27 matches found
Command injection
electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...
CVE-2016-10534
electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...
CVE-2016-10534
CVE-2016-10534 affects electron-packager where the --strict-ssl option is defaulted to false in versions 5.2.1–6.0.0 and 6.0.0–6.0.2 unless explicitly set to true. This enables potential MITM attacks during Electron downloads for supported targets. Connected advisories corroborate the MITM risk a...
CVE-2016-10534
electron-packager is a command line tool that packages Electron source code into ".app" and ".exe" packages. along with Electron. The "--strict-ssl" command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to...
CVE-2016-10534: Improper Certificate Validation
electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...
PT-2018-4713
Name of the Vulnerable Software and Affected Versions electron-packager versions 5.2.1 through 6.0.2 Description The issue allows an attacker to perform a man-in-the-middle attack due to the --strict-ssl command line option defaulting to false if not explicitly set to true. This could enable an...
Man-in-the-Middle (MitM)
electron-packager is vulnerable to man-in-the-middle MitM attacks. The application by default sets the --strict-ssl variable to false, disabling SSL certificate validation. This can allow an attacker on an adjacent network to conduct a MitM attack during the electron package installation step...