CVE-2022-29247 Exposure of Resource to Wrong Sphere in Electron

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

CVE-2022-29247 Exposure of Resource to Wrong Sphere in Electron

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

CVE-2022-29247

CVE-2022-29247 — Electron IPC leakage via nodeIntegrationInSubFrames . The issue affects Electron versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5. A renderer with JS execution can gain access to a new renderer process when nodeIntegrationInSubFrames is enabled, which can expose access...

CVE-2022-29247 Exposure of Resource to Wrong Sphere in Electron

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

CVE-2022-29247

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with "nodeIntegrationInSubFrame...

CVE-2022-29247: Exposure of Resource to Wrong Sphere

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

Electron 输入验证错误漏洞

Electron is a personal developer of a user to write cross-platform desktop application JavaScript framework. The framework is based on nodejs and Chromium can use HTML, CSS to achieve cross-platform desktop application writing. An input validation error vulnerability exists in Electron versions...

CVE-2022-29257: Improper Input Validation

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

PT-2022-4290

Name of the Vulnerable Software and Affected Versions Electron versions prior to 18.0.0-beta.6 Electron versions prior to 17.2.0 Electron versions prior to 16.2.6 Electron versions prior to 15.5.5 Description The issue is related to the nodeIntegrationInSubFrames parameter in Electron, which can...

Electron 安全漏洞

Electron is a personal developer of a user to write cross-platform desktop application JavaScript framework. The framework is based on nodejs and Chromium and can be used to write cross-platform desktop applications using HTML and CSS. A security vulnerability exists in Electron version...

PT-2022-19505

Name of the Vulnerable Software and Affected Versions Electron versions prior to 18.0.0-beta.6 Electron versions prior to 17.2.0 Electron versions prior to 16.2.6 Electron versions prior to 15.5.5 Description A vulnerability in Electron allows attackers who have control over a given app's update...

Command execution vulnerability in JGraph drawio-desktop

drawio-desktop is an Electron-based diagramming and whiteboarding desktop application. A command execution vulnerability exists in JGraph drawio-desktop that can be exploited by an attacker to cause code execution...

vulhub

This repository is an offensive tool for web application security training and testing. It is a collection of vulnerable web applications and tools for testing and training purposes. The repository contains a variety of vulnerable applications, including web servers, databases, and other web-base...

GHSA-2GC6-2H2G-PH48 Rambox RCE Vulnerability

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

Rambox RCE Vulnerability

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

Proton 跨站脚本漏洞

Proton is a standalone application by steventhanna individual developers that uses Electron to quickly preview and edit Markdown files. A security vulnerability exists in Proton version v0.2.0 that originates from allowing the creation of malicious links in markdown files...

Electron vulnerable to remote command execution

Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...

@fdnpm/fd-module-cli (>=4.0.4, <=4.0.7), @finviet-jsrpt/jsrpt-electron-pdf (>=1.0.5, <=1.0.6) +61 more potentially affected by CVE-2017-12581 via electron (>=1.3.1, <=1.6.7)

electron NPM version =1.3.1, =4.0.4, =1.0.5, =2.1.1, =1.0.0, =0.0.7, =1.3.0, =4.1.0, =0.6.0, =1.3.3, =0.0.18, =0.0.2, =1.0.0, =1.0.0, =1.1.5 and more Source cves: CVE-2017-12581 Source advisory: OSV:GHSA-7FV9-M79R-J9X8...

GHSA-7FV9-M79R-J9X8 Electron vulnerable to remote command execution

Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...

Electron vulnerable to URL spoofing via PDFium

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...