Exploit for Double Free in Whatsapp

CVE-2019-11932 Modifiez l'adresse d'écoute celle de l'attaqu...

Deepfakes and LinkedIn: malign interference campaigns

Deepfakes haven't quite lost the power to surprise, but given their wholesale media saturation in the last year or so, there’s a sneaking suspicion in some quarters that they may have missed the bus. When people throw a fake Boris Johnson or Jeremy Corbyn online these days, the response seems to ...

ACCESS Act might improve data privacy through interoperability

Data privacy is back in Congressional lawmakers’ sights, as a new, legislative proposal focuses not on data collection, storage, and selling, but on the idea that Americans should be able to more easily pack up their user data and take it to a competing service—perhaps one that better respects...

Two Hackers Who Extorted Money From Uber and LinkedIn Plead Guilty

Two grey hat hackers have pleaded guilty to blackmailing Uber, LinkedIn, and other U.S. corporations for money in exchange for promises to delete data of millions of customers they had stolen in late 2016. In a San Jose courthouse in California on Wednesday, Brandon Charles Glover 26 of Florida a...

Two Hackers Who Extorted Money From Uber and LinkedIn Plead Guilty

Two grey hat hackers have pleaded guilty to blackmailing Uber, LinkedIn, and other U.S. corporations for money in exchange for promises to delete data of millions of customers they had stolen in late 2016. In a San Jose courthouse in California on Wednesday, Brandon Charles Glover 26 of Florida a...

NASA NODIS Cross Site Scripting

Cross-site Scripting XSS Vulnerability in NASA through User Agent - Binit Ghimire As of October 19, 2019, there exists a Reflected Cross-site Scripting XSS vulnerability in a sub-domain of the official NASA website as a result of the User Agent HTTP request header getting displayed in the webpage...

Beware of Fall Phishing Season

A recent blog post by LinkedIn says there are more available job postings listed in October than any other month. Since 89% of the hiring managers who spoke to LinkedIn said it takes less than four weeks to fill those roles, there is a limited window of opportunity - for both job seekers and...

WordPress bws-linkedin plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress bws-linkedin plugin. An attacker can exploit this...

CVE-2017-18516

The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues...

CVE-2017-18516

The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues...

Cross site scripting

The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues...

CVE-2017-18516

The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues...

CVE-2017-18516

CVE-2017-18516 affects the WordPress plugin bws-linkedin prior to version 1.0.5. The vulnerability is described as multiple XSS issues in the plugin, allowing authenticated attackers to execute arbitrary JavaScript in victims’ browsers, potentially stealing session cookies, credentials, or acting...

Linux/x86 - NOT +SHIFT-N+ XOR-N Encoded /bin/sh Shellcode (168 bytes)

/ description ; Title : X64 NOT +SHIFT-N+ XOR-N encoded /bin/sh - shellcode ; Author : Pedro Cabral ; Twitter : @CabrallPedro ; LinkedIn : https://www.linkedin.com/in/pedro-cabral1992 ; SLAE ID : SLAE64 - 1603 ; Purpose : spawn /bin/sh shell ; Tested On : Ubuntu 16.04.6 LTS ; Arch : x64 ; Size :...

HiddenEye - Modern Phishing Tool With Advanced Functionality (Android-Support-Available)

Modern Phishing Tool With Advanced Functionality PHISHING | KEYLOGGER | INFORMATIONCOLLECTOR | ALLINONETOOL | SOCIALENGINEERING DEVELOPERS & CONTRIBUTORS 1. ANONUD4Y https://github.com/An0nUD4Y 2. USAMA ABDUL SATTAR https://github.com/usama7628674 3. sTiKyt https://github.com/sTiKyt 4. UNDEADSEC...

Iran-Linked APT34 Invites Victims to LinkedIn for Fresh Malware Infections

A recent phishing campaign by Iran-linked threat actor APT34 made use of a savvy approach: Asking victims to join their social network. According to FireEye, the adversaries masqueraded as a Cambridge University lecturer, including setting up a LinkedIn page, in order to gain victims’ trust. From...

Hard Pass: Declining APT34’s Invite to Join Their Professional Network

Background With increasing geopolitical tensions in the Middle East, we expect Iran to significantly increase the volume and scope of its cyber espionage campaigns. Iran has a critical need for strategic intelligence and is likely to fill this gap by conducting espionage against decision makers a...

Project iKy v2.0.0 - Tool That Collects Information From An Email And Shows Results In A Nice Visual Interface

Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Project First of all we want to advice you that we have changed the Frontend from AngularJS to Angular 7. For this reason we left the project with...

A week in security (June 17 – 23)

Last week on the Malwarebytes Labs blog, we took a look at the growing pains of smart cities, took a deep dive into AI, jammed along to Radiohead, and looked at the lessons learned from Chernobyl in relation to critical infrastructure. We also explored a new Steam phish attack, and pulled apart a...

Crosslinked - LinkedIn Enumeration Tool To Extract Valid Employee Names From An Organization Through Search Engine Scraping

CrossLinked simplifies the processes of searching LinkedIn to collect valid employee names when performing password spraying or another security testing against an organization. Using similar search engine scraping capabilities found in tools like subscraper and pymeta, CrossLinked will find vali...