CVE-2019-9150

CVE-2019-9150 affects the Mailvelope extension prior to 3.3.0. The vulnerability arises because the extension does not require user interaction to import public keys shown on the web page, enabling trickery to hide a key import or obfuscate which key was imported. Impact is limited to the affecte...

CVE-2019-9150

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported...

CVE-2019-9149

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign and encrypt arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows ...

CVE-2019-9149

CVE-2019-9149 affects Mailvelope prior to 3.3.0. An attacker can trigger private key operations without user interaction by tampering a URL parameter in Mailvelope’s client-API, allowing signing (and encrypting) arbitrary messages if the private key password is cached. A separate issue enables de...

CVE-2019-9148

Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certification. Keys that are obviously invalid are not rejected during import. An attacker that is able to get a victim to import a manipulated key...

CVE-2019-9148

Mailvelope is affected up to version 3.2.x; the vulnerability arises from importing invalid PGP keys during key import. Specifically, Mailvelope accepts or operates with keys that contain users without a valid self-certification and does not reject clearly invalid keys during import, enabling an ...

CVE-2019-9147

Mailvelope CVE-2019-9147 affects the Mailvelope browser extension before version 3.1.0. The vulnerability is a clickjacking issue on the settings page, which is intended to be embedded by web apps. The problem arises because the browser extension isolation mechanisms are disabled via web_accessib...

CVE-2019-9147

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled webaccessibleresources. Mailvelope implements additional measures to preve...

Mailvelope Encryption Problem Vulnerability

Mailvelope is a suite of open source extensions for using in-browsers. The program is primarily used for end-to-end encryption of email traffic within a web browser. A cryptographic issue vulnerability exists in Mailvelope versions prior to 3.3.0, which arises from a network system or product tha...

Windows Gather Google Chrome User Data Enumeration

This module will collect user data from Google Chrome and attempt to decrypt sensitive information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Google Chrome User Data...