Reposted by Fredrik Boström
Good grief. A plugin used to authenticate to Swift, Qatar's national identity provider, the Swedish Tax Agency and many banks had a piss simple RCE
"they implemented a cryptographic check, and they did it themselves"
amibeingpwned.com/blog/8-in-10...
amibeingpwned.com
8 out of 10 Banks HATE This One Weird 3SKey RCE
SConnect (1M+ users), the extension and native host used to authenticate with 3SKey, SWIFT, eIDs and other hardware signing tokens, had a drive-by RCE: any site or iframe could silently download and r...