CVE-2019-11354: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The client in Electronic Arts EA Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices...

PT-2019-12254

Name of the Vulnerable Software and Affected Versions EA Origin version 10.5.36 Description The issue concerns template injection in the title parameter of the Origin2 URI handler, allowing an attacker to escape the AngularJS sandbox. This can lead to remote code execution via an...