Malicious code in tiktok_embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7efd23c732b9d63531a53f0dc12b58d8c1cc7fbaec7d4c0ada1bef6fb113c4b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TikTok: TikTok's pixel/sdk.js leaks current URL from websites using postMessage

A vulnerability was found where an oauth token could have been leaked due to an origin check bypass in the TikTok Pixel SDK. We thank @fransrosen for reporting this to our team...

Disinfo and Hate Speech Flood TikTok Ahead of Kenya’s Elections

Mozilla researchers identified accounts with millions of view spreading hate speech and disinformation...

CVE-2022-28799

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...

CVE-2022-28799

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...

CVE-2022-28799

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...

Code injection

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...

Bytedance TikTok 安全漏洞

Bytedance TikTok Jieyin International Version is an application for creating and sharing short videos by Chinese company Bytedance. A security vulnerability exists in TikTok versions prior to 23.8.4, which stems from a crafted URL unauthenticated deep link that can force com.zhiliaoapp.musically...

TikTok: IDOR in family pairing API

Vulnerability description not provided...

CVE-2022-28799

CVE-2022-28799 affects the TikTok Android app prior to version 23.7.3. A crafted unvalidated deeplink could cause the app’s WebView (com.zhiliaoapp.musically) to load an arbitrary website, enabling an attached JavaScript interface to be exploited and potentially take over a user account. The root...

CVE-2022-28799

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...

PT-2022-19245 · Bytedance +1 · Tiktok +1

Name of the Vulnerable Software and Affected Versions: TikTok application before 23.7.3 for Android Description: The issue allows account takeover through a crafted URL that can force the com.zhiliaoapp.musically WebView to load an arbitrary website, potentially leveraging an attached JavaScript...

TikTok: Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.com

A blind stored Cross-Site Scripting XSS vulnerability was found on a TikTok Ads domain via uploaded file. We thank @mrzheev for reporting this to our team...

TikTok: Internal Employee informations Disclosure via TikTok Athena api

A vulnerability was found where internal employee email address could be disclosed on a TikTok Ads endpoint API by adding an "employeeemail" value to the "metrics" field/array in the request body. We thank @heinthant for reporting this to our team...

TikTok: Create product discounts of any shop

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok seller endpoint, which could have resulted in any user to create product discounts for shops they did not own. We thank @datph4m for reporting this to our team...

TikTok: TikTok Account Creation Date Information Disclosure

A vulnerability was found where the date of a user's account creation would be able to be obtained without logging into that account. We thank @f15 for reporting this to our team...

TikTok: disclosure the live_analytics information of any livestream.

A possible disclosure of the liveanalytics information for any livestream was found by accessing the roomid parameter via devtools. We thank @datph4m for reporting this to our team...

TikTok: Email address disclosure via invite token validatiion

The possibility of email address disclosure was found on a Business.TikTok.com endpoint as no rate limit was implemented on the invite token. We thank @noobbutcut3 for reporting this to our team...

TikTok: IDOR in report download functionality on ads.tiktok.com

An IDOR Insecure Direct Object Reference vulnerability was found on a TikTok Ads endpoint within the report download functionality. We thank @fm for reporting this to our team...

TikTok: IDOR on Tagged People

An Insecure Direct Object Reference IDOR vulnerability was found on the TikTok app where a user was able to tag any other user on videos that don't belong to them. We thank @apapedulimu for reporting this to our team. Write-Up:...