CVE-2017-1000424

The CVE-2017-1000424 entry concerns GitHub Electron versions 1.6.4–1.6.11 and 1.7.0–1.7.5, which are vulnerable to a URL spoofing flaw when opening PDFs in PDFium. This can result in loading arbitrary PDFs controlled by an attacker. The root cause is described as a PDFium-related URL spoofing vul...

CVE-2017-1000424: Undefined Security Weakness

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...

Automattic: Crafted frame injection leading to form-based UI redressing.

Summary One can inject iframes into a note and create a login form that sends the user's details to a third-party server. Once again I will let the PoC do most of the explaining. PoC Paste the following snippet into a Simplenote and then view it in the preview panel. I am using the latest stable...

Automattic: [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging Electron

Hi, A carefully crafted injection in the Markdown parser within Simplenote for Windows can be leveraged to achieve remote code execution via an external JavaScript file. The nature of Simplenote's content sharing system, which makes use of tags containing email addresses, means that an adversary...

High severity vulnerability that affects electron

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line...

@fibjs/matcha (0.7.1), @kraken97/restate (>=1.1.1, <=3.0.9) +37 more potentially affected by CVE-2016-1202 via electron (>=0.1.2, <=0.4.1)

electron NPM version =0.1.2, =1.1.1, =1.0.0, =1.0.0, =1.0.1, =0.3.0, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =0.0.2 - deepin 1.0.6 and more Source cves: CVE-2016-1202 Source advisory: OSV:GHSA-GVCJ-PFQ2-WXJ7...

Remote Code Execution

Electron is vulnerable to remote code execution RCE attacks. These attacks affect all Electron apps which access remote content, this includes applications using the sandbox option...

BloodHound - Six Degrees of Domain Admin

BloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a PowerShell ingestor. BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attacks can...

Remote Code Execution (RCE)

Electron.js is vulnerable to remote code execution RCE. Github Electron has nodeIntegration enabled by default allowing Javascript to access operating system primitives. This affects all applications that bundle Electron...

GitHub Electron nodeIntegration Bypass Vulnerability

GitHub Electron is an open source framework for building desktop applications using HTML, CSS and JavaScript. A bypass vulnerability exists in GitHub Electron nodeIntegration. Allows an attacker to perform remote command execution...

Android Remote Administration Tool: AhMyth

Android Remote Administration Tool AhMyth consists of two parts : Server side : desktop application based on electron framework control panel Client side : android application backdoor Getting Started From source code Prerequisite : Electron to start the app Java to generate apk backdoor...

CVE-2017-12581

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...

Design/Logic Flaw

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...

CVE-2017-12581

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...

CVE-2017-12581

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...

CVE-2017-12581

CVE-2017-12581 affects GitHub Electron before 1.6.8, where a nodeIntegration bypass can bypass the Same Origin Policy and allow remote command execution. A privileged chrome-devtools:// URL could eval Node.js primitives (e.g., child_process.execFile), enabling OS commands on the user’s host. The ...

CVE-2017-12581: Improper Neutralization of Special Elements used in an OS Command

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...

ASTo - An IoT Network Security Analysis Tool and Visualizer

ASTo is security analysis tool for IoT networks. It is developed to support the Apparatus security framework. ASTo is based on electron and cytoscape.js. The icons are provided by Google's Material Design. The application is still in prototyping stage, which means a lot of functionality is being...

AhMyth Android RAT - Android Remote Administration Tool

AhMyth Android RAT is an Android Remote Administration Tool Beta Version It consists of two parts: Server side: desktop application based on electron framework control panel Client side: Android application backdoor Getting Started From source code Prerequisite : Electron to start the app Java to...

IoT Network Security Analysis Tool: ASTo

IoT Network Security Analysis Tool Apparatus is a security framework to facilitate security analysis in IoT systems. To make the usage of the Apparatus framework easier the ASTo app was created ASTo stands for Apparatus Software Tool. ASTo is based on electron and cytoscape.js . The application i...