CVE-2024-35222

CVE-2024-35222 affects Tauri; remote origin iFrames can bypass origin checks to access IPC endpoints when not explicitly allowed (v1: before 1.6.7; v2: before 2.0.0-beta.19). Vulnerability enables an attacker-controlled iframe to invoke Tauri commands (e.g., delete project, transfer credits) via ...

CVE-2024-35222 iFrames Bypass Origin Checks for Tauri API Access Control

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. Valid commands with potentially...

CVE-2024-35222

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. Valid commands with potentially...

CVE-2024-35222

creationtimestamp| type| source ---|---|--- 2024-05-23 02:51:35+00:00| published-proof-of-concept| https://github.com/tauri-apps/tauri/security/advisories/GHSA-57fm-592m-34r7...

Tauri 安全漏洞

Tauri is a Tauri open source for building smaller, faster, and more secure desktop applications using a web front end. A security vulnerability exists in Tauri that stems from a vulnerability that allows an attacker to access the Tauri IPC endpoint and execute commands such as delete project via ...

PT-2024-26386 · Tauri · Tauri

Name of the Vulnerable Software and Affected Versions: Tauri versions prior to 1.6.7 Tauri versions prior to 2.0.0-beta.19 Description: The issue allows remote origin iFrames in Tauri applications to access the Tauri IPC endpoints without being explicitly allowed. This bypasses the origin check a...

CVE-2024-35222: Improper Access Control

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. Valid commands with potentially...

RUSTSEC-2023-0117 `tauri-winrt-notifications` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user gabielle55131 to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...

`tauri-winrt-notifications` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user gabielle55131 to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...

RUSTSEC-2023-0108 `tauri-win-rt-notification` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user gabielle55131 to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...

Information Disclosure

@tauri-apps/cli is vulnerable to Information Disclosure. This vulnerability is due to a commonly used misconfiguration which leads to the leakage of the private key and updater key password. If envPrefix: 'VITE', 'TAURI', was pasted from the documentation into vite.config.ts, the TAURIPRIVATEKEY...

GHSA-2RCP-JVR4-R259 Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables

Impact This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri...

localapp (0.1.2) potentially affected by CVE-2023-46115 via tauri-cli (1.1.1)

tauri-cli CARGO version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on tauri-cli and may be impacted: - localapp 0.1.2 Source cves: CVE-2023-46115 Source advisory: OSV:GHSA-2RCP-JVR4-R259...

pake-cli (>=2.0.7-beta1, <=2.0.7), vue-cli-plugin-tauri (>=1.0.0-beta-rc.1, <=1.0.0-rc.3) potentially affected by CVE-2023-46115 via @tauri-apps/cli (>=1.0.0-beta-rc.1, <=1.3.1)

@tauri-apps/cli NPM version =1.0.0-beta-rc.1, =2.0.7-beta1, =1.0.0-beta-rc.1, =1.0.0-rc.3 Source cves: CVE-2023-46115 Source advisory: OSV:GHSA-2RCP-JVR4-R259...

Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables

Impact This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri...

CVE-2023-46115

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

Code injection

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115

Technical details (affected versions, vulnerable components, exploit specifics) are not provided in the supplied documents. Monitor for updates from the vendors and CVE registries.

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...