vulhub

This repository is an offensive tool for web application security training and testing. It is a collection of vulnerable web applications and tools for testing and training purposes. The repository contains a variety of vulnerable applications, including web servers, databases, and other web-base...

Rambox RCE Vulnerability

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

GHSA-2GC6-2H2G-PH48 Rambox RCE Vulnerability

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

Proton 跨站脚本漏洞

Proton is a standalone application by steventhanna individual developers that uses Electron to quickly preview and edit Markdown files. A security vulnerability exists in Proton version v0.2.0 that originates from allowing the creation of malicious links in markdown files...

GHSA-7FV9-M79R-J9X8 Electron vulnerable to remote command execution

Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...

Electron vulnerable to remote command execution

Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...

0.app1 (=1.0.52), 0.edsql (>=1.0.49 <=1.0.50) +548 more potentially affected by CVE-2017-12581 via electron (>=0.1.2 <=1.6.7)

electron NPM version =0.1.2, =1.0.49, =1.0.49, =1.0.49, =1.0.0, =1.0.6, =4.0.23, =0.0.7, =0.0.73, =1.0.0, =2.0.0, =2.0.2 and more Source cves: CVE-2017-12581 Source advisory: OSV:GHSA-7FV9-M79R-J9X8...

GHSA-6H98-CF9G-VMG2 Electron vulnerable to URL spoofing via PDFium

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...

Electron vulnerable to URL spoofing via PDFium

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...

@ftnk/electron-prebuilt-compile (=1.7.3), @philipptrenz/photo-booth (>=1.0.1 <=1.0.6) +57 more potentially affected by CVE-2017-1000424 via electron (>=1.7.0 <=1.7.5)

electron NPM version =1.7.0, =1.0.1, =1.0.0, =1.0.1, =0.4.0-next.0b426d22, =0.3.3, =0.4.0-next.0cc6469e, =0.4.0-next.0b426d22, =0.3.3, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.ff386514 and more Source cves:...

Lazarus is back, targeting organizations with cryptocurrency thefts via TraderTraitor malware

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI, the Cybersecurity and Infrastructure Security Agency CISA, and the U.S. Treasury Department Treasury have issued a joint Cybersecurity AdvisoryCSA to make organizations in the blockchai...

Kraken - A Multi-Platform Distributed Brute-Force Password Cracking System

Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolera...

Privilege Escalation

electron is vulnerable to privilege escalation. An attacker can obtain access to a bluetooth device via the web bluetooth API if the application has not configured a custom select-bluetooth-device event handler...

GHSA-3P22-GHQ8-V749 Renderers can obtain access to random bluetooth device without permission in Electron

Impact This vulnerability allows renderers to obtain access to a random bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device...

Renderers can obtain access to random bluetooth device without permission in Electron

Impact This vulnerability allows renderers to obtain access to a random bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device...

0.edsql (>=1.0.49 <=1.0.50), 0.electron.main (>=1.0.49 <=1.0.50) +257 more potentially affected by CVE-2022-21718 via electron (>=0.1.2 <=13.6.2)

electron NPM version =0.1.2, =1.0.49, =1.0.49, =1.0.49, =1.0.0, =4.0.23, =0.0.73, =3.0.0, =2.10.0, =2.15.0, =2.10.0, =2.10.0, =2.18.0-dev.10 and more Source cves: CVE-2022-21718 Source advisory: OSV:GHSA-3P22-GHQ8-V749...

Internet Bug Bounty: Renderers can obtain access to random bluetooth device without permission

With the default configuration in Electron, renderer processes which should not have access to system resources by default can gain read/write access to a nearby bluetooth device. To reproduce: Run the electron-quick-start app with a vulnerable version of Electron:...

CVE-2022-21718

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not...

Design/Logic Flaw

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not...

CVE-2022-21718 Renderers can obtain access to random bluetooth device without permission in Electron

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not...