Curiosity Kills Security When it Comes to Phishing

Regardless of the amount of training and technology applied to phishing prevention, people are going to click on links, trust messages from supposedly known sources and get into trouble online. A recent academic paper collates the results of an experiment conducted with more than 1,200 German...

Spear Phishing Attacks

Really interesting research: "Unpacking Spear Phishing Susceptibility," by Zinaida Benenson, Freya Gassmann, and Robert Landwirth. Abstract: We report the results of a field experiment where we sent to over 1200 university students an email or a Facebook message with a link to non-existing party...

X (Formerly Twitter): [CRITICAL] Full account takeover using CSRF

Reporter discovered a CSRF vulnerability in the linkage between Periscope accounts and Facebook. This vulnerability would potentially allow for account take-over of Periscope accounts. The problem was resolved and the reporter awarded a bounty...

For many well-known companies impact of Oracle Responsys local file inclusion vulnerability-vulnerability warning-the black bar safety net

Today I want to show you is, how do I find the Oracle Responsys cloud service system in a local file inclusion vulnerabilities LFI Airport. Due to the current commercial sales, network storage and social relationships companies are using the Oracle Responsys cloud solution, so that the...

facebook.com Open Redirect vulnerability

Vulnerable URL:...

CVE-2017-8769

Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files Audio, Documents, Images, Video, and Voice Notes associated with a chat, even after that chat is deleted. There may be users who expect file deletion to occur upon chat deletion, or who expect...

CVE-2017-8769

Facebook WhatsApp Messenger for Android prior to 2.16.323 stores files associated with chats (Audio, Documents, Images, Video, Voice Notes) on the SD card in cleartext, and this persists after the chat is deleted. The root cause described is that files are kept in cleartext on external storage de...

MobaXtrem 10.2 Remote Code Execution Exploit

Exploit for windows platform in category remote exploits ''' Exploit Title: MobaXtrem 10.2 telnet Server Remote Code Execution Date: 15/5/2017 Exploit Author: Sultan Albalawi Software Link: http://download.mobatek.net/10220170312132617/MobaXtermPortablev10.2.zip Version: 10.2 Tested on: win7 CVE ...

Facebook's Observations on Information Operations and the 2016 US Election

Facebook published paper on the information operations it has seen, as well as some observations regarding the recent US election. It's interesting reading...

Wordpress Art Picture Shop Plugins File Upload Vulnerability

Exploit for php platform in category web applications Wordpress Plugins Art Picture Shop File Upload Vulnerability | CSRF Author : Berandal Google Dork: inurl:/wp-content/plugins/art-picture-shop/admin/ Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ +-+-+-+-+-+-+-+-+ |B|e|r|a|n|d|a|l|...

Weblate: Facebook share URL should be HTTPS

Hi, Related Report Issue: 225722 Navigate this URL: https://demo.weblate.org/projects/hello/master/enGB/ Find the button name "Share" Navigate to Share on facebook! I noticed that link not using HTTPS See my attached photo. Thanks,...

Facebook Last Warning Phishing Scam Stealing Login, Credit Card Data

By Waqas Facebook is undoubtedly one of the most used social media networks with 1.86 billion monthly active users. Thats why its users are also under constant threat by hackers and cyber criminals. Recently, we discovered a phishing scam targeting Facebook users by tricking them into giving away...

WordPress Facebook <= 1.0.13 - Authenticated SQL Injection

http://www.defensecode.com/advisories/DC-2017-04-011WordPressFacebookPluginAdvisory.pdf PoC Vulnerable POST URL: http://vulnerablesite.com/wp-admin/admin.php?page=SpiderFacebookmanage Vulnerable POST Body: searcheventsbytitle=number=1ornot=ordesc=1by=type AND SELECT FROM SELECTSLEEP5DefenseCode...

WordPress Facebook <= 1.0.13 - Authenticated SQL Injection

http://www.defensecode.com/advisories/DC-2017-04-011WordPressFacebookPluginAdvisory.pdf Vulnerable POST URL: http://vulnerablesite.com/wp-admin/admin.php?page=SpiderFacebookmanage Vulnerable POST Body: searcheventsbytitle=&pagenumber=1&serchornot=&ascordesc=1&orderby=type AND SELECT FROM...

Weblate: CSRF to Connect third party Account

Hello Weblate Security Team, I have found security vulnerability in your website : https://hosted.weblate.org Vulnerable URL :- https://hosted.weblate.org/accounts/profile/auth Vulnerability :- CSRF to Connect FACEBOOK Account CARF Code :- save as name.html and send it to victim Full Youtube Vide...

Weblate: Open redirect in Signing in via Social Sites

Weak Authentication Leads to the Open redirection to Malicios Sites : Signing in via Facebook : + https://hosted.weblate.org/accounts/login/facebook/?next=///evil.com Signing in via Gmail : + https://hosted.weblate.org/accounts/login/google-oauth2/?next=///evil.com Signing in via Github: +...

Webroot 'mistakenly' flags Windows as Malware and Facebook as Phishing site

Popular antivirus service Webroot mistakenly flagged core Windows system files as malicious and even started temporarily removing some of the legit files, trashing user computers around the world. The havoc caused after the company released a bad update on April 24, which was pulled after...

Meh : CSRF in Facebook Delegated Account Recovery

Note this is going to be a quick post. This year, at Enigma 2017 Conference, Facebook introduced a way to move Account Recovery beyond Email and the "Secret" Question. After the presentation the moved operationally and presented the first integration partner : Github. These days I have seen a lot...

Facebook Proxygen Security Vulnerability (CNVD-2017-05674)

Facebook Proxygen is a set of open source C++ HTTP class libraries from the U.S. company Facebook . A security vulnerability exists in the SPDY/2 codec in versions of Facebook Proxygen prior to 2015-11-09. An attacker can exploit the vulnerability to perform hijacking and injection attacks...

Facebook Proxygen Security Breach

Facebook Proxygen is a set of open source C++ HTTP class libraries from the U.S. company Facebook . A security vulnerability exists in versions of Facebook Proxygen prior to 2015-11-09 that stems from the program not properly managing the HTTPMessage.request state. A remote attacker can exploit t...