CVE-2019-9147: Improper Restriction of Rendered UI Layers or Frames

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled webaccessibleresources. Mailvelope implements additional measures to preve...

ExtAnalysis - Browser Extension Analysis Framework

With ExtAnalysis you can : Download & Analyze Extensions From: Chrome Web Store Firefox Addons Analyze Installed Extensions of: Google Chrome Mozilla Firefox Opera Browser Coming Soon Upload and Scan Extensions. Supported formats: .crx .xpi .zip Features of ExtAnalysis : View Basic Informations:...

CVE-2019-3610 True Key Browser Extension 3.1.9219.0 update fixes Sensitive Data Exposure vulnerability

Data Leakage Attacks vulnerability in Microsoft Windows client in McAfee True Key TK 3.1.9211.0 and earlier allows local users to expose confidential data via specially crafted malware...

Grammarly Launches Public Bug Bounty Program

Online AI-based communications tool Grammarly is taking its private bug bounty program public in hopes of finding and fixing more vulnerabilities in its software. The company has run a private bug bounty program – which currently has 1,500 participants – in conjunction with HackerOne for over a...

CVE-2018-18865

The Royal browser extensions TS before 4.3.60728 Release Date 2018-07-28 and TSX before 3.3.1 Release Date 2018-09-13 allow Credentials Disclosure...

Kaspersky: Kaspersky Password Manager is vulnerable to HTML injection in the browser action pop-up via user name

Note: According to https://www.securityweek.com/kaspersky-adds-password-manager-bug-bounty-program and some other sources, Kaspersky Password Manager is in scope for this program. The program description doesn't reflect this however. Summary There is a stored XSS vulnerability in popover.html the...

Royal TSX Information Disclosure Vulnerability

Exploit for jsp platform in category web applications Title: Royal TS/X - Information Disclosure Author: Jakub Palaczynski CVE: CVE-2018-18865 Affected product: ============= Royal TS/X RoyalTS/X Exploit var wsUri = "ws://127.0.0.1:54890/"; var output; function init output =...

Royal TS/X - Information Disclosure

RoyalTS/X Exploit var wsUri = "ws://127.0.0.1:54890/"; var output; function init output = document.getElementById"output"; testWebSocket; function testWebSocket writeToScreen"Let's retrieve some data..."; websocket = new WebSocketwsUri; websocket.onopen = functionevt...

Royal TS/X Information Disclosure

Title: Royal TS/X - Information Disclosure Author: Jakub Palaczynski Date: 10. July 2018 CVE: CVE-2018-18865 Affected product: ============= Royal TS/X RoyalTS/X Exploit var wsUri = "ws://127.0.0.1:54890/"; var output; function init output = document.getElementById"output"; testWebSocket; functio...

Introducing: Malwarebytes Browser Extension

Are you tired of all the unwanted content the world wide web offers up, whether you like it or not? It is our privilege to introduce you to the Malwarebytes Browser Extension BETA. Or, better said, the Malwarebytes Browser Extensions, because we have one for Firefox and one for Chrome. Introducti...

Pinterest Browser Extension Injects Unwanted Code into 5K Websites

A buggy Mozilla Firefox browser extension for sharing links to Pinterest has automatically injected malformed code into at least 5,000 websites. The code injection in this instance was not malicious, but researchers at Sucuri, which discovered and reported the problem on Tuesday, said the inciden...

CVE-2017-7820

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects...

CVE-2017-7820: Undefined Security Weakness

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects...

ZenMate VPN Browser Extension Deanonymization & Hijacking Vulnerability (3.5 Million Affected Users)

Summary ZenMate, a VPN provider with over 43 million users, offers multiple browser extensions to use their VPN with. As of the time of this writing the browser extensions have a combined total of 3.5 million users. The ZenMate VPN clients for both Chrome & Firefox trust the previously expired...

CVE-2018-1000176: Exposure of Sensitive Information to an Unauthorized Actor

An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's w...

Malicious gaming extensions: a child’s play to infection

Did you ever lend your laptop to a child to play a video game, only to get it back filled with advertisements? Our CEO knows a little bit about that predicament, having unknowingly infected his parents' computer when he was a kid. But times have changed since then. Let us play for you a modern-da...

Critical Flaw in Grammarly Spell Checker Could Let Attackers Steal Your Data

A critical vulnerability discovered in the Chrome and Firefox browser extension of the grammar-checking software Grammarly inadvertently left all 22 million users' accounts, including their personal documents and records, vulnerable to remote hackers. According to Google Project Zero researcher...

Malicious Chrome Extension Steals Data Posted to Any Website

Malicious browser extensions continue to bear fruit for hackers who have been using them to spread banking malware and adware, and hijacking popular add-ons to spread other nasty code. The latest abuse involves a Google Chrome extension being spread in phishing emails that steals any data posted...

CVE-2017-7820

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects...

The two did not repair the vulnerabilities affect the mainstream browser extension system-vulnerability warning-the black bar safety net

Security researchers found that the two did not fix the vulnerability embedded in many mainstream browsers in the expansion of the system, such as Firefox, Safari, and all with Chromium related browsers such as Chrome, Opera, etc. ! An attacker can exploit these vulnerabilities expose the user of...