3745 matches found
CVE-2020-1911
A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...
Facebook WhatsApp Desktop Cross-Site Scripting Vulnerability
Facebook WhatsApp is a suite of mobile applications from the American company Facebook that utilize the web to deliver text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, and more. A cross-site scripting...
Facebook's Zuckerberg Says He's Got Election Stuff Under Control
Facebook rolls out its plan to protect the US from November mayhem...
GHSA-363H-VJ6Q-3CMJ Rosetta-Flash JSONP Vulnerability in hapi
This description taken from the pull request provided by Patrick Kettner. Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy. Recommendation - Update hapi to version 6.1.1...
Rosetta-Flash JSONP Vulnerability in hapi
This description taken from the pull request provided by Patrick Kettner. Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy. Recommendation - Update hapi to version 6.1.1...
Glassdoor: Account Takeover
A user's access token from a Facebook/Google app was found to be accepted by the target application, allowing for account takeover. The token was not properly validated, enabling the use of any previously obtained user token to log in to the application...
Facebook Hits Back At Apple’s iOS 14 Privacy Update
Facebook is lambasting an upcoming Apple mobile operating system privacy update, which requires application to ask users for permission before collecting and sharing their data. In the iOS 14 update, Apple iPhone and iPad users have an explicit option to opt out of allowing apps to collect data...
No more targeted ads on iPhone after new iOS 14 update – Facebook
By Deeba Ahmed Apple’s new anti-tracking tools on iOS 14 will render Facebook’s Audience Network ineffective. This is a post from HackRead.com Read the original post: No more targeted ads on iPhone after new iOS 14 update - Facebook...
Facebook Finally Cracks Down on QAnon
Plus: A top-secret iPod, Carnival ransomware, and more of the week’s top security news...
How Facebook and Other Sites Manipulate Your Privacy Choices
Social media platforms repeatedly use so-called dark patterns to nudge you toward giving away more of your data...
Apple Knocked Off Perch as Most Imitated Brand for Phishing Attacks
Google and Amazon overtook Apple in the second quarter Q2 of 2020 as the brand most spoofed by attackers to lure people into falling for phishing attacks. The leaderboard change is likely due to activity related to the COVID-19 pandemic, according to new research. While the number of so-called...
WordPress The Official Facebook Chat Plugin <= 1.5 - Authenticated Options Change vulnerability
Authenticated Options Change vulnerability discovered by WordFence in WordPress The Official Facebook Chat Plugin versions = 1.5. Solution Update the WordPress The Official Facebook Chat Plugin to the latest available version at least 1.6...
The Official WordPress Facebook Chat Plugin < 1.6 - Authenticated Options Change to Chat Takeover
This flaw made it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. Obtain PageID from a test Facebook Page found under page - about - pageID. Use this...
The Official WordPress Facebook Chat Plugin < 1.6 - Authenticated Options Change to Chat Takeover
This flaw made it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. PoC Obtain PageID from a test Facebook Page found under page - about - pageID. Use...
uDork - Tool That Uses Advanced Google Search Techniques To Obtain Sensitive Information In Files Or Directories, Find IoT Devices, Detect Versions Of Web Applications, And So On
uDork is a script written in Bash Scripting that uses advanced Google search techniques to obtain sensitive information in files or directories, find IoT devices, detect versions of web applications, and so on. uDork does NOT make attacks against any server, it only uses predefined dorks and/or...
Introduction to SQL: Examples, Best Practices and Pitfalls
SQL Structured Query Language has been with us for more than half a century and it’s not going away anytime soon. Popular in both traditional relational databases and newer NoSQL databases technologies, SQL is widely used for data analytics, Big Data processing, coding languages, and more. I’m a...
Facebook's NSO Group Lawsuit Over WhatsApp Spying Set to Proceed
Facebook’s lawsuit against NSO Group over alleged spying on WhatsApp users will be allowed to go forward. WhatsApp-owner Facebook is alleging that NSO Group exploited a vulnerability in WhatsApp to deploy its spyware against human rights activists, journalists and political dissidents. A federal...
Facebook osquery elevation of privilege vulnerability
Facebook osquery is a SQL-based, open-source operating system detection and monitoring framework from Facebook Inc. in the United States. An elevation of privilege vulnerability exists in Facebook osquery versions prior to 4.4.0. The vulnerability stems from the fact that when a Windows system is...