Wordpress plugin Social Stream API secret key information leakage vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. Wordpress plugin Social-Stream uses the Twitter API key as a parameter of the URL link There is an information leakage that can be...

On EternalRocks, WannaCry, and More

Mike Mimoso and Chris Brook recap the news of the week, including the EternalRocks worm, the latest on WannaCry, a subtitle hack, and a Twitter flaw. Download: ThreatpostNewsWrapMay262017.mp3 Music by Chris Gonsalves...

Keybase Extension Brings End-to-End Encrypted Chat To Twitter, Reddit, GitHub

A recently released Chrome extension, developed by the public key crypto database Keybase, brought end-to-end encrypted messaging to several apps this week. Keybase, a service that allows users to identify themselves with a public encryption key, introduced its end-to-end encrypted chat feature...

Twitter Flaw Could Have Allowed Attacker to Tweet From Any Account

Before it was fixed earlier this year, a flaw in Twitter could have allowed an attacker to tweet as any user. Twitter was quick to resolve the issue, fixing it three days after the researcher–a bug hunter who goes by the handle Kedrisch–reported it via HackerOne. Kedrisch found the vulnerability ...

CVE-2017-0262

Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka “Office Remote Code Execution Vulnerability”. This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281. Recent assessments:...

OAuth Worm II - The revenge

We all know about this massive Google Doc Phishing Attack that hit about 1 million accounts right? --- Image from https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/ Well this really "sophisticated attack" really?? was based on a really spread...

Wordpress Art Picture Shop Plugins File Upload Vulnerability

Exploit for php platform in category web applications Wordpress Plugins Art Picture Shop File Upload Vulnerability | CSRF Author : Berandal Google Dork: inurl:/wp-content/plugins/art-picture-shop/admin/ Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ +-+-+-+-+-+-+-+-+ |B|e|r|a|n|d|a|l|...

See how I dug into the Twitter XSS vulnerabilities and bypass the CSP-vulnerability warning-the black bar safety net

A few months ago, I dug up a TwitterXSSvulnerability, while bypassing a site's content security policy CSP successfully executed the JavaScript code. In the present article will be mainly to share theXSSloophole mining ideas and specific details while in the article that comes with the PoC demo...

You are not alone; WhatsApp is down for many (Updated)

By Carolina If you are wondering whats going on with the popular messenger app WhatsApp then you are not alone because its service is down in many countries. Although it is unclear whats going on and why the service is down theres a massive number of users complaining on Twitter. WhatsApp users i...

Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability in Twitter Cards Meta

We recently found that the Twitter Cards Meta contains a cross-site request forgery CSRF/cross-site scripting XSS vulnerability on the plugin’s setting pages,/wp-admin/admin.php?page=twitter-cards-meta. The CSRF potion of the vulnerability was due to a lack of a nonce on the page and a lack of a...

Twitter - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Twitter published at the 'play' market has multiple vulnerabilities...

X (Formerly Twitter): HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameter

Overview The imagesrc parameter on amp.twimg.com accepts images from any arbitrary host, therefore, enabling attackers to supply image destinations that respond with a "HTTP 401 Unauthorized" response. Description HTTP 401 attacks occur when there is no whitelisting or proxying images and/or page...

Rimons Twitter Widget < 1.3 - XSS

The Rimons Twitter Widget WordPress plugin was affected by a XSS security vulnerability...

Shadow Brokers Group Releases More Stolen NSA Hacking Tools & Exploits

Remember The Shadow Brokers? They are back. A hackers group that previously claimed to have stolen a bunch of hacking tools malware, zero-day exploits, and implants created by the NSA and gained popularity last year for leaking a portion of those tools is back. Today, The Shadow Brokers group...

X (Formerly Twitter): [██████████.gnip.com] .htpasswd disclosure

Greetings, There is a .htpasswd disclosure on your subdomain : - Go to : http://█████████.gnip.com/.htpasswd - previewgnip:██████ F173925 Fix : Protect the htpasswd file...

Twitter Cards Meta <= 2.4.5 - CSRF and XSS

The Twitter Cards Meta – Best Twitter Card Plugin for WordPress WordPress plugin was affected by a CSRF and XSS security vulnerability...

New RAT Targets Koreans And Is Skilled At Evading Detection

Researchers have identified a stealthy new remote access tool dubbed ROKRAT that leverages a bevy of anti-detection measures. The RAT targets the Korean language Microsoft Word alternative Hangul Word Processor HWP. ROKRAT was detected several weeks ago by Cisco Talos, who said the malware is par...

Follow Tool for Twitter - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Follow Tool for Twitter published at the 'play' market has multiple vulnerabilities...

The Struts S2-045 vulnerability heat analysis-vulnerability warning-the black bar safety net

Author: janesknow Chong Yu 404 laboratory Date: 2017-03-15 Background description Struts2 official to GMT 2017 3 December 6, 10pm published Struts2 there is a remote code execution vulnerability vulnerability number S2-045, CVE number: CVE-2017-5638, and rated as high-risk vulnerabilities. Becaus...

Microsoft Windows LoadUvsTable() Buffer Overflow

Date: 15-03-2017 Author: Hossein Lotfi https://twitter.com/hosselot CVE: CVE-2016-7274 1. Description An integer overflow error within the "LoadUvsTable" function of usp10.dll can be exploited to cause a heap-based buffer overflow. Full analysis is available at:...