40 matches found
EUVD-2018-18401
Malware in sbrugna...
Inside Grammarly’s AI-driven automation with the MCP Server for Wiz
Meet the system that cut manual triage times by 90% and enables engineers to focus on strategic thinking...
Malicious code in grammarly-editor-sdk (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f24713f82fc90957a8e5834da2735094adc919b65b81f569360b9b8b1c284873 Any computer that has this package installed or running should be considered...
CVE-2018-6654
The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr-ifr, because the exposure of these tokens is not restricted to any specific web site...
Malicious code in grammarly-desktop (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2436 Malicious code in grammarly-desktop (npm)
--- -= Per source details. Do not edit below this line.=-...
Critical OAuth Flaws Uncovered in Grammarly, Vidio, and Bukalapak Platforms
Critical security flaws have been disclosed in the Open Authorization OAuth implementation of popular online services such as Grammarly, Vidio, and Bukalapak, building upon previous shortcomings uncovered in Booking.com and Expo. The weaknesses, now addressed by the respective companies following...
What is a keylogger?
A blog post published earlier this year posed the question "Is Grammarly a keylogger?" I have personally had people reference that post and ask me to add detection of Grammarly to Malwarebytes. The answer has always been, "no." Whether or not you like what Grammarly does, Grammarly is not a...
MAL-2022-3445 Malicious code in grammarly-editor (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0544f765bed48017a1316c2702e62eee624be8032b93d3d84302957e6c3a5e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in grammarly-editor (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0544f765bed48017a1316c2702e62eee624be8032b93d3d84302957e6c3a5e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Grammarly: Bypassing the Grammarly plagiarism checker by simply replacing characters in the source text
Summary: Replacing the characters i, a, e, o, p, c, x in the text with similar ones in the Ukrainian keyboard layout leads to the fact that plagiarism detectors Grammarly plagiarism checker and others skip such text, mark it as unique without any plagiarism and do not even signal that the...
Grammarly fixed XSS vulnerability that bypasses AWS WAF
Grammarly is the unicorn company that announced its open bug bounty program last September. Since that time, many security researchers posted their submissions and got paid well. Some of Grammarlys issues are also useful for others. Like the recent XSS, that also bypasses an AWS WAF. The recent X...
88.99.240.100 Cross Site Scripting vulnerability OBB-1266720
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Grammarly: Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeover
@tomtenisse identified a vulnerability in Grammarly Keyboard for Android that allowed malicious application installed on the device to guess the PKCE code verifier value and consequently obtain access to OAuth accesstoken grauth cookie. The vulnerability was fixed by moving from PRNG to...
iOS 13 Bug Lets 3rd-Party Keyboards Gain 'Full Access' — Even When You Deny
Following the release of iOS 13 and iPadOS earlier this week, Apple has issued an advisory warning iPhone and iPad users of an unpatched security bug impacting third-party keyboard apps. On iOS, third-party keyboard extensions can run entirely standalone without access to external services and...
iOS 13 Bug Lets 3rd-Party Keyboards Gain 'Full Access' — Even When You Deny
Following the release of iOS 13 and iPadOS earlier this week, Apple has issued an advisory warning iPhone and iPad users of an unpatched security bug impacting third-party keyboard apps. On iOS, third-party keyboard extensions can run entirely standalone without access to external services and...
Grammarly: Can register any mobile number in MFA without current code.
@chackmate identified a vulnerability that allows a user to connect arbitrary phone numbers with their account. No users affected...
Grammarly: Previously created sessions continue being valid after MFA activation
Hi team, I found one issue related to your 2FA system on https://account.grammarly.com/security POC 1 access the same account on https://account.grammarly.com in two devices 2 on device 'A' go to https://account.grammarly.com/security complete all steps to activate the 2FA system Now the 2FA is...
Grammarly: Account takeover through the combination of cookie manipulation and XSS
Summary: A cookie based XSS on www.grammarly.com exists due to reflection of a cookie called gnarcontainerId in DOM without any sanitization. Normally, gnarcontainerId is being set by the server however a vulnerable endpoint at gnar.grammarly.com called "/cookies" allows us to manipulate cookies...
Grammarly: Grammarly Keyboard for Android <4.1 leaks user input through logs (except for sensitive input fields)
@homelander identified that Grammarly for Android on Android 4.1 was leaking user-entered text to device logs. Currently, Grammarly for Android doesn't support devices with platform versions less than Android 5.0...