PT-2022-24556

Name of the Vulnerable Software and Affected Versions: Click Studios Passwordstate affected versions not specified Click Studios Passwordstate Browser Extension Chrome affected versions not specified Description: A problematic issue has been found in the API component, affecting the processing of...

CVE-2022-3875

Affected software: Click Studios Passwordstate and Passwordstate Browser Extension Chrome. CVE-2022-3875 describes an authentication bypass in the API caused by issues in the API code (unknown code path) that can be exploited remotely. The vulnerability is exploitable by an unauthenticated remote...

CVE-2022-4613 Click Studios Passwordstate Browser Extension Provisioning improper authorization

A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated...

Click Studios Passwordstate 安全漏洞

Click Studios Passwordstate passwordstate is a password management software from the Click Studios team in Australia. The program provides users with the ability to save their passwords, record their accounts and passwords, and keep them safe. This program provides you with the ability to save yo...

CVE-2022-4612 Click Studios Passwordstate insufficiently protected credentials

A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has be...

CVE-2022-4613 Click Studios Passwordstate Browser Extension Provisioning improper authorization

A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated...

CVE-2022-4610

Technical details for CVE-2022-4610 are not publicly available in the provided documents. Monitor for updates.

CVE-2022-3877

CVE-2022-3877 affects Click Studios Passwordstate and Passwordstate Browser Extension Chrome. The issue is a vulnerability in an unknown function of the URL Field Handler that enables cross-site scripting. It can be triggered remotely, and public disclosures exist describing the exploit. A fix is...

CVE-2022-4612

Technical details (affected product/version, root cause, and remediation) are not publicly provided in the supplied documents. Monitor for updates from official advisories and trusted sources.

Hiro: Security Issue into Wallet lock protection

Description While testing wallet extension i generally try to test multiple endpoints, so 2 tabs were open of wallet on chrome-extension://ldinpeekobnhjjdofggfgjlcehhmanlj/popup.html So i tried to lock Wallet extension buti found that i can still use browser in 2nd tab, why i had already locked...

This Malware Installs Malicious Browser Extensions to Steal Users' Passwords and Cryptos

A malicious extension for Chromium-based web browsers has been observed to be distributed via a long-standing Windows information stealer called ViperSoftX. Czech-based cybersecurity company dubbed the rogue browser add-on VenomSoftX owing to its standalone features that enable it to access websi...

Experts Warn of Browser Extensions Spying On Users via Cloud9 Chrome Botnet Network

The Keksec threat actor has been linked to a previously undocumented malware strain, which has been observed in the wild masquerading as an extension for Chromium-based web browsers to enslave compromised machines into a botnet. Called Cloud9 by security firm Zimperium, the malicious browser add-...

Microsoft Warns of Large-Scale Click Fraud Campaign Targeting Gamers

Microsoft said it's tracking an ongoing large-scale click fraud campaign targeting gamers by means of stealthily deployed browser extensions on compromised systems. "The attackers monetize clicks generated by a browser node-webkit or malicious browser extension secretly installed on devices,"...

Experts Uncover 350 Browser Extension Variants Used in ABCsoup Adware Campaign

A malicious browser extension with 350 variants is masquerading as a Google Translate add-on as part of an adware campaign targeting Russian users of Google Chrome, Opera, and Mozilla Firefox browsers. Mobile security firm Zimperium dubbed the malware family ABCsoup, stating the "extensions are...

MAL-2022-6303 Malicious code in steamdb-browser-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53b9c4544d470043b533487c9efda47a2623cc8795d5212cbf561b76f77ca33e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in steamdb-browser-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53b9c4544d470043b533487c9efda47a2623cc8795d5212cbf561b76f77ca33e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BITB - Browser In The Browser (BITB) Templates

Browser templates for Browser In The Browser BITB attack. More information: https://mrd0x.com/browser-in-the-browser-phishing-attack/ Usage Each folder has a index.html file which has 4 variables that must be modified: XX-TITLE-XX - The title that shows up for the page e.g. Sign in to your accoun...

CVE-2022-28795

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then...

enhanced-github跨站脚本漏洞

enhanced-github is a browser extension that adds useful functionality to the GitHub website by Varun Malhotra, an individual developer in India. A security vulnerability exists in enhanced-github version 5.0.11, which stems from a cross-site scripting XSS vulnerability in the file name parameter ...

CVE-2022-24074

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises...