<iframe src="//www.googletagmanager.com/ns.html?id=GTM-TT8R4P" height="0" width="0" style="display:none;visibility:hidden">
Stay updated on the latest news from
the makers of Nexus
Stored XSS That Allowed Hackers To Hijack Tumblr Blogs Still Unfixed
by Ali Loney on December 11, 2012

Tags: component vulnerabilities, AppSec Spotlight

Softpedia – (International) Stored XSS that allowed hackers to hijack Tumblr blogs still unfixed. The stored cross-site scripting (XSS) vulnerability that allowed hackers to hijack Tumblr blogs remains unfixed, according to a security researcher. He explains that this vulnerability could be utilized for numerous cybercriminal operations. The stored XSS could be used for phishing, malware attacks, and even to spam users. The researcher also reveals some interesting facts about this particular stored XSS security hole. For instance, victims of attacks that exploit this vulnerability do not have to be logged in to Tumblr. Also, the bug could be used to spread a malicious payload because when an entry is reblogged, the payload is also included in the new post. Furthermore, arbitrary JavaScript can be executed in the victim’s browser from a remote location.

Source: http://news.softpedia.com/news/Stored-XSS-That-Allowed-Hackers-to-Deface-Tumblr-Blogs-Still-Unfixed-313829.shtml

Posts by Topic

see all

Get Blog Updates