eMudhra CAs Were Revoked for Compromise, and Nobody Has Said Why
Over one weekend, eMudhra revoked eight of its own issuing CAs with reason code cACompromise, Sectigo pulled its cross-signs, Mozilla pushed a block, and Go shipped an emergency release.
fenko.nz/blog/emudhra-ca-com…
PSA: In Riskyplugins.com, you can go to any Chrome/Firefox/VSCode extension's page, and browse all their versions' source code right inside the browser.
Pretty handy if your'e an analyst looking for a hunt
UPDATE: Leantime has released the advisory for below vulnerability:
github.com/Leantime/leantime…
We found two unguarded onboarding methods in Leantime's JSON-RPC API. A low-privilege user can use them to overwrite and activate an owner account.
The permission check fails open when a method lacks its authorization attribute.
fenko.nz/blog/leantime-json-…
500,000 people installed a Chrome "VPN" that lets an attacker decide where their traffic goes, through 2 Google accounts and a Telegram channel
31 different extensions, same logic.
We took it apart, with STIX file available for your CTI platform:
linkedin.com/feed/update/urn…
We found two unguarded onboarding methods in Leantime's JSON-RPC API. A low-privilege user can use them to overwrite and activate an owner account.
The permission check fails open when a method lacks its authorization attribute.
fenko.nz/blog/leantime-json-…