Malicious code in beautifulsooup4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 58c3e31b0561d93f895daa3584e7c10b9127e10d258fcf1cfcbabec19a1b08ce Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in websocets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 466292a81e99e2d203935987ab3f37b0175a12275894c97387eb075b71884c07 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in websokets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e8b6f01e8e4ba4dd4d17c1e52ce6ad43d998bbf82b8d5ffa2375d4756437803d Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in yvper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 53b17fd4f9f0d8f72d214b72683b4e65516bd40b5f724d1e615f4c325629c0cb Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in crypotfeed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b4588a6de65bb1177842e5c647887bb81a2e8b22bf29d968a2f7a054d8ec0f70 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in ccxxt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2f0475928d01aa7735ccbbd11aea089aa02c703d8449177cd3e5d32636246059 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Vulnerability of browser extensions in Google Chrome and Microsoft Edge, allowing attackers to gain unauthorized access to protected information

The vulnerability of Google Chrome and Microsoft Edge browser extensions is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by downloading a specially created extension...

Microsoft Warns of Large-Scale Click Fraud Campaign Targeting Gamers

Microsoft said it's tracking an ongoing large-scale click fraud campaign targeting gamers by means of stealthily deployed browser extensions on compromised systems. "The attackers monetize clicks generated by a browser node-webkit or malicious browser extension secretly installed on devices,"...

Malicious Browser Extensions Targeted Over a Million Users So Far This Year

More than 1.31 million users attempted to install malicious or unwanted web browser extensions at least once, new findings from cybersecurity firm Kaspersky show. "From January 2020 to June 2022, more than 4.3 million unique users were attacked by adware hiding in browser extensions, which is...

Threat in your browser: what dangers innocent-looking extensions hold for users

Whether you want to block ads, keep a to-do list or check your spelling, browser extensions allow you to do all of the above and more, improving convenience, productivity and efficiency for free, which is why they are so popular. Chrome, Safari, Mozilla — these and many other major Web browsers —...

You can be tracked online using your Chrome browser extensions

A researcher has found a way to generate a fingerprint of your device from your installed Google Chrome extensions, and then use that fingerprint to track you online. Fingerprinting is a way of figuring out what makes your device unique and then using that to identify you as you move around the...

Jenkins Sonar Quality Gates Plugin transmits credentials in plain text during configuration

Sonar Quality Gates Plugin stores credentials in its global configuration file org.quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the...

GHSA-GVCJ-72H4-8XM9 Jenkins Quality Gates Plugin transmits credentials in plain text during configuration

Quality Gates Plugin stores credentials in its global configuration file quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form b...

GHSA-6FH3-XHWG-7HFH Jenkins Sonar Quality Gates Plugin transmits credentials in plain text during configuration

Sonar Quality Gates Plugin stores credentials in its global configuration file org.quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the...

GHSA-4FJC-FWJ2-7XFG Credentials transmitted in plain text by Repository Connector Plugin

Repository Connector Plugin stores credentials in its global configuration file org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text a...

Client secret transmitted in plain text by Azure AD Plugin

Azure AD Plugin stores a client secret in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions,...

Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration

S3 Publisher Plugin stores a secret key in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by S3 publisher Plugin 0.11.4 and earlier. This can result in exposure of the credential through browser...

Jenkins QMetry for JIRA Plugin shows plain text password in configuration form

Jenkins QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration. While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result...

GHSA-793W-Q2H5-8H5J Jenkins QMetry for JIRA Plugin shows plain text password in configuration form

Jenkins QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration. While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result...

Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form

Jenkins Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions,...