Malicious code in nayan-imgur-upload-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83086119743263f9bdf6c297c723c4435596eb345ae1346780b6cb9c49e0e597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3843 Malicious code in nayan-imgur-upload-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83086119743263f9bdf6c297c723c4435596eb345ae1346780b6cb9c49e0e597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

U.K. ICO Investigates TikTok, Reddit, and Imgur Over Children's Data Protection Practices

The U.K.'s Information Commissioner's Office ICO has opened an investigation into online platforms TikTok, Reddit, and Imgur to assess the steps they are taking to protect children between the ages of 13 and 17 in the country. To that end, the watchdog said it's probing how the ByteDance-owned...

MAL-2024-11829 Malicious code in imgur-uploader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e12db7b7de507126d4fa046e84a7acb1e502c87e639c69d90159cd396bed2b84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imgur-uploader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e12db7b7de507126d4fa046e84a7acb1e502c87e639c69d90159cd396bed2b84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nayan-imgur-upload-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b98ebdb98b3110329cb9db3c496ef6fa0d0f21bcf8ec8302746d6f47b0cf884 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11808 Malicious code in nayan-imgur-upload-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b98ebdb98b3110329cb9db3c496ef6fa0d0f21bcf8ec8302746d6f47b0cf884 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imgur-upload-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fc21112f21105a413aa69a8b3e3f21c53895809a2f5fd20cdbf6dd16baadfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11144 Malicious code in imgur-upload-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fc21112f21105a413aa69a8b3e3f21c53895809a2f5fd20cdbf6dd16baadfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-24837

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes an...

Imgur: 8ybhy85kld9zp9xf84x6.imgur.com Subdomain Takeover

Hello Gents, + While testing Imgur I found an unclaimed subdomain which is; “8ybhy85kld9zp9xf84x6.imgur.com”, and I was able to claim it! + But actually I didn't upload or host a simple file like mrbaka.html, because I need to upgrade the account to be able to use this custom domain! + Anyway, yo...

Imgur: No length on password

Hey, when I try to set the password while creating an account I noticed that you haven't kept any password limit. You need to decrease password length: There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behal...

Xmind 2020 - XSS to Remote Command Execution Vulnerability

Exploit Title: Xmind 2020 - XSS to RCE Exploit Author: TaurusOmar CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Risk: High 8.8 Vendor Homepage: https://www.xmind.net/ Version: 2020 Tested on: Windows, Linux, MacOs Software Description: XMind, a full-featured mind mapping and brainstorming tool,...

Froala 3.2.6-1 Cross Site Scripting Vulnerability

Exploit Title: Stored XSS and Html Code Injection Editor Froala Version 3.2.6-1 Author: Vincent666 ibn Winnie Software Link: https://froala.com/wysiwyg-editor/ Tested on: Windows 10 Web Browser: Mozilla Firefox My Youtube Channel: https://www.youtube.com/channel/UCZOWpC2dW9sipPq5z63C2rQ PoC: In t...

Imgur: xss reflected on imgur.com

Steps to reproduce : - i log in to my account and navigate to see other profile - i intercept the request then click Give Emerald F1115658 Request look like : POST /account/v1/gifting/purchase?clientid=546c25a59c58ad7 HTTP/1.1 Host: api.imgur.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:83.0...

Imgur: Bypass subscription

Hello team! You can bypass avatar subscriptions. Thus, without connecting a subscription - it's free. A list of all avatars is available at the address below, with a GET request: :method: GET :authority: api.imgur.com :scheme: https :path: /account/v1/accounts/me/avatars?clientid=YOU CLIENT ID...

Malicious Package in pizza-pasta

Version 1.0.3 of pizza-pasta contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from imgur.com. The package also printed the users SSH keys to the console. Recommendation Remove the package from your environment. There are no...

Imgur: Stored XSS in Post title (PoC)

Hello, Stored XSS in Post title, example: https://imgur.com/gallery/Y5JUzv3, Thanks Impact steal cookies and session...

Imgur: self-xss with ClickJacking can leads to account takeover in Firefox

Description Hi, i think i found a valid chaining issues here ClickJacking issue I discovered that have some endpoints that permits to frame imgur.com with some limitations, but even in this case, it is possible to carry out a proof of concept. One of the cases is in the /all/ directory of...

Imgur: Sourcemaps and Unminified Source Code Exposed on Pages

Hello, I'm not sure if this was actually meant to be made public on purpose, but I was looking through some of the sources that were loaded and found out the following: https://imgur.com/ - See ██████ s.imgur.com - desktop-assets - js contains multiple minified JS files as one would usually expec...