3164 matches found
Motorola G4 & G5 mobile phone was traced to the presence of high-risk kernel command line injection vulnerability-vulnerability warning-the black bar safety net
In a previous article about the Nexus6 root vulnerability in the article, we had mentioned Vulnerability CVE-2016-10277 will likely affect the Motorola device. When we on Twitter by some of the relevant reports after the fact to prove our previous conjecture. In order to prove that Motorola devic...
WordPress WP to Twitter plugin <= 3.2.9 - Cross-Site Request Forgery Vulnerability
Cross-Site Request Forgery Vulnerability was found in WordPress WP to Twitter plugin in 3.2.9 version. If the nonce input field is empty, the nonce check is not run. This happens In the file /wp-to-twitter-manager.php. Solution Update the plugin...
Hackers Are Using An Effective Way to Spread Fake News From Verified Accounts
Social media networks are no doubt a quick and powerful way to share information and ideas, but not everything shared on Facebook or Twitter is true. Misinformation, or "Fake News," has emerged as a primary issue for social media platforms, seeking to influence millions of people with wrong...
See how I found Twitter any accounts to send tweets vulnerabilities and get 7560 $ Bounty-vulnerability warning-the black bar safety net
! Participation in the Twitter vulnerability Bounty project in the process, I passed some Safety tests found that a Twitter presence of significant vulnerabilities: an attacker does not need access to others account permissions, you can order any accounts to publish tweets. I'm in 2017 2 May 26,...
Zendesk: Twitter SSO allows unverified e-mail registration, leads to Slack and social media hijacks
See title. SEE BLOGPOST: "How I hacked hundreds of companies through their helpdesk" https://medium.com/@intideceukelaire/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c...
How I took control of your Twitter account (tweeting, viewing/deleting photos and other media)
Summary: This blog post is about an Insecure direct object reference vulnerability on Twitter which could have been used by attackers to tweet from other accounts, upload videos on behalf of user, delete pics/videos from victim's tweets, view private media uploaded by other twitter accounts etc...
WordPress Social-Stream 1.6.0 Twitter API Secret Disclosure
Wordpress Plugin Social-Stream - Exposure of Twitter API Secret Keys CWE-522 :Insufficiently Protected Credentials Products: Wordpress Social Stream Versions 1.6.0 and lower https://codecanyon.net/item/wordpress-social-stream/2201708 Social Network Tabs Versions 1.7.4 and lower...
Wordpress plugin Social Stream API secret key information leakage vulnerability
WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. Wordpress plugin Social-Stream uses the Twitter API key as a parameter of the URL link There is an information leakage that can be...
On EternalRocks, WannaCry, and More
Mike Mimoso and Chris Brook recap the news of the week, including the EternalRocks worm, the latest on WannaCry, a subtitle hack, and a Twitter flaw. Download: ThreatpostNewsWrapMay262017.mp3 Music by Chris Gonsalves...
Keybase Extension Brings End-to-End Encrypted Chat To Twitter, Reddit, GitHub
A recently released Chrome extension, developed by the public key crypto database Keybase, brought end-to-end encrypted messaging to several apps this week. Keybase, a service that allows users to identify themselves with a public encryption key, introduced its end-to-end encrypted chat feature...
Twitter Flaw Could Have Allowed Attacker to Tweet From Any Account
Before it was fixed earlier this year, a flaw in Twitter could have allowed an attacker to tweet as any user. Twitter was quick to resolve the issue, fixing it three days after the researcher–a bug hunter who goes by the handle Kedrisch–reported it via HackerOne. Kedrisch found the vulnerability ...
CVE-2017-0262
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka “Office Remote Code Execution Vulnerability”. This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281. Recent assessments:...
OAuth Worm II - The revenge
We all know about this massive Google Doc Phishing Attack that hit about 1 million accounts right? --- Image from https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/ Well this really "sophisticated attack" really?? was based on a really spread...
Wordpress Art Picture Shop Plugins File Upload Vulnerability
Exploit for php platform in category web applications Wordpress Plugins Art Picture Shop File Upload Vulnerability | CSRF Author : Berandal Google Dork: inurl:/wp-content/plugins/art-picture-shop/admin/ Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ +-+-+-+-+-+-+-+-+ |B|e|r|a|n|d|a|l|...
See how I dug into the Twitter XSS vulnerabilities and bypass the CSP-vulnerability warning-the black bar safety net
A few months ago, I dug up a TwitterXSSvulnerability, while bypassing a site's content security policy CSP successfully executed the JavaScript code. In the present article will be mainly to share theXSSloophole mining ideas and specific details while in the article that comes with the PoC demo...
You are not alone; WhatsApp is down for many (Updated)
By Carolina If you are wondering whats going on with the popular messenger app WhatsApp then you are not alone because its service is down in many countries. Although it is unclear whats going on and why the service is down theres a massive number of users complaining on Twitter. WhatsApp users i...
Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability in Twitter Cards Meta
We recently found that the Twitter Cards Meta contains a cross-site request forgery CSRF/cross-site scripting XSS vulnerability on the plugin’s setting pages,/wp-admin/admin.php?page=twitter-cards-meta. The CSRF potion of the vulnerability was due to a lack of a nonce on the page and a lack of a...
Twitter - Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Twitter published at the 'play' market has multiple vulnerabilities...
X (Formerly Twitter): HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameter
Overview The imagesrc parameter on amp.twimg.com accepts images from any arbitrary host, therefore, enabling attackers to supply image destinations that respond with a "HTTP 401 Unauthorized" response. Description HTTP 401 attacks occur when there is no whitelisting or proxying images and/or page...
