Chrome pushes forward with plans to limit ad blockers in the future

Google has announced it will shut down Manifest V2 in June 2024 and move on to Manifest V3, the latest version of its Chrome extension specification that has faced criticism for putting limits on ad blockers. Roughly said, Manifest V2 and V3 are the rules that browser extension developers have to...

ParaSiteSnatcher: How Malicious Chrome Extensions Target Brazil

We detail the modular framework of malicious Chrome extensions that consist of various highly obfuscated components that leverage Google Chrome API to monitor, intercept, and exfiltrate victim data...

ibis-extensions (0.1.2) potentially affected by CVE-2023-47248 via ibis-framework (4.1.0)

ibis-framework PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ibis-framework and may be impacted: - ibis-extensions 0.1.2 Source cves: CVE-2023-47248 Source advisory: OSV:GHSA-X563-6HQV-26MR...

DEBIAN-CVE-2023-47627

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

PYSEC-2023-246

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

UBUNTU-CVE-2023-47627

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

kernel: Intel firmware update for Incorrect default permissions in some memory controller configurations

A flaw was found in the Linux kernel. Some IntelR XeonR processors with Intel® Software Guard Extensions SGX may allow privilege escalation. This issue may allow a privileged user to enable privilege escalation via local access...

Iptables Network Interface Component Confidential Data Access Data Compromise

The vulnerability of the extensions/libxttcp.c component of the Iptables network interface control system is related to insufficient input data validation. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service interruptions...

Google Chrome Extension Access Data Compromise

The vulnerability of Google Chrome’s browser Extensions relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a specially created HTML page...

CVE-2023-47190

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin = 1.9.0 versions...

CVE-2023-47190

CVE-2023-47190 affects the Apollo13 Framework Extensions plugin for WordPress (

CVE-2023-47190 WordPress Apollo13 Framework Extensions Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin = 1.9.0 versions...

org.keycloak:keycloak-wildfly-extensions (>=1.2.0.beta1, <=1.2.0.final), org.wildfly.core:wildfly-domain-http-interface (1.0.0.alpha12) +10 more potentially affected by CVE-2023-4061 via org.wildfly.core:wildfly-controller (1.0.0.alpha12)

org.wildfly.core:wildfly-controller MAVEN version 1.0.0.alpha12 is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-controller and may be impacted: - org.keycloak:keycloak-wildfly-extensions =1.2.0.beta1, =1.2.0.final -...

CVE-2023-47190: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin = 1.9.0 versions...

PT-2023-30354

Name of the Vulnerable Software and Affected Versions Apollo13Themes Apollo13 Framework Extensions plugin versions = 1.9.0 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher authentication levels. There is no informatio...

WordPress Plugin Apollo13 Framework Extensions Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Fedora 39 : chromium (2023-0b39dc9302)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0b39dc9302 advisory. update to 118.0.5993.117. Security release for CVE-2023-5472 ---- Update to 118.0.5993.88 ---- Update to 118.0.5993.70. Include following security...

[SECURITY] Fedora 39 Update: icecat-115.3.1-7.rh2.fc39

GNU IceCat is the GNU version of the Firefox ESR browser. Extensions included to this version of IceCat: LibreJS GNU LibreJS aims to address the JavaScript problem described in the article "The JavaScript Trap" of Richard Stallman. HTTPS Everywhere HTTPS Everywhere is an extension that encrypts...

First handset with MTE on the market

By Mark Brand, Google Project Zero Introduction It's finally time for me to fulfill a long-standing promise. Since I first heard about ARM's Memory Tagging Extensions, I've said to far too many people at this point to be able to back out… that I'd immediately switch to the first available device...

CVE-2023-42804 BigBlueButton Path Traversal – Reading Certain File Extensions

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions txt, swf...