions = 1.0.0. Solution No patched version available...

WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin <= 1.7.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin versions = 1.7.9. Solution Update the WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin to the latest available version at least 1.7.91...

WordPress Add Linkedin insight tags for Linkedin ads plugin <= 1.2.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Add Linkedin insight tags for Linkedin ads plugin versions = 1.2.3. Solution Update the WordPress Add Linkedin insight tags for Linkedin ads plugin to the latest available version at least 1.2.4...

WordPress WP Relevant Ads plugin <= 1.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Relevant Ads plugin versions = 1.0.0. Solution No patched version available...

WordPress "Any Popup – Popup Forms, Optins & Ads" plugin <= 1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Any Popup – Popup Forms, Optins & Ads" plugin versions = 1.0. Solution No patched version available...

Google and Microsoft accused of feeding smaller search engines spam ads

Google and Microsoft appear to have been flooding their smaller search engine rivals with spam ads, to limit the number of higher-value ads that appear on them, according to data viewed by POLITICO. Ads are considered "spam" if they appear in search results but have little to no relevance to the...

ads-cash.ru Cross Site Scripting vulnerability OBB-2382482

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

TikTok: Instance Page DOS within Organization on TikTok Ads

A vulnerability was found on the Instance Page service of TikTok Ads, which would allow an Operator to perform a Denial of Service DoS on the Front End of only their own organization. We thank @arsenelupin for reporting this to our team...

TikTok: IDOR delete any Tickets on ads.tiktok.com

An IDOR Insecure Direct Object Reference vulnerability was found on TikTok ads, through the "draftorderid" parameter which could have allowed an attacker to delete the support tickets of other users. We thank @datph4m for reporting this to our team and confirming its resolution...

FBI warns of bogus job postings on recruitment sites

Before Christmas was a busy time down at the fake job factory, with all manner of dubious antics out to ruin someone’s day. We’re now info February and the bogus job offers show no sign of abating. In fact, the FBI considers it to be such a problem that its issued an alert. This isn’t your typica...

Semrush: IDOR allowing to read another user's token on the Social Media Ads service

The hotfix was released asap. The investigation showed that there were no cases of vulnerability exploitation. Social Media Ads is a tool for dedicated paid social specialists working with ads. The tool needs to interact with the user's social network account. To do this, Semrush collects a token...

Google Drops FLoC and Introduces Topics API to Replace Tracking Cookies for Ads

Google on Tuesday announced that it is abandoning its controversial plans for replacing third-party cookies in favor of a new Privacy Sandbox proposal called Topics, which categorizes users' browsing habits into approximately 350 topics. The new mechanism, which takes the place of FLoC short for...

CVE-2021-25073

The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack...

Steer clear of gift card balance scams

Rogue ads are a problem-causing menace which can strike in many ways. Malvertising often uses a combination of exploits to drop malware. Phishing campaigns get the job done with social engineering and bogus websites. This particular incident is an example of the latter, and a good reminder to be...

TikTok: Reflected xss on ads.tiktok.com using `from` parameter.

A XSS cross-site scripting vulnerability was found on a TikTok ads endpoint using the "from" parameter. We thank @imrannisar for reporting this to our team and confirming its resolution...

Facebook Launches 'Privacy Center' to Educate Users on Data Collection and Privacy Options

Meta Platforms, the company formerly known as Facebook, on Friday announced the launch of a centralized Privacy Center that aims to "educate people" about its approach with regards to how it collects and processes personal information across its family of social media apps. "Privacy Center provid...

TikTok: Cross site scripting via file upload in subdomain ads.tiktok.com

A file upload XSS cross-site scripting vulnerability was found in TikTok ads ticketing platform. Due to missing checks it was possible to upload .svg files which contained XSS payload. We thank @blubluuu for reporting this to our team and confirming its resolution...

Over 500,000 Android Users Downloaded a New Joker Malware App from Play Store

A malicious Android app with more than 500,000 downloads from the Google Play app store has been found hosting malware that stealthily exfiltrates users' contact lists to an attacker-controlled server and signs up users to unwanted paid premium subscriptions without their knowledge. The latest...

TikTok: Clickjacking Vulnerability In Whole Page Ads Tiktok

A clickjacking vulnerability was found on a TikTok Ads endpoint, where an attacker, once obtaining the ID, could trick another user to perform actions such as creating or deleting campaigns. We thank @rioncool22 for reporting this to our team...