CVE-2020-26158

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration...

Design/Logic Flaw

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration...

Design/Logic Flaw

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration...

CVE-2020-26157

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration...

CVE-2020-26157

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration...

CVE-2020-26157

CVE-2020-26157 affects Leanote Desktop up to version 2.6.2. The root cause is a mishandled note title during syncing that enables cross-site scripting (XSS). This vulnerability is described as leading to remote code execution due to Node integration. The available documents do not specify a concr...

CVE-2020-26158

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration...

CVE-2020-26158

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration...

CVE-2020-26158

Leanote Desktop (up to and including 2.6.2) exposes a vulnerability where triggering the batch feature mishandles a note title, enabling a cross-site scripting (XSS) vector that can lead to remote code execution via Node integration. Root cause: improper handling of the note title within the batc...

CVE-2020-26157: Improper Neutralization of Input During Web Page Generation

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration...

CVE-2020-26158: Improper Neutralization of Input During Web Page Generation

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration...

PT-2020-16314

Name of the Vulnerable Software and Affected Versions Leanote Desktop versions 2.6.2 and earlier Description The issue arises from the mishandling of a note's title during syncing, leading to cross-site scripting XSS. This, in turn, enables remote code execution due to Node integration...

PT-2020-16315

Name of the Vulnerable Software and Affected Versions Leanote Desktop versions prior to 2.6.3 Description The issue arises from the mishandling of a note's title when the batch feature is triggered, leading to XSS. This, in turn, results in remote code execution due to Node integration...

Joplin 1.0.245 - Arbitrary Code Execution (PoC)

Exploit Title: Joplin 1.0.245 - Arbitrary Code Execution PoC Date: 2020-09-21 Exploit Author: Ademar Nowasky Junior @nowaskyjr Vendor Homepage: https://joplinapp.org/ Software Link: https://github.com/laurent22/joplin/releases/download/v1.0.245/Joplin-Setup-1.0.245.exe Version: 1.0.190 to 1.0.245...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4076 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4076 Source advisory: OSV:GHSA-M93V-9QJC-3G79...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

Code injection

European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected...

Code injection

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate...

CVE-2019-18633: Improper Certificate Validation

European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected...

CVE-2019-18632: Improper Certificate Validation

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate...