Researchers Uncover Publisher Spoofing Bug in Microsoft Visual Studio Installer

Security researchers have warned about an "easily exploitable" flaw in the Microsoft Visual Studio installer that could be abused by a malicious actor to impersonate a legitimate publisher and distribute malicious extensions. "A threat actor could impersonate a popular publisher and issue a...

Researchers Uncover Publisher Spoofing Bug in Microsoft Visual Studio Installer

Security researchers have warned about an "easily exploitable" flaw in the Microsoft Visual Studio installer that could be abused by a malicious actor to impersonate a legitimate publisher and distribute malicious extensions. "A threat actor could impersonate a popular publisher and issue a...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. This updat...

Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux

The Mozilla Foundation Security Advisory describes this flaw as: Firefox did not properly handle downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain Distributions. Other operating systems are...

Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux

The Mozilla Foundation Security Advisory describes this flaw as: Firefox did not properly handle downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain Distributions. Other operating systems are...

Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux

The Mozilla Foundation Security Advisory describes this flaw as: Firefox did not properly handle downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain Distributions. Other operating systems are...

PT-2023-2422 · Microsoft · Visual Studio

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Studio affected versions not specified Description: The issue is related to errors in the representation of information by the user interface, which can allow an attacker to conduct spoofing attacks. It has been reported that...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google Inc. in the United States. A security vulnerability exists in Google Chrome version 111.0.5563.64, which stems from a weak policy enforcement issue in the Extensions API component. An attacker who persuades users to install malicious extensions is allowe...

USN-5881-1 chromium-browser vulnerabilities

It was discovered that Chromium did not properly manage memory. A remote attacker could possibly use these issues to cause a denial of service or execute arbitrary code via a crafted HTML page. CVE-2023-0471, CVE-2023-0472, CVE-2023-0473, CVE-2023-0696, CVE-2023-0698, CVE-2023-0699, CVE-2023-0702...

SUSE CVE-2017-5393

The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects...

SUSE CVE-2020-15966

Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension...

SUSE CVE-2023-0474

Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. Chromium security severity: Medium...

MAL-2023-1590 Malicious code in bbeautifulsoup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 61290bc7eb7a48880670a9aa3fe8d067ad2086f8874063fd9daf8ee2a42f1e0a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-1881 Malicious code in igtpython (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 573c0f3cc220d739194d0751a2eeec89e8ef60f3b53443ee8a4cf02806270ce0 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2053 Malicious code in pycodetsyle (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9bb028bd0872135da54d2c05bf51abb37662c78cbefe4ae6bc669142a841bb5e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-1991 Malicious code in prommpt-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 311cb8997482e18c4ebcc1ec7e371d321d8498ae6018076c67d969021c43bd81 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2092 Malicious code in pysoccks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ad93b8ba30a7cde3f77fb79bc6acf1fa81bd3549eccf3e020d6b21b67b5ba435 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2162 Malicious code in requests-tooblelt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cb593da74433bdac1fd6d90034b07d77f04f399903be1c4ddd50473ea23a7355 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-1814 Malicious code in dscord-webhook (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c50cc6a4200c01b5bc360ef4868c56c3ea06e46b6b54c3e53984b2765b4d18a5 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2172 Malicious code in requests-tooleblt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 557e510eebc15089acf31ec61853895e79c3ca93441ded980c4097eea04d9684 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...