3695 matches found
WordPress Meetup 0.1 Authentication Bypass
CVE-2024-50483 Meetup = 0.1 - Authentication Bypass via Account Takeover Description: The Meetup plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them v...
South Korea Fines Meta $15.67M for Illegally Sharing Sensitive User Data with Advertisers
Meta has been fined 21.62 billion won $15.67 million by South Korea's data privacy watchdog for illegally collecting sensitive personal information from Facebook users, including data about their political views and sexual orientation, and sharing it with advertisers without their consent. The...
Exploit for Authorization Bypass Through User-Controlled Key in Tareqhasan Meetup
CVE-2024-50483 Meetup = 0.1 - Authentication Bypass via Ac...
New Phishing Kit Xiū gǒu Targets Users Across Five Countries With 2,000 Fake Sites
Cybersecurity researchers have disclosed a new phishing kit that has been put to use in campaigns targeting Australia, Japan, Spain, the U.K., and the U.S. since at least September 2024. Netcraft said more than 2,000 phishing websites have been identified the kit, known as Xiū gǒu, with the...
Threat actors use copyright infringement phishing lure to deploy infostealers
Cisco Talos has observed an unknown threat actor conducting a phishing campaign targeting Facebook business and advertising account users in Taiwan. The decoy email and fake PDF filenames are designed to impersonate a company's legal department, attempting to lure the victim into downloading and...
Fake Meta Ads Hijacking Facebook Accounts to Spread SYS01 Infostealer
A malvertising campaign is exploiting Meta's platform to spread SYS01 infostealer, targeting men 45+ via fake ads for…...
Malvertising Campaign Hijacks Facebook Accounts to Spread SYS01stealer Malware
Cybersecurity researchers have uncovered an ongoing malvertising campaign that abuses Meta's advertising platform and hijacked Facebook accounts to distribute an information stealer known as SYS01stealer. "The hackers behind the campaign use trusted brands to expand their reach," Bitdefender Labs...
The Disinformation Warning Coming From the Edge of Europe
Moldova is facing a tide of disinformation unprecedented in complexity and aggression, the head of a new center meant to combat it tells WIRED. And platforms like Facebook, TikTok, Telegram and YouTube could do more...
CVE-2020-36838
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxupdateoptions function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger accou...
CVE-2020-36838 Facebook Chat Plugin <= 1.5 - Missing Capabilities Check
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxupdateoptions function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger accou...
CVE-2020-36838
The CVE-2020-36838 entry concerns the Facebook Chat Plugin for WordPress (versions up to and including 1.5). The root cause is an authorization bypass caused by a missing capability check in the wp_ajax_update_options function, enabling low‑level authenticated attackers to connect their own Faceb...
CVE-2020-36838 Facebook Chat Plugin <= 1.5 - Missing Capabilities Check
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxupdateoptions function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger accou...
WordPress plugin Facebook Chat 访问控制错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control...
PT-2024-10848 · Facebook · Facebook Chat Plugin For Wordpress
Name of the Vulnerable Software and Affected Versions: Facebook Chat Plugin for WordPress versions up to and including 1.5 Description: The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp ajax update options function. This flaw...
A week in security (October 7 – October 13)
Last week on Malwarebytes Labs: Modern TVs have "unprecedented capabilities for surveillance and manipulation," group reveals Internet Archive suffers data breach and DDoS Google Search user interface: A/B testing shows security concerns remain AI girlfriend site breached, user fantasies stolen...
Exposing the Facebook funeral livestream scam (Lock and Code S05E21)
This week on the Lock and Code podcast … Online scammers were seen this August stooping to a new low—abusing local funerals to steal from bereaved family and friends. Cybercrime has never been a job of morals calling it a "job" is already lending it too much credit, but, for many years, scams...
Android users targeted on Facebook and porn sites, served adware
Android users, be on your guard against adware trying to infect your device. The adware—known as MobiDash—is spreading via several channels, according to ThreatDown research. One of the characteristics that makes MobiDash stand out is that it can be added to legitimate apps without changing how t...
Facebook and Instagram passwords were stored in plaintext, Meta fined
Ireland’s privacy watchdog Data Protection Commission DPC has fined Meta €91M $101M after the discovery in 2019 that Meta had stored 600 million Facebook and Instagram passwords in plaintext. The DPC ruled that Meta was in violation of GDPR on several occasions related to this breach. It determin...
Meta Fined €91 Million for Storing Millions of Facebook and Instagram Passwords in Plaintext
The Irish Data Protection Commission DPC has fined Meta €91 million $101.56 million as part of a probe into a security lapse in March 2019, when the company disclosed that it had mistakenly stored users' passwords in plaintext in its systems. The investigation, launched by the DPC the next month,...
AZL-49728 CVE-2024-45773 affecting package thrift for versions less than 0.15.0-5
A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00...