3164 matches found
X (Formerly Twitter): iOS app crashed by specially crafted direct message reactions
Summary: iOS app crashed by specially crafted direct message reactions Description: Twitter does not properly sanitize direct message reactions, making it possible for arbitrary reaction text to be shown to the user via the message preview in the direct message list. Special characters such as \r...
X (Formerly Twitter): Accepting error message on twitter sends you to attacker site
Summary: Accepting error message on twitter sends you back to attacker site. Description: 1. The link https://twitter.com/i/flow shows up an error message with an OK button 2. When you are not logged in, clicking in that OK button takes you back to twitter.com 3. But if you open that link when yo...
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the...
CVE-2011-3614
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9...
Improper access control
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9...
CVE-2011-3614
CVE-2011-3614 affects Vanilla Forums (Facebook, Twitter, and Embedded plugins) prior to version 2.0.17.9. The issue is an Access Control vulnerability that could impact confidentiality, integrity, and availability. Remediation: upgrade to Vanilla Forums 2.0.17.9 or newer; apply any vendor-supplie...
CVE-2011-3614
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9...
JhoneRAT: Cloud based python RAT targeting Middle Eastern countries
By Warren Mercer, Paul Rascagneres and Vitor Ventura with contributions from Eric Kuhla. Updated January 17th: the documents do not exploit the CVE-2017-0199 vulnerability. Executive Summary Today, Cisco Talos is unveiling the details of a new RAT we have identified we're calling "JhoneRAT." This...
New JhoneRAT Malware Targets Middle East
Researchers are warning of a new remote access trojan RAT, dubbed JhoneRAT, which is being distributed as part of an active campaign, ongoing since November 2019, that targets victims in the Middle East. Once downloaded, the RAT gathers information on the victims’ computers and is also able to...
X (Formerly Twitter): Bypass Password Authentication for updating email and phone number - Security Vulnerability
Summary: Additional requirement for authentication is an extra layer of security for a person's Twitter account. Instead of only entering the password at the time of log in, twitter further Introduces additional layer of security by prompting users to enter their password before attempting to...
Did Donald Trump and Iran Use Twitter to Prevent a War?
Tweets from US president Donald Trump and Iranian foreign minister Javad Zarif Tuesday offered a fascinating glimpse at how world leaders can communicate more quickly and directly than ever in times of crisis...
Facebook Cracks Down on Deepfake Videos
Facebook is banning deepfake videos, which stem from a technique of human-image synthesis based on artificial intelligence AI to create fake content. Over the past year, security experts and lawmakers have voiced concerns about malicious deepfake applications, particularly as a vessel for...
X (Formerly Twitter): lack of input validation that can lead Denial of Service (DOS)
Hi Security Team, Summary: There is no limit to the number of characters in the issue comments, which allows a DoS attack. The DoS attack affects server-side. Description On the input form of Username in https://twitter.com/settings/screenname there's no Input validation using this you can send...
X (Formerly Twitter): User input validation can lead to DOS
Hi Security Team, Summary: There is no limit to the number of characters on phone numbers and using this you can perform a DOS Attack Description: On the input form of phone number in https://twitter.com/account/complete there's no Input validation using this you can send more payload and may cau...
ghafla.com Cross Site Scripting vulnerability OBB-1053239
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Twitter Fixes Bug that Enabled Takeover of Android App Accounts
Twitter for Android users are being urged to update their app to avoid a security bug that allows a malicious user to access private account data and could also allow an attacker to take control of accounts to send tweets and direct messages. The warning comes from Twitter who said there are no...
Epilepsy Foundation Bombarded with Seizure-Triggering Twitter Posts
The Epilepsy Foundation on Monday filed a criminal complaint against a number of undisclosed Twitter users after they bombarded its Twitter feed in November with a barrage of posts of flashing or strobing lights — exposing its thousands of followers to potential seizure-triggering images. The...
RTTM - Real Time Threat Monitoring Tool
Monitoring possible threats of your company on Internet is an impossible task to be achieved manually. Hence many threats of the company goes unnoticed until it becomes viral in public. Thus causing monetary/reputation damage. This is where RTTM comes into action. RTTM Real Time Threat Monitoring...
SDKs Misused to Scrape Twitter, Facebook Account Info
Twitter and Facebook are warning of software development kits SDKs that could be embedded within a mobile application and used to harvest personal user information. The SDKs, which the tech giants said are maintained by oneAudience and MobiBurn, could be used by mobile app developers to craft...
Facebook & Twitter suffer data breach via third-party developers
By Sudais Another day another breach involving Facebook, Twitter, and third-party developers. This is a post from HackRead.com Read the original post: Facebook & Twitter suffer data breach via third-party developers...