CVE-2020-11014 BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLP

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the...

@philipplgh/electron-app-manager (>=0.12.0 <=0.56.0), electron-app-manager (>=0.56.0 <=0.57.1) +4 more potentially affected by unknown CVE via electron-updater (>=4.0.0 <=4.1.2)

electron-updater NPM version =4.0.0, =0.12.0, =0.56.0, =0.0.2, =4.0.3, =1.0.0, =1.3.1 Source cves: unknown CVE Source advisory: SNYK:JS-ELECTRONUPDATER-567704...

Signature Validation Bypass

Overview electron-updater is a module allowing applications to implement auto-update functionality. Affected versions of this package are vulnerable to Signature Validation Bypass. The signature verification check is based on a string comparison between the installed binary’s publisherName and th...

antSword

This is a comprehensive analysis of the provided code and metadata from the AntSword repository. Classification: Exploit module/toolkit targeting web applications Primary CVE ID: Not specified Target product/service or framework: Web applications Vulnerability class/vector: Not specified Probable...

CVE-2020-12079

Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API...

CVE-2020-12079

Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API...

CVE-2020-12079

CVE-2020-12079 affects Beaker prior to 0.8.9. The issue allows a sandbox escape due to missing Electron context isolation, enabling a prototype-pollution attack against the Electron internal messaging API and resulting in system access and potential code execution. The vulnerability is rooted in ...

CVE-2020-12079

Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API...

PT-2020-13031 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Beaker versions prior to 0.8.9 Description: The issue allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution...

Starkiller - A Frontend For PowerShell Empire

Starkiller is a Frontend for Powershell Empire. It is an Electron application written in VueJS. If you'd like to contribute please follow the Contribution guide. Getting Started To run Starkiller, you can download the installers for Mac, Linux, and Windows on the Releases page. For more info on...

CVE-2020-9443

Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82...

CVE-2020-9443

Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82...

Design/Logic Flaw

Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82...

CVE-2020-9443

Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82...

CVE-2020-9443

CVE-2020-9443 affects Zulip Desktop prior to 4.0.3. The issue arises from loading untrusted content in an Electron webview with web security disabled, enabling cross-site scripting (XSS) in multiple ways. The vulnerability notably impacts Zulip Desktop 2.3.82. The public documentation notes this ...

UPDATE: Electronegativity v1.4.0

Electronegativity v1.4.0 was released some time ago. My first post about this open source Electron Security tool was titled – Electronegativity: An Open Source Electron Security Auditor which contains several bug fixes and a new feature. What is Electronegativity? Electronegativity is an open...

VulnCheck KEV: CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

@philipplgh/electron-app-manager (>=0.12.0 <=0.56.0), electron-app-manager (>=0.56.0 <=0.57.1) +4 more potentially affected by unknown CVE via electron-updater (>=4.0.0 <=4.1.2)

electron-updater NPM version =4.0.0, =0.12.0, =0.56.0, =0.0.2, =4.0.3, =1.0.0, =1.3.1 Source cves: unknown CVE Source advisory: SNYK:JS-ELECTRONUPDATER-561421...

Signature Validation Bypass

Overview electron-updater is a module allowing applications to implement auto-update functionality. Affected versions of this package are vulnerable to Signature Validation Bypass. The signature verification check is based on a string comparison between the installed binary’s publisherName and th...

This WhatsApp Bug Could Have Let Attackers Access Files On Your PCs

A cybersecurity researcher today disclosed technical details of multiple high severity vulnerabilities he discovered in WhatsApp, which, if exploited, could have allowed remote attackers to compromise the security of billions of users in different ways. When combined together, the reported issues...