CVE-2017-1000424

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...

CVE-2017-1000424

The CVE-2017-1000424 entry concerns GitHub Electron versions 1.6.4–1.6.11 and 1.7.0–1.7.5, which are vulnerable to a URL spoofing flaw when opening PDFs in PDFium. This can result in loading arbitrary PDFs controlled by an attacker. The root cause is described as a PDFium-related URL spoofing vul...

CVE-2017-1000424

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...

CVE-2017-1000424

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...

@ftnk/electron-prebuilt-compile (1.7.3), downloadbycurl (1.0.0) +6 more potentially affected by CVE-2017-1000424 via electron (>=1.7.0, <=1.7.5)

electron NPM version =1.7.0, =1.7.0, =1.0.0, =0.0.1, =1.1.2, =1.3.2 Source cves: CVE-2017-1000424 Source advisory: MEND:CVE-2017-1000424...

CVE-2017-1000424: Undefined Security Weakness

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control...

PT-2018-5199

Name of the Vulnerable Software and Affected Versions Electron versions 1.6.4 through 1.6.11 Electron versions 1.7.0 through 1.7.5 Description The issue allows for a URL Spoofing problem when opening PDFs in PDFium, resulting in the loading of arbitrary PDFs that a hacker can control...

Automattic: Crafted frame injection leading to form-based UI redressing.

Summary One can inject iframes into a note and create a login form that sends the user's details to a third-party server. Once again I will let the PoC do most of the explaining. PoC Paste the following snippet into a Simplenote and then view it in the preview panel. I am using the latest stable...

Automattic: [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging Electron

Hi, A carefully crafted injection in the Markdown parser within Simplenote for Windows can be leveraged to achieve remote code execution via an external JavaScript file. The nature of Simplenote's content sharing system, which makes use of tags containing email addresses, means that an adversary...

High severity vulnerability that affects electron

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line...

@fibjs/matcha (0.7.1), @kraken97/restate (>=1.1.1, <=3.0.9) +37 more potentially affected by CVE-2016-1202 via electron (>=0.1.2, <=0.4.1)

electron NPM version =0.1.2, =1.1.1, =1.0.0, =1.0.0, =1.0.1, =0.3.0, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =0.0.2 - deepin 1.0.6 and more Source cves: CVE-2016-1202 Source advisory: OSV:GHSA-GVCJ-PFQ2-WXJ7...

@fibjs/matcha (0.7.1), @kraken97/restate (>=1.1.1, <=3.0.9) +37 more potentially affected by CVE-2016-1202 via electron (>=0.1.2, <=0.4.1)

electron NPM version =0.1.2, =1.1.1, =1.0.0, =1.0.0, =1.0.1, =0.3.0, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =0.0.2 - deepin 1.0.6 and more Source cves: CVE-2016-1202 Source advisory: GHSA-GVCJ-PFQ2-WXJ7...

Remote Code Execution

Electron is vulnerable to remote code execution RCE attacks. These attacks affect all Electron apps which access remote content, this includes applications using the sandbox option...

BloodHound - Six Degrees of Domain Admin

BloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a PowerShell ingestor. BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attacks can...

Remote Code Execution (RCE)

Electron.js is vulnerable to remote code execution RCE. Github Electron has nodeIntegration enabled by default allowing Javascript to access operating system primitives. This affects all applications that bundle Electron...

GitHub Electron nodeIntegration Bypass Vulnerability

GitHub Electron is an open source framework for building desktop applications using HTML, CSS and JavaScript. A bypass vulnerability exists in GitHub Electron nodeIntegration. Allows an attacker to perform remote command execution...

Android Remote Administration Tool: AhMyth

Android Remote Administration Tool AhMyth consists of two parts : Server side : desktop application based on electron framework control panel Client side : android application backdoor Getting Started From source code Prerequisite : Electron to start the app Java to generate apk backdoor...

CVE-2017-12581

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...

Design/Logic Flaw

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...

CVE-2017-12581

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...