Drxyj

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."

**Name of the Vulnerable Software and Affected Versions** vidIQ Vision for YouTube Extension version 3.199.0 **Description** A remote information disclosure issue exists in the postMessage Handler component. The flaw occurs within the `window.addEventListener()` function when the `vidiqEvent` argument is manipulated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BEN Group TubeBuddy for YouTube Extension versions prior to 5.8.5 **Description** Insufficient verification of data authenticity occurs within the `TBGlobal.GetToken()` function located in the `tubebuddymaster1.js` file. A remote attacker can exploit this by manipulating the `t/c/r` argument. **Recommendations** Update BEN Group TubeBuddy for YouTube Extension to version 5.8.5 or later. As a temporary mitigation, restrict the use of the `TBGlobal.GetToken()` function until the update is applied.

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Orange View Limited DualSafe Password Manager & Digital Vault Extension versions prior to 1.4.36 **Description** A flaw exists in the postMessage-based Bridge component of the extension on Chrome. A remote attacker can perform a manipulation of an unknown function within this component to cause information disclosure. This attack is characterized by high complexity and is considered difficult to exploit. **Recommendations** Update the extension to a version newer than 1.4.35.

**Name of the Vulnerable Software and Affected Versions** Adblock for Youtube Extension versions prior to 7.2.2 **Description** An improper authorization issue exists in the Event Listener component within the `contentscript.js` file. The flaw occurs in the `updateDynamicRules()` function when the `yt-anti-adblock-detected` argument is manipulated, allowing a remote attacker to initiate an attack. **Recommendations** As a temporary workaround, restrict the use of the `updateDynamicRules()` function in the `contentscript.js` file until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Alaev SEO Tools Extension versions prior to 1.0.11 **Description** A remote cross-site scripting issue exists in the Popup UI component within the `src/popup.html` file. The flaw is located in the `addDiv()` function, where improper manipulation allows an attacker to execute malicious scripts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `addDiv()` function in the `src/popup.html` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** eyeo Adblock Plus versions prior to 4.36.3 **Description** Improper access controls exist in the Legacy Premium Activation component within the `postMessage()` function of the `premium.preload.js` file. This allows remote exploitation through manipulation, though the affected code path is part of a deprecated activation flow. The licensing server issues short-lived trial licenses (approximately 24 hours) for any submitted `userId`, which expire upon the next validation if no valid subscription is found. **Recommendations** Upgrade the affected component to a version later than 4.36.2.

**Name of the Vulnerable Software and Affected Versions** SeaCMS version 11.6 **Description** A problematic issue affects the Picture Upload Handler component, specifically the file member.php, where the manipulation of the `oldpic` argument leads to denial of service. The attack can be initiated remotely. **Recommendations** For SeaCMS version 11.6, consider restricting access to the Picture Upload Handler component until a fix is available. As a temporary workaround, avoid using the `oldpic` argument in the affected file member.php to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Guest Management System version 1.0 **Description** A problematic issue has been found in the file dateTest.php of the component GET Parameter Handler. The manipulation of the `name` argument leads to cross-site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For SourceCodester Guest Management System version 1.0, consider disabling the `dateTest.php` file or restricting access to the GET Parameter Handler component until a patch is available. Avoid using the `name` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.