829 matches found
PT-2025-33514 · Unknown · Buttercup Buttercup-Browser-Extension
Name of the Vulnerable Software and Affected Versions: Buttercup buttercup-browser-extension versions up to 0.14.2 Description: A vulnerability exists in Buttercup buttercup-browser-extension up to version 0.14.2 due to improper access controls. The issue is remotely exploitable, but the complexi...
CVE-2017-20199 Buttercup buttercup-browser-extension Vault access control
A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity...
MAL-2025-32954 Malicious code in sentry-sdk-browser-extension (npm)
The package sentry-sdk-browser-extension was found to contain malicious code...
Malicious code in sentry-sdk-browser-extension (npm)
The package sentry-sdk-browser-extension was found to contain malicious code...
Malicious code in dappradar-browser-extension (npm)
The package dappradar-browser-extension was found to contain malicious code...
MAL-2025-17963 Malicious code in dappradar-browser-extension (npm)
The package dappradar-browser-extension was found to contain malicious code...
The vulnerability of the GitK browser extension “gitk filename”, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the gitk browser extension exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...
MAL-2025-4568 Malicious code in mergify-browser-extension (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8f2de81952e94086d23e94decb4b563c67c4a2022666fae6a869278e07c0b0 Any computer that has this package installed or running should be considered...
Malicious code in mergify-browser-extension (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8f2de81952e94086d23e94decb4b563c67c4a2022666fae6a869278e07c0b0 Any computer that has this package installed or running should be considered...
CVE-2025-24169
A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass browser extension authentication...
CVE-2024-0310
A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...
CVE-2024-33669
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...
CVE-2022-4610
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this...
CVE-2022-4613
A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated...
CVE-2022-4611
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed...
CVE-2019-17636
In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given...
"Explain, Don'T Just Warn!" -- a Real-Time Framework for Generating Phishing Warnings with Contextual Cues
Anti-phishing tools typically display generic warnings that offer users limited explanation on why a website is considered malicious, which can prevent end-users from developing the mental models needed to recognize phishing cues on their own. This becomes especially problematic when these tools...
MAL-2025-2682 Malicious code in kagi_browser_ext (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d43b7fd2a47594e2b75e6634bd546cec8f3fb5d8c20181ce0f6ed15e368a91bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Devolutions Server <= 2024.3.13 Multiple Vulnerabilities (DEVO-2025-0004)
The version of Devolutions Server installed on the remote host is prior or equal to 2024.3.13 and is, therefore, affected by multiple vulnerabilities: - Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak h...