KingComposer, a WordPress plugin found installed with over 100,000 WordPress sites found vulnerable to Reflected Cross-Site Scripting . The vulnerability was found by the Wordfence security team with KingComposer Drag and Drop page building plugin. The vulnerability can be exploited by the attacker tricking the victim into clicking a malicious link, which sends the victim to the vulnerable website along with the payload. It can be tracked as CVE-2020-15299 and received CVSS Score: 6.1. the version before 2.9.5 is affected by the vulnerability. The vulnerability resides with AJAX action that no longer actively used by the plugin, “but could still be used by sending a POST request to wp-admin/admin-ajax.php with the action parameter set to kc_install_online_preset .” The vulnerability can be exploited using base64-encoding on a malicious payload and trick the victim into sending a request through a kc-online-preset-data parameter, which would allow the malicious payload to execut
Cybersecurity researchers took the wraps off yet another instance of Android malware hidden under the guise of legitimate applications to stealthily subscribe unsuspecting users for premium services without their knowledge. In a report published by Check Point research today, the malware — infamously called Joker (or Bread) — has found another trick to bypass Google's Play Store protections: obfuscate the malicious DEX executable inside the application as Base64 encoded strings, which are then decoded and loaded on the compromised device. Following responsible disclosure by Check Point researchers, the 11 apps ( list and hashes here ) in question were removed by Google from the Play Store on April 30, 2020. "The Joker malware is tricky to detect, despite Google's investment in adding Play Store protections," said Check Point 's Aviran Hazum, who identified the new modus operandi of Joker malware. "Although Google removed the malicious apps from the Play Stor