@kumologica/pocdk (>=0.0.7-beta, <=0.0.8-beta), @kumologica/pocsdk (>=0.0.9-poc, <=0.0.33-poc) +6 more potentially affected by CVE-2020-26272 via electron (>=11.0.0, <=11.0.5)

electron NPM version =11.0.0, =0.0.7-beta, =0.0.9-poc, =3.0.0, =0.32.0-alpha.47, =2.0.9, =2.0.12 - simple-git-gui 3.5.4 Source cves: CVE-2020-26272 Source advisory: OSV:GHSA-HVF8-H2QH-37M9...

IPC messages delivered to the wrong frame in Electron

Impact IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app does ANY of the following, then it is impacted by this issue: - Uses...

CVE-2020-26272

CVE-2020-26272 (Electron IPC frame routing) : In Electron, IPC messages sent from the main process to a subframe in the renderer process (via webContents.sendToFrame , or in handlers using event.reply or the remote module) can be delivered to the wrong frame in versions before fixed releases. Aff...

CVE-2020-26272 Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame,...

CVE-2020-26272

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame,...

PT-2021-11228

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 9.4.0 Electron versions prior to 10.2.0 Electron versions prior to 11.1.0 Electron versions prior to 12.0.0-beta.9 Description: IPC messages sent from the main process to a subframe in the renderer process, through...

CVE-2020-26272: Exposure of Resource to Wrong Sphere

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame,...

Electron Security Vulnerabilities

Electron is Electron open source a user to write cross-platform desktop application JavaScript framework. The framework is based on nodejs and Chromium can use HTML, CSS to achieve cross-platform desktop application writing. Electron has a security vulnerability , the vulnerability stems from in...

Warning: Cross-Platform ElectroRAT Malware Targeting Cryptocurrency Users

Cybersecurity researchers today revealed a wide-ranging scam targeting cryptocurrency users that began as early as January last year to distribute trojanized applications to install a previously undetected remote access tool on target systems. Called ElectroRAT by Intezer, the RAT is written from...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

Privilege escalation

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989

The CVE-2020-25989 entry concerns pritunl's Electron client (versions 1.0.1116.6 up to 1.2.2550.20). The issue is a privilege-escalation via arbitrary file write that may allow code execution with root privileges on the affected system. The connected documents confirm the vulnerability class and ...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989: Improper Link Resolution Before File Access

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

PT-2020-16263

Name of the Vulnerable Software and Affected Versions pritunl electron client versions 1.0.1116.6 through 1.2.2550.20 Description The issue allows for privilege escalation via arbitrary file write. Successful exploitation may enable an attacker to execute code on the affected system with root...

Basecamp: Remote Code Execution in Basecamp Windows Electron App

The Windows application for Basecamp, allows a "Download" feature for images in your posts. Under certain restrictions, those files are downloaded and sometimes even automatically opened executed. The file will be executed if it's a download from an internal URL and the mimetype is text/calendar...

Rocket.Chat: Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)

Persistent XSS flaw using nested markdown tags allows remote attacker to inject arbitrary JavaScript to message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. Patched on 3.11, 3.10.5, 3.9.7, 3.8.8...

Mark Text Cross-Site Scripting Vulnerability

Mark Text is an Electron-based Markdown editor for individual developers. A cross-site scripting vulnerability exists in Mark Text version 0.16.2, which can be exploited by an attacker to cause remote code execution...