Facebook HipHop Virtual Machine Information Disclosure Vulnerability

Facebook HipHop Virtual Machine is a HipHop virtual machine developed by Facebook Inc. that significantly improves PHP performance for loading dynamic pages. An information disclosure vulnerability exists in versions of Facebook HipHop Virtual Machine prior to 3.3.0, which allows remote attackers...

Facebook HipHop Virtual Machine CRLF Injection Vulnerability

Facebook HipHop Virtual Machine is a HipHop virtual machine developed by Facebook Inc. that significantly improves PHP performance for loading dynamic pages. A CRLF injection vulnerability exists in versions of Facebook HipHop Virtual Machine prior to 2.4.2, which allows remote attackers to execu...

Facebook HipHop Virtual Machine crypgraphic protection mechanism bypass vulnerability

Facebook HipHop Virtual Machine is a HipHop virtual machine developed by Facebook Inc. that significantly improves PHP performance for loading dynamic pages. A crypgraphic protection mechanism bypass vulnerability exists in Facebook HipHop Virtual Machine versions prior to 3.3.0. The vulnerabilit...

Facebook Careers Page XXE Vulnerability Patched

A vulnerability was discovered and patched in a third-party service that handles resumes on Facebook’s careers page. The discovery was worth more than $6,000 in a bounty paid out by Facebook to researcher Mohamed Ramadan of Egypt, who published some details of the vulnerability and exploit on his...

Steal Facebook user information: using Android same origin policy vulnerability a malicious application is found-vulnerability warning-the black bar safety net

A few months ago we studied the Android same origin policy（SOP）of vulnerability, however recently there has been a use of this vulnerability to Facebook user attack a malicious application, which utilizes code based on the disclosed Metasploit test code. myhack58 science: the same-origin policy...

Hacking Facebook Accounts Using Android 'Same Origin Policy' Vulnerability

A serious security vulnerability has been discovered in the default web browser of the Android OS lower than 4.4 running on a large number of Android devices that allows an attacker to bypass the Same Origin Policy SOP. The Android Same Origin Policy SOP vulnerability CVE-2014-6041 was first...

CVE-2014-2209

Facebook HipHop Virtual Machine HHVM before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory...

CVE-2014-2208

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

CVE-2014-2209

CVE-2014-2209: HHVM before 3.1.0 fails to drop supplemental group memberships in hphp/util/capability.cpp and hphp/util/light-process.cpp, enabling remote attackers to bypass access restrictions by abusing file/directory group permissions. Affected: Facebook HipHop Virtual Machine (HHVM) prior to...

CVE-2014-2208

The vulnerability CVE-2014-2208 affects Facebook HHVM prior to version 2.4.2. A CRLF injection in the LightProcess protocol implementation (hphp/util/light-process.cpp) allows remote attackers to cause arbitrary command execution by injecting a newline character before the end of a string. Affect...

CVE-2014-2209

Facebook HipHop Virtual Machine HHVM before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory...

CVE-2014-2208

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

CVE-2014-5386

CVE-2014-5386 affects Facebook HHVM: the mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp does not seed the random number generator before HHVM 3.3.0, which enables remote attackers to defeat cryptographic protections by reusing a single initialization vector. Root cause is lac...

Facebook Photo Uploader ActiveX Control FileMask Method Buffer Overflow - Ver2 (CVE-2008-0660)

Facebook is a social networking website which allows its users to publish their photos. The website publishes an ActiveX control, ImageUploader4.ocx, to assist photo uploading. A buffer overflow vulnerability exists in the Facebook Photo Uploader ActiveX control. The flaw is due to a boundary err...

Facebook Bug Bounty #17 - Migrate Privacy Vulnerability

Document Title: =============== Facebook Bug Bounty 17 - Migrate Privacy Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1370 Facebook Security ID: 216850649 Vulnerability Magazine:...

Facebook Bug Bounty #17 - Migrate Privacy Vulnerability

Document Title: =============== Facebook Bug Bounty 17 - Migrate Privacy Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1370 Facebook Security ID: 216850649 Vulnerability Magazine:...

Facebook Studio Cross Site Scripting

Document Title: =============== Facebook Bug Bounty 16 Studio - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1368 Facebook Security ID: 219162244 Release Date: ============= 2014-12-10 Vulnerability Laboratory ID VL-ID:...

Cardoza Facebook Like Box < 2.8.3 - Multiple CSRF

The Easy Social Like Box – Popup – Sidebar Widget WordPress plugin was affected by a Multiple CSRF security vulnerability...

Facebook BB #18 - IDOR Issue & Privacy Vulnerability

Document Title: =============== Facebook BB 18 - IDOR Issue & Privacy Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1371 Facebook Security ID: 219208937 Release Date: ============= 2014-12-12 Vulnerability Laboratory ID VL-ID:...

WordPress WP-FB-AutoConnect 4.0.5 CSRF / XSS

Title: WordPress 'WP-FB-AutoConnect' plugin - XSS/CSRF Version: 4.0.5 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2014/12/12 Download: https://wordpress.org/plugins/wp-fb-autoconnect/ Contacted WordPress: 2014/11/27 ----------------------------------------------------------------...