3745 matches found
Cross site request forgery (csrf)
The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...
Design/Logic Flaw
The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...
CVE-2021-24218 Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion
The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...
CVE-2021-24218
The CVE-2021-24218 entry concerns the Facebook for WordPress plugin (WordPress Facebook Pixel) versions before 3.0.4. Root cause: CSRF due to lack of nonce protection in the AJAX handlers wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings, with additional input sanitization gaps in saveFbe...
CVE-2021-24217 Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain
The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...
CVE-2021-24217
The CVE-2021-24217 entry concerns the WordPress Facebook for WordPress plugin prior to version 3.0.0. The vulnerability arises because run_action deserializes user-supplied data, enabling PHP object injection, and an available magic method could be exploited to achieve remote code execution. Affe...
WordPress 插件 代码问题漏洞
WordPress Plugin is an open source application plugin for WordPress. The WordPress Facebook for WordPress plugin has a security vulnerability prior to version 3.0.0, which can be exploited by attackers to achieve remote code execution via the available magic methods...
Facebook WhatsApp and WhatsApp Business have unspecified vulnerabilities
Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...
Facebook WhatsApp Buffer Overflow Vulnerability
Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...
Facebook Had Years to Fix Flaw That Leaked 500M Users’ Data
Software makers can’t catch every bug every time, but Facebook had ample warning about the privacy problems with its “contact import” feature...
Facebook ads dropped malware posing as Clubhouse app for PC
By Deeba Ahmed Upon clicking the ad, the user is taken to a fake Clubhouse app website that looks quite authentic but its download link drops malware. Last year, in two separate incidents hackers abused Facebook ads to phish 615,000 account credentials. Then, the infamous Ragnar Locker ransomware...
Data from 500M LinkedIn Users Posted for Sale Online
Personal data from more than 500 million LinkedIn users has been posted for sale online in yet another incident of threat actors scraping data from public profiles and slinging it online for potential cybercriminal misuse. Hackers posted an archive containing data they said includes LinkedIn IDs,...
Facebook: Stolen Data Scraped from Platform in 2019
The leak of personal data from more than 533 million Facebook users was scraped from their profiles by malicious actors because of a security flaw in the company’s platform prior to September 2019, the social media giant said Tuesday. Threat actors posted that data to a public hacker forum over t...
What Really Caused Facebook's 500M-User Data Leak?
The company's explanations have been confusing and inconsistent, but there are finally some answers...
Are You One of the 533M People Who Got Facebooked?
Neer-do-wells leaked personal data -- including phone numbers -- for some 553 million Facebook users this week. Facebook says the data was collected before 2020 when it changed things to prevent such information from being scraped from profiles. To my mind, this just reinforces the need to remove...
Has Facebook leaked your phone number?
Unless you keep your social media at a pole’s distance, you have probably heard that an absolutely enormous dataset—containing over 500 million phone numbers—has been made public. These phone numbers have been in the hands of some cybercriminals since 2019 due to a vulnerability in Facebook that...
Facebook WhatsApp 缓冲区错误漏洞
Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...
533M Facebook Accounts Leaked Online: Check if You Are Exposed
More than 533 million Facebook users had their personal information posted to a public hacker forum, a move that is raising concerns about an uptick in cybercrime leveraging the credentials. The publicly released Facebook user data is believed to be part of a 2019 “Add Friend” Facebook security b...
A week in security (March 29 – April 4)
Last week on Malwarebytes Labs, our podcast featured Malwarebytes senior security researcher JP Taggart, who talked to us about why you need to trust your VPN. You’ve likely heard the benefits of using a VPN: You can watch TV shows restricted to certain countries, you can encrypt your web traffic...