MAL-2024-1070 Malicious code in jitsi-meet-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d00022cc6b75ddc259b9fe60993dbdf646c17b30cce6a76c88798ca229947db The OpenSSF Package Analysis project identified 'jitsi-meet-electron' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

FreeBSD : electron{27,28} -- vulnerability in libxml2 (e74da31b-276a-4a22-9772-17dd42b97559)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e74da31b-276a-4a22-9772-17dd42b97559 advisory. - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader...

CVE-2024-27303

electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh...

Code injection

electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh...

CVE-2024-27303 electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh...

CVE-2024-27303 electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh...

CVE-2024-27303 electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh...

CVE-2024-27303

The CVE-2024-27303 vulnerability affects electron-builder’s NSIS installer prior to 24.13.2 on Windows. The NSIS installer runs NSExec, which by default searches the install folder before PATH. If an attacker places a malicious cmd.exe in the same folder as the installer, that executable can be e...

electron-builder security vulnerability

electron-builder is a tool for packaging and building ready-to-distribute Electron, Proton Native applications for macOS, Windows, and Linux with out-of-the-box "auto-update" support. A security vulnerability exists in electron-builder prior to version 24.13.2, which stems from the fact that if a...

electron{27,28} -- vulnerability in libxml2

Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-25062...

electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

Impact Windows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh installer script. NSExec by default searches the current directory of where the installer is located before searching PATH. This means that if an attacker can place a malicious executable file named...

GHSA-R4PF-3V7R-HH55 electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

Impact Windows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh installer script. NSExec by default searches the current directory of where the installer is located before searching PATH. This means that if an attacker can place a malicious executable file named...

PT-2024-21807

Name of the Vulnerable Software and Affected Versions electron-builder versions prior to 24.13.2 Description A vulnerability in electron-builder for Windows allows an attacker to execute a malicious file named cmd.exe if it is placed in the same folder as the installer. The NSIS installer makes a...

FreeBSD : electron{27,28} -- Use after free in Mojo (3567456a-6b17-41f7-ba7f-5cd3efb2b7c9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3567456a-6b17-41f7-ba7f-5cd3efb2b7c9 advisory. - Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potential...

electron{27,28} -- Use after free in Mojo

Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-1670...

CVE-2023-50975

The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled i.e., ELECTRONRUNASNODE can be used in production. This makes it easier for a compromised process to access banking information...

Information disclosure

The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled i.e., ELECTRONRUNASNODE can be used in production. This makes it easier for a compromised process to access banking information...

Arbitrary File Read

electron-pdf is vulnerable to Arbitrary File Read. The vulnerability due to the improper input application when validating the HTML content, allowing an attacker to remotely obtain arbitrary local files by injecting malicious HTML content...

CVE-2023-50975

The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled i.e., ELECTRONRUNASNODE can be used in production. This makes it easier for a compromised process to access banking information...

CVE-2023-50975

The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled i.e., ELECTRONRUNASNODE can be used in production. This makes it easier for a compromised process to access banking information...