CVE-2016-6875

CVE-2016-6875 corresponds to an infinite recursion in WDDX handling in Facebook HHVM prior to 3.15.0. The vulnerability statement notes an unspecified impact via unknown vectors. The linked metrics assign a high base score (CVSSv2: 7.5; CVSSv3: 9.8) with network access and low attack complexity, ...

CVE-2016-6874

CVE-2016-6874 affects Facebook HHVM (before 3.15.0) via the array_*_recursive functions, enabling unspecified impact through recursion. The available connected docs confirm the affected component and root cause (recursion in specific functions) but do not provide concrete exploit details, vectors...

CVE-2016-6871

CVE-2016-6871: Integer overflow in Bcmath within Facebook HHVM before 3.15.0 can trigger a buffer overflow via unknown vectors, with unspecified impact. Affected product: Facebook HHVM (HipHop VM). Practical impact is described as overflow-related, but the exact exploit scenarios are not detailed...

CVE-2016-6875

Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors...

CVE-2016-6874

The arrayrecursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, related to recursion...

CVE-2016-6872

CVE-2016-6872 involves an integer overflow in StringUtil::implode in Facebook HHVM prior to 3.15.0. The vulnerability has a high/severe impact profile (CVSS v3.0: CRITICAL, 9.8; v2.0: HIGH, 7.5) with network attack vector and no authentication required. The reports state that the overflow could e...

CVE-2016-6873

Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors...

CVE-2016-6870

CVE-2016-6870 affects Facebook HHVM prior to 3.15.0. The vulnerability is an out-of-bounds write in the third-party/multibyte-related functions: mb_detect_encoding, mb_send_mail, and mb_detect_order, leading to unspecified impact through unknown vectors. The provided public documents do not speci...

CVE-2016-6871

Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow...

Drupal Facebook Pull Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Facebook Pull is one of the modules. A cross-site scripting vulnerability exists in the Drupal Facebook Pull module. This vulnerability can be exploited to execute arbitrary script code...

Joomla Spider Facebook 1.6.1 SQL Injection

Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy: https://extensions.joomla.org/extensions/extension/social-web/social-display/spider-facebook/ Demo:...

Joomla Spider Facebook 1.6.1 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy:...

Joomla! Component Spider Facebook 1.6.1 - SQL Injection

Joomla! Component Spider Facebook 1.6.1 - SQL Injection Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy:...

Joomla! Component Spider Facebook 1.6.1 - SQL Injection

Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfacebook Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy: https://extensions.joomla.org/extensions/extension/social-web/social-display/spider-facebook/ Demo:...

Tiger Post Facebook Auto Post Multi Pages/Groups/Profiles 3.0.1 SQL Injection

Exploit Title: Tiger Post - Facebook Auto Post Multi Pages/Groups/Profiles v3.0.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://vtcreators.com/ Software Buy: https://codecanyon.net/item/tiger-post-facebook-auto-post-multi-pagesgroupsprofiles/15279075 Demo:...

Tiger Post 3.0.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Tiger Post - Facebook Auto Post Multi Pages/Groups/Profiles v3.0.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://vtcreators.com/ Software Buy:...

Cross-site Request Forgery (CSRF)

facebook-sdk is vulnerable to cross-site request forgery CSRF. It does not support the state property in auth urls for CSRF detection, allowing CSRF attacks based on state mutation...

Facebook Pull - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-011

This module enables you to add integration with Facebook API. The module doesn't sufficiently sanitize incoming data from Facebook. This vulnerability is mitigated by the fact that an attacker must have be able to successfully pass malicious code through Facebook API or alter facebooks DNS and...

Zomato: Unauthorised Access to Anyone's User Account

When we do Login with Facebook on the Zomato app, you're doing zero authentication of the user. I'm able to hack into the targeted user's accounts by just using the Facebook ID. Affected API raw request: POST...

I got emails - G Suite Vulnerability

After recent finding about Uber and SendGrid bug, I decided to check other third party applications that were also used for similar cases. During the investigation, some third party applications were found to be vulnerable including G Suite. The initial research of this vulnerability started when...