Brave Software: RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context

Summary: \395737 has shown that Brave supports chrome://brave/ URLs. The Brave team introduced a patch which blocks navigation to chrome://brave and removed chrome.remote.require to prevent command execution on the machine. Navigation to chrome://brave via shortcut files From my understanding: 1...

The vulnerability of the Electron application development software platform arises from access control errors, which allow a hacker to execute arbitrary code.

The vulnerability of the Electron application development software platform stems from access control errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially crafted iframe element...

Electron WebPreferences - Remote Code Execution Exploit

Exploit for multiple platform in category remote exploits CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested...

Electron WebPreferences - Remote Code Execution

Electron WebPreferences - Remote Code Execution CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested child windo...

Electron WebPreferences - Remote Code Execution

CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested child windows on Electron versions 3.0.0-beta.6, 2.0.7,...

Remote Code Execution (RCE)

Electron is vulnerable to remote code execution RCE attacks. When IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" option are used, it is possible for an attacker to launch web preferences vulnerability leading to remote code execution...

@felixrieseberg/electron-prebuilt-compile (>=2.0.0-beta.1, <=2.0.7), @ngx-electron/cli (>=0.0.3, <=0.0.10) +22 more potentially affected by CVE-2018-15685 via electron (>=2.0.0, <=2.0.7)

electron NPM version =2.0.0, =2.0.0-beta.1, =0.0.3, =0.0.2, =0.0.1, =0.0.1, =2.1.0, =0.0.4, =2.0.0-beta.1, =0.0.10, =19.1.0, =19.3.1 and more Source cves: CVE-2018-15685 Source advisory: OSV:GHSA-HV9C-QWQG-QJ3V...

GHSA-HV9C-QWQG-QJ3V Electron webPreferences vulnerability can be used to perform remote code execution

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a webPreferences vulnerability that can be leveraged to perform remote code execution. More information to determine if yo...

Electron webPreferences vulnerability can be used to perform remote code execution

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a webPreferences vulnerability that can be leveraged to perform remote code execution. More information to determine if yo...

@devpodio/application-manager (>=0.3.16, <=0.3.20), @devpodio/bunyan (>=0.3.16, <=0.3.20) +158 more potentially affected by CVE-2018-15685 via electron (>=1.8.1, <=1.8.7)

electron NPM version =1.8.1, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.20 and more Source cves: CVE-2018-15685 Source advisory: OSV:GHSA-HV9C-QWQG-QJ3V...

@ftnk/electron-prebuilt-compile (1.7.3), @philipptrenz/photo-booth (>=1.0.1, <=1.0.6) +68 more potentially affected by CVE-2018-15685 via electron (>=1.7.0, <=1.7.13)

electron NPM version =1.7.0, =1.0.1, =1.0.0, =1.0.1, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.1, =0.2.0-next.29255833, =0.4.0-next.ff386514 and more Source...

Remote code execution

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution...

CVE-2018-15685

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution...

CVE-2018-15685

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution...

CVE-2018-15685

GitHub Electron versions 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6 are affected by a WebPreferences vulnerability when using IFRAME with nativeWindowOpen: true or sandbox: true, enabling remote code execution. The issue arises in Electron’s WebPreferences handling and can be triggered in nested wind...

CVE-2018-15685

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution...

Active Directory Privilege Relationships: BloodHound

BloodHound is a single page Javascript web application, built on top of Linkurious , compiled with Electron , with a Neo4j database fed by a PowerShell ingestor . BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attacks c...

Electron WebPreferences Remote Command Execution Vulnerability

Electron is an open source library developed by Github to build cross-platform desktop applications using HTML, CSS and JavaScript.Electron accomplishes this by merging Chromium and Node.js into the same runtime environment and applications for Mac, Windows and Linux systems. A remote command...

@ftnk/electron-prebuilt-compile (1.7.3), @theia/application-package (>=0.2.0-next.0148a1fd, <=0.4.0-next.f7dccfd2) +41 more potentially affected by CVE-2017-16151 via electron (>=1.7.0, <=1.7.7)

electron NPM version =1.7.0, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.1, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.4.0-next.0317f991,...

GHSA-4W88-RJJ3-X7WP Chromium Remote Code Execution in electron

Affected versions of ElectronJS are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the sandbox option is enabled. Recommendation Update to electron version 1.7.8 or later...