Cross-Site Scripting (XSS)

octoprint is vulnerable to cross-site scripting. The vulnerability exists in webcam stream test due to lack of sanitization which allows a malicious attacker to inject and execute arbitrary javascript...

OctoPrint 跨站脚本漏洞

OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...

CVE-2022-24890 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

Foscam R2C IP Conditional Competition Vulnerability

Foscam R2C IP, a webcam from Foscam China, is a conditional contention vulnerability that could be exploited by remote attackers to gain full remote access to the IP camera and the underlying Linux system with root privileges...

No-Joke Borat RAT Propagates Ransomware, DDoS

Attackers are using a newly released remote access trojan RAT to spread ransomware and distributed denial of service DDoS — in addition to the traditional RAT function of backdooring victims’ systems. Researchers at Cyble Research Labs discovered the RAT, which they dubbed Borat RAT because it us...

Nextcloud: Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

Summary: add summary of the vulnerability Steps To Reproduce: 1. Create a Call as User A Moderator 2. Add User B to the call 3. Start the call as User A 4. User B joins the call and enables the camera 5. User A removes all permissions for User B, cam and mic are now disabled 6. User A grants all...

Apple Pays $100.5K Bug Bounty for Mac Webcam Hack

A researcher who showed Apple how its webcams can be hijacked via a universal cross-site scripting bug UXSS Safari bug has been awarded what is reportedly a record $100,500 bug bounty. The bug could be used by an adversary as part of an attack to gain full access to every website ever visited by...

Apple Pays $100,500 Bounty to Hacker Who Found Way to Hack MacBook Webcam

Apple last year fixed a new set of macOS vulnerabilities that exposed Safari browser to attack, potentially allowing malicious actors to access users' online accounts, microphone, and webcam. Security researcher Ryan Pickren, who discovered and reported the bugs to the iPhone maker, was compensat...

Apple fixes Mac bug that could have allowed takeover of webcams and browser tabs

A researcher has picked up a $100,500 bounty from Apple after discovering a rather nasty method of gaining control of other people’s Macs. The issue, discovered lurking in Safari by Ryan Pickren, could make use of rogue websites to perform a number of dubious actions. It begins, as so many attack...

A week in security (January 10 – 16)

Last week on Malwarebytes Labs: Ransomware cyberattack forces New Mexico jail to lock down Some Android users can disable 2G now and why that is a good thing Phishers on the prowl with fake parking meter QR codes Update now: Microsoft patches 97 bugs including 6 zero-days and a wormable one...

What is RAT Remote Access Trojan ❓ Detection and Removal

Introduction Humans live in the 21st century where a large portion of our exchanges are taken care of on the web. Thus, people, businesses and organizations are presented with new online protection dangers. A significant number of these digital dangers will break into your framework and challenge...

2-year prison for pervert who hacked webcams to spy on underage girls

By Deeba Ahmed Robert Davies was also one of the customers of now seized login credentials selling site WeLeakInfo. A Byron… This is a post from HackRead.com Read the original post: 2-year prison for pervert who hacked webcams to spy on underage girls...

Software engineer hacked webcams to spy on girls—Here’s how to protect yourself

A 32 year-old software engineer has been sentenced to two years and two months in prison for remotely accessing chat logs, photos, videos, and webcams of his female victims. For nine years, between 2010 to 2019, Robert Davies used malware to infiltrate his targets devices and access their data...

Active WebCam 11.5 Unquoted Service Path

Exploit Title: Active WebCam 11.5 - Unquoted Service Path Exploit Author: Salman Asad @deathflash1411, [email protected] Date: 09.09.2021 Software Link: https://www.techspot.com/downloads/175-active-webcam.html Vendor Homepage: https://www.pysoft.com/ Version: 11.5 Tested on: Windows 10 Note: "Sta...

Active WebCam 11.5 - Unquoted Service Path Vulnerability

Exploit Title: Active WebCam 11.5 - Unquoted Service Path Exploit Author: Salman Asad @deathflash1411, email protected Software Link: https://www.techspot.com/downloads/175-active-webcam.html Vendor Homepage: https://www.pysoft.com/ Version: 11.5 Tested on: Windows 10 Note: "Start on Windows...

Active WebCam 11.5 - Unquoted Service Path

Exploit Title: Active WebCam 11.5 - Unquoted Service Path Exploit Author: Salman Asad @deathflash1411 a.k.a LeoBreaker Date: 09.09.2021 Software Link: https://www.techspot.com/downloads/175-active-webcam.html Vendor Homepage: https://www.pysoft.com/ Version: 11.5 Tested on: Windows 10 Note: "Star...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-66917)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plug-in. Video Posts Webcam Recorder WordPress versions...

CVE-2021-34656 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice function found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7...

CVE-2021-34656

The CVE-2021-34656 entry documents a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “2Way VideoCalls and Random Chat – HTML5 Webcam Videochat”. The issue is triggered via the vws_notice function in the file ~/inc/requirements.php and affects versions up to and includin...

CVE-2021-34656 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice function found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7...