CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989

The CVE-2020-25989 entry concerns pritunl's Electron client (versions 1.0.1116.6 up to 1.2.2550.20). The issue is a privilege-escalation via arbitrary file write that may allow code execution with root privileges on the affected system. The connected documents confirm the vulnerability class and ...

CVE-2020-25989: Improper Link Resolution Before File Access

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

PT-2020-16263

Name of the Vulnerable Software and Affected Versions pritunl electron client versions 1.0.1116.6 through 1.2.2550.20 Description The issue allows for privilege escalation via arbitrary file write. Successful exploitation may enable an attacker to execute code on the affected system with root...

Basecamp: Remote Code Execution in Basecamp Windows Electron App

The Windows application for Basecamp, allows a "Download" feature for images in your posts. Under certain restrictions, those files are downloaded and sometimes even automatically opened executed. The file will be executed if it's a download from an internal URL and the mimetype is text/calendar...

Rocket.Chat: Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)

Persistent XSS flaw using nested markdown tags allows remote attacker to inject arbitrary JavaScript to message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. Patched on 3.11, 3.10.5, 3.9.7, 3.8.8...

Mark Text Cross-Site Scripting Vulnerability

Mark Text is an Electron-based Markdown editor for individual developers. A cross-site scripting vulnerability exists in Mark Text version 0.16.2, which can be exploited by an attacker to cause remote code execution...

Sandbox Restrictions Bypass

electron is vulnerable to sandbox restrictions bypass. Apps using both contextIsolation and sandbox: true/nativeWindowOpen: true/nodeIntegrationInSubFrames: true allow the code running in the main world context in the renderer to reach into the isolated electron context and perform privileged...

Top-Level Navigation Restrictions Bypass

electron allows bypass of top-level navigation restrictions. The vulnerability exists as sub-frames can bypass the top-level navigation prevention through the will-navigate event...

CVE-2020-15174

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...

CVE-2020-15174

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...

CVE-2020-15215

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass,...

CVE-2020-15215

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass,...

Code injection

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...

Design/Logic Flaw

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass,...

CVE-2020-15215 Context isolation bypass in Electron

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass,...

@dojo/cli-build-app (>=8.0.0-alpha.1, <=8.0.1), hey-you (3.0.10) +2 more potentially affected by CVE-2020-15215 via electron (10.1.1)

electron NPM version 10.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - @dojo/cli-build-app =8.0.0-alpha.1, =2.0.1, =2.0.2 - sidewinder-viewer 0.6.1 Source cves: CVE-2020-15215 Source advisory: MEND:CVE-2020-15215...

CVE-2020-15215

CVE-2020-15215 affects Electron before 11.0.0-beta.6, 10.1.2, 9.3.1, or 8.5.2. It is a context isolation bypass whereby code running in the main world context in a renderer can access the isolated Electron context when apps use both contextIsolation and sandbox: true, or contextIsolation and node...

@capacitor-community/electron-core (>=0.0.2, <=1.0.1), @felixrieseberg/electron-prebuilt-compile (>=9.0.0-beta.1, <=9.3.0) +16 more potentially affected by CVE-2020-15215 via electron (>=9.0.0-beta.1, <=9.3.0)

electron NPM version =9.0.0-beta.1, =0.0.2, =9.0.0-beta.1, =5.0.0-1, =0.8.2, =0.1.1, =0.3.218, =0.2.9, =3.0.7, =9.0.0, =1.1.52, =3.2.13, =3.1.0, =3.1.10 and more Source cves: CVE-2020-15215 Source advisory: MEND:CVE-2020-15215...