2328 matches found
OPENSUSE-SU-2024:14193-1 nodejs-electron-30.2.0-1.1 on GA media
These are all security issues fixed in the nodejs-electron-30.2.0-1.1 package on the GA media of openSUSE Tumbleweed...
electron29 -- multiple vulnerabilities
Electron developers report: This update fixes the following vulnerabilities: Security: backported fix for CVE-2024-6291. Security: backported fix for CVE-2024-6293. Security: backported fix for CVE-2024-6290. Security: backported fix for CVE-2024-6292...
Improper Verification Of Cryptographic Signature
electron-updater is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is caused due to improper handling and comparison of file paths, allowing an attacker to bypass signature verification by exploiting environment variable expansion and tricking the application in...
CVE-2024-39698
electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...
CVE-2024-39698
The CVE-2024-39698 entry concerns a Windows code-signing bypass in electron-updater. A flaw in the verification routine in packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts arises because the surrounding shell (cmd.exe) expands environment variables in the command line, enab...
CVE-2024-39698 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6
electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...
CVE-2024-39698 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6
electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...
CVE-2024-39698 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6
electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...
GHSA-9JXC-QJR9-VJXQ electron-updater Code Signing Bypass on Windows
Observations The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. It executes the following command in a new shell process.env.ComSpec on Windows, usually C:\Windows\System32\cmd.exe:...
electron-updater Code Signing Bypass on Windows
Observations The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. It executes the following command in a new shell process.env.ComSpec on Windows, usually C:\Windows\System32\cmd.exe:...
electron-builder security vulnerability
electron-builder is a tool for packaging and building ready-to-distribute Electron, Proton Native applications for macOS, Windows, and Linux with out-of-the-box "auto-update" support. A security vulnerability exists in electron-builder prior to version 6.3.0-alpha.6, which can be exploited to...
PT-2024-28636 · Unknown · Electron-Updater
Name of the Vulnerable Software and Affected Versions: electron-updater versions prior to 6.3.0-alpha.6 Description: The issue concerns the signature validation routine for Electron applications on Windows, implemented in the file...
CVE-2024-23997
Lukas Bach yana =1.0.16 is vulnerable to Cross Site Scripting XSS via src/electron-main.ts...
CVE-2024-23997
Lukas Bach yana =1.0.16 is vulnerable to Cross Site Scripting XSS via src/electron-main.ts...
PT-2024-20224 · Unknown · Lukas Bach
Name of the Vulnerable Software and Affected Versions: Lukas Bach yana version 1.0.16 Description: The issue is related to Cross Site Scripting XSS via src/electron-main.ts. Recommendations: For version 1.0.16, update to a version that is 1.0.16 or later to resolve the issue. As a temporary...
Yana Security Breach
Yana is a powerful laptop application from the individual developer Lukas Bach. A security vulnerability exists in Yana version 1.0.16 and prior versions, which stems from a cross-site scripting vulnerability in the src/electron-main.ts location...
electron29 -- multiple vulnerabilities
Electron developers report: This update fixes the following vulnerabilities: Security: backported fix for CVE-2024-5499. Security: backported fix for CVE-2024-5493. Security: backported fix for CVE-2024-5494. Security: backported fix for CVE-2024-5495. Security: backported fix for CVE-2024-5496...
Malicious code in en-conduit-electron-worker (npm)
--- -= Per source details. Do not edit below this line.=-...