Active Directory Privilege Relationships: BloodHound

BloodHound is a single page Javascript web application, built on top of Linkurious , compiled with Electron , with a Neo4j database fed by a PowerShell ingestor . BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attacks c...

CVE-2018-15685: Initialization of a Resource with an Insecure Default

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution...

Electron WebPreferences Remote Command Execution Vulnerability

Electron is an open source library developed by Github to build cross-platform desktop applications using HTML, CSS and JavaScript.Electron accomplishes this by merging Chromium and Node.js into the same runtime environment and applications for Mac, Windows and Linux systems. A remote command...

@ftnk/electron-prebuilt-compile (1.7.3), @theia/application-package (>=0.2.0-next.0148a1fd, <=0.4.0-next.f7dccfd2) +41 more potentially affected by CVE-2017-16151 via electron (>=1.7.0, <=1.7.7)

electron NPM version =1.7.0, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.1, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.4.0-next.0317f991,...

GHSA-4W88-RJJ3-X7WP Chromium Remote Code Execution in electron

Affected versions of ElectronJS are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the sandbox option is enabled. Recommendation Update to electron version 1.7.8 or later...

@fdnpm/fd-module-cli (>=4.0.4, <=4.0.7), @finviet-jsrpt/jsrpt-electron-pdf (>=1.0.5, <=1.0.6) +68 more potentially affected by CVE-2017-16151 via electron (>=1.3.1, <=1.6.13)

electron NPM version =1.3.1, =4.0.4, =1.0.5, =2.1.1, =1.0.0, =0.0.7, =1.3.0, =4.1.0, =0.6.0, =1.3.3, =0.0.18, =0.0.2, =1.0.0, =1.3.4 and more Source cves: CVE-2017-16151 Source advisory: OSV:GHSA-4W88-RJJ3-X7WP...

Advanced Electron Forum Private Message Module Cross-Site Scripting Vulnerability

Advanced Electron Forum AEF is an online forum system written in PHP.Private Message is one of the personal information modules. A cross-site scripting vulnerability exists in the 'FTP Link' element of the Private Message module in AEF version 1.0.9, which originates from unfiltered content in th...

CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

Cross site scripting

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

CVE-2018-13000: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

Google Chromium Electron Remote Code Execution Vulnerability

Google Chromium is the United States Google Google company developed a Web browser. Electron is used in one of the use of JavaScript, HTML and CSS and other Web technologies to create desktop applications framework. A remote code execution vulnerability exists in Electron in Google Chromium. A...

CVE-2017-16151

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the sandbox option is enabl...

CVE-2017-16151

CVE-2017-16151 describes a remote code execution vulnerability in Google Chromium that affects Electron apps. The issue, affecting all recent Electron versions when loading remote content, can be triggered regardless of the sandbox option being enabled. The exposed component is Electron’s integra...

electron-packager Man-in-the-Middle Attack Vulnerability

electron-packager is a tool for packaging applications into executables based on different platforms. A security vulnerability exists in electron-packager versions 5.2.1 through 6.0.0 and 6.0.0 through 6.0.2, which stems from the '--strict-ssl' command line option being set by default to 'false '...

Empire GUI - Empire Client Application

The Empire Multiuser GUI is a graphical interface to the Empire post-exploitation Framework. It was written in Electron and utilizes websockets SocketIO on the backend to support multiuser interaction. The main goal of this project is to enable red teams, or any other color team, to work together...

CVE-2016-10534

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...

CVE-2016-10534

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...

Command injection

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...

CVE-2016-10534

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...