779 matches found
CVE-2024-30252
Livemarks up to version 3.7 is affected by a CSRF vulnerability where a malicious site can coerce the extension to perform an authenticated GET to an arbitrary URL via subscribe.js; this is possible because subscribe.html is a web_accessible_resource. The issue can compromise data integrity on pr...
SASE Solutions Fall Short Without Enterprise Browser Extensions, New Report Reveals
As SaaS applications dominate the business landscape, organizations need optimized network speed and robust security measures. Many of them have been turning to SASE, a product category that offers cloud-based network protection while enhancing network infrastructure performance. However, a new...
@-0/browser (>=0.3.1 <=0.3.61), @cfxjs/extension-runtime (>=0.0.1 <=0.0.4) +41 more potentially affected by CVE-2024-29650 via @thi.ng/paths (>=1.6.6 <=4.2.14)
@thi.ng/paths NPM version =1.6.6, =0.3.1, =0.0.1, =0.0.2, =0.0.1, =0.2.0, =0.2.0, =0.0.4, =0.0.3, =0.0.13, =0.0.1, =1.0.5, =0.0.1, =0.3.0, =0.3.2 and more Source cves: CVE-2024-29650 Source advisory: OSV:GHSA-8PPR-WWW8-HFJX...
DEBIAN-CVE-2024-0810
Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Medium...
CVE-2024-0310
A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...
Code injection
A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...
CVE-2024-0310
CVE-2024-0310 affects the ENS Control browser extension (prior to 10.7.0 Update 15). The issue allows a remote attacker to alter the response header parameter to switch the content-security-policy (CSP) into report-only mode, bypassing CSP protections. Affected component: ENS Control extension; v...
Design/Logic Flaw
Under certain conditions the Microsoft Edge browser extension SAP GUI connector for Microsoft Edge - version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confidentiality...
Ducktail fashion week
Ducktail is a malware family that has been active since the second half of 2021 and aims to steal Facebook business accounts. WithSecure and GridinSoft have covered Ducktail attacks: the infostealer spread under the guise of documents relating to well-known companies and brands projects and...
Password-stealing Chrome extension smuggled on to Web Store
Researchers at the University of Wisconsin-Madison have demonstrated that Chrome browser extensions can steal passwords from the text input fields in websites, even if the extension is compliant with Chrome's latest security and privacy standard, Manifest V3. To prove it, they created a proof of...
Evil QR - Proof-of-concept To Demonstrate Dynamic QR Swap Phishing Attacks In Practice
Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR codes to...
Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Exploit
Exploit Title: Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Google Dork: NA Date: 22-07-2023 Exploit Author: H4rk3nz0 Vendor Homepage: https://www.keepersecurity.com/enGB/ Software Link: https://www.keepersecurity.com/enGB/get-keeper.html Version: Desktop App...
Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping
Exploit Title: Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Google Dork: NA Date: 22-07-2023 Exploit Author: H4rk3nz0 Vendor Homepage: https://www.keepersecurity.com/enGB/ Software Link: https://www.keepersecurity.com/enGB/get-keeper.html Version: Desktop App...
CVE-2023-33866
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution...
Design/Logic Flaw
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution...
Malwarebytes Browser Guard introduces three new features
Malwarebytes Browser Guard is our free browser extension for Chrome, Edge, Firefox, and Safari that blocks unwanted and unsafe content, giving users a safer and faster browsing experience. It's the worlds first browser extension to do this while also identifying and stopping tech support scams. A...
SOC-Multitool - A Powerful And User-Friendly Browser Extension That Streamlines Investigations For Security Professionals
Introducing SOC Multi-tool, a free and open-source browser extension that makes investigations faster and more efficient. Now available on the Chrome Web Store and compatible with all Chromium-based browsers such as Microsoft Edge, Chrome, Brave, and Opera. Now available on Chrome Web Store!...
New Malware Campaign Leveraging Satacom Downloader to Steal Cryptocurrency
A recent malware campaign has been found to leverage Satacom downloader as a conduit to deploy stealthy malware capable of siphoning cryptocurrency using a rogue extension for Chromium-based browsers. "The main purpose of the malware that is dropped by the Satacom downloader is to steal BTC from...
Inadequate Encryption Strength
Overview trustwallet/wallet-core is a mobile-focused library implementing low-level cryptographic wallet functionality for a high number of blockchains Affected versions of this package are vulnerable to Inadequate Encryption Strength in its mt19937 seed generation, which has only 32 bits of...
CVE-2023-31290
Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...