3751 matches found
WordPress Facebook for WordPress Plugin 3.0.x < 3.0.4 CSRF Vulnerability
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
Facebook Thrift 安全漏洞
Facebook Thrift is a fork of Apache Thrift, a serialization and RPC framework for service communication from Facebook, USA. A security vulnerability exists in versions prior to Facebook Thrift v2021.02.22.00, which stems from an invalid free in Thrift's table-based serialization that could cause ...
CVE-2021-24218
The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...
CVE-2021-24217
The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...
CVE-2021-24217
The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...
CVE-2021-24218
The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...
Cross site request forgery (csrf)
The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...
Design/Logic Flaw
The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...
CVE-2021-24218 Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion
The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...
CVE-2021-24218
The CVE-2021-24218 entry concerns the Facebook for WordPress plugin (WordPress Facebook Pixel) versions before 3.0.4. Root cause: CSRF due to lack of nonce protection in the AJAX handlers wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings, with additional input sanitization gaps in saveFbe...
CVE-2021-24217 Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain
The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...
CVE-2021-24217
The CVE-2021-24217 entry concerns the WordPress Facebook for WordPress plugin prior to version 3.0.0. The vulnerability arises because run_action deserializes user-supplied data, enabling PHP object injection, and an available magic method could be exploited to achieve remote code execution. Affe...
WordPress 插件 代码问题漏洞
WordPress Plugin is an open source application plugin for WordPress. The WordPress Facebook for WordPress plugin has a security vulnerability prior to version 3.0.0, which can be exploited by attackers to achieve remote code execution via the available magic methods...
Facebook WhatsApp Buffer Overflow Vulnerability
Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...
Facebook WhatsApp and WhatsApp Business have unspecified vulnerabilities
Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...
Facebook Had Years to Fix Flaw That Leaked 500M Users’ Data
Software makers can’t catch every bug every time, but Facebook had ample warning about the privacy problems with its “contact import” feature...
Facebook ads dropped malware posing as Clubhouse app for PC
By Deeba Ahmed Upon clicking the ad, the user is taken to a fake Clubhouse app website that looks quite authentic but its download link drops malware. Last year, in two separate incidents hackers abused Facebook ads to phish 615,000 account credentials. Then, the infamous Ragnar Locker ransomware...
Data from 500M LinkedIn Users Posted for Sale Online
Personal data from more than 500 million LinkedIn users has been posted for sale online in yet another incident of threat actors scraping data from public profiles and slinging it online for potential cybercriminal misuse. Hackers posted an archive containing data they said includes LinkedIn IDs,...
Facebook: Stolen Data Scraped from Platform in 2019
The leak of personal data from more than 533 million Facebook users was scraped from their profiles by malicious actors because of a security flaw in the company’s platform prior to September 2019, the social media giant said Tuesday. Threat actors posted that data to a public hacker forum over t...