Backdoor.Win32.Zombam.b Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/1e3665a67201209609ae493a2a590beeC.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.b Vulnerability: Cross Site Scripting XSS Description: z0mbie's HTTP RAT v0.1...

TrickBot Malware Targeted Customers of 60 High-Profile Companies Since 2020

The notorious TrickBot malware is targeting customers of 60 financial and technology companies, including cryptocurrency firms, primarily located in the U.S., even as its operators have updated the botnet with new anti-analysis features. "TrickBot is a sophisticated and versatile malware with mor...

Twitter Has Started Blocking Porn in Germany

Dozens of accounts have been vanished as Twitter bows to pressure to make it harder for children to find adult content online...

Twitter cans 2FA service provider over surveillance claims

Twitter is transitioning away from from its two-factor authentication 2FA provider, Mitto AG, a Swiss communications company. The social media giant broke the news to US Senator Ron Wyden of Oregon. It is noted that Twitters decision to move away from Mitto AG came after allegations that its...

Twitter down – You are not alone Twitter is down for many

By Waqas Twitter is down in many countries across the globe - Hackread.com can confirm that Twitters app and website… This is a post from HackRead.com Read the original post: Twitter down - You are not alone Twitter is down for many...

com.github.3tty0n:gatling-thrift_2.12 (>=0.2.0 <=0.4.4), com.github.ikhoon:finatra-swagger_2.12 (=2.13.0) +54 more potentially affected by CVE-2020-35774 via com.twitter:twitter-server_2.12 (>=1.28.0 <=20.10.0)

com.twitter:twitter-server2.12 MAVEN version =1.28.0, =0.2.0, =2.9.0, =0.5.0, =0.5.0, =0.5.0, =0.17.0, =0.17.0, =0.17.0, =2.9.0, =20.10.0 - com.twitter:finatra-kafka-streams-prerestore2.12 =20.10.0 - com.twitter:finatra-kafka-streams-queryable-thrift-client2.12 =20.10.0 -...

GHSA-3MQV-8GXG-PFM4 TwitterServer Cross-site Scripting via /histograms endpoint

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer aka twitter-server before 20.12.0, in some configurations, allows XSS via the /histograms endpoint...

Microsoft: Slow MFA adoption presents “dangerous mismatch” in security

Multi-factor authentication MFA has been around for many years now, but few enterprises have fully embraced it. In fact, according to Microsofts inaugural "Cyber Signals" report, only 22 percent of all its Azure Active Directory AD enterprise clients have adopted two-factor authentication 2FA, a...

SocialPwned - An OSINT Tool That Allows To Get The Emails, From A Target, Published In Social Networks Such As Instagram, Linkedin And Twitter To Find Possible Credentials Leaks In PwnDB Or Dehashed And Obtain Google Account Information Via GHunt

SocialPwned is an OSINT tool that allows to get the emails, from a target, published in social networks like Instagram, Linkedin and Twitter to find the possible credential leaks in PwnDB or Dehashed and obtain Google account information via GHunt. The purpose of this tool is to facilitate the...

A week in security (January 31 – February 6)

Last week on Malwarebytes Labs: Threat actor steals email with Zimbra zero-day FBI warns of bogus job postings on recruitment sites Investment scams are on the rise A worrying Etsy listing reveals the stalking potential of Apple’s AirTags Beware bogus OperaGX sponsorship offers $320 milllion stol...

eotvos-gyal.edu.hu Cross Site Scripting vulnerability OBB-2357526

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

pwnKit About: Title: pwnKit Description: Privilege esc...

aup.edu.pk Cross Site Scripting vulnerability OBB-2357030

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| aup.edu.pk ---|--- Open Bug Bounty...

golovynska-gromada.gov.ua Cross Site Scripting vulnerability OBB-2355491

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Actor’s verified Twitter profile hijacked to spam NFT giveaways

When we refer to hijacked verified profiles on Twitter, it’s most commonly some sort of Elon Musk themed scam. The hijackers compromise the account, switch the picture to Elon, and then start spamming cryptocurrency links. Alternatively, they may keep the account as it is and spam images claiming...

WP Review Slider < 11.0 - Admin+ SQL Injection

The plugin does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks Create a Twitter Source, copy it via the 'Copy' button, then change the pid parameter in the URL to 1000 UNION ALL SELECT...

Dontgo403 - Tool To Bypass 40X Response Codes

dontgo403 is a tool to bypass 40X errors. Installation git clone https://github.com/devploit/dontgo403; cd dontgo403; go get; go build Customization If you want to edit or add new bypasses, you can add it directly to the specific file in payloads folder and the tool will use it. Options custom...

egyhaz.me.gov.hu Cross Site Scripting vulnerability OBB-2346016

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)

The plugin was vulnerable to Authenticated Stored Cross Site Scripting XSS within the Twitter username to mention text field. 1. Insert below payload in the Twitter username to mention text field "alert44 2. Click on Save Changes...

The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)

The plugin was vulnerable to Authenticated Stored Cross Site Scripting XSS within the Twitter username to mention text field. PoC 1. Insert below payload in the Twitter username to mention text field " 2. Click on Save Changes...