CVE-2019-17051

Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file...

Evernote: One Click Code Execution via File

This issue was reported to Evernote by @ajdumanhug and fixed in November 2019. This disclosure is a copy of the original, and is for historical purposes only. Overview The Open with Terminal functional is vulnerable to One Click Code Execution. Tested the vulnerability using the Mac Desktop App...

CVE-2019-17051

Evernote for macOS (prior to 7.13 GA) is affected by CVE-2019-17051. The root cause is the com.apple.quarantine attribute not being applied to downloaded attachments, enabling a one-click code execution scenario via a crafted Terminal file when a user drags and drops it into Evernote Open With Te...