Design/Logic Flaw

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution because nodeIntegration in webPreferences is true...

CVE-2020-35717: Improper Neutralization of Input During Web Page Generation

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution because nodeIntegration in webPreferences is true...

CVE-2020-16608

Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-16608: Improper Neutralization of Input During Web Page Generation

Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

PlayStation: Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application

Summary The PlayStation Now application version 11.0.2 is vulnerable to remote code execution RCE. Any website loaded in any browser on the same machine can run arbitrary code on the machine through a vulnerable websocket connection. 1. The local websocket server at localhost:1235 does not check...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548: Improper Neutralization of Input During Web Page Generation

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

@felixrieseberg/electron-prebuilt-compile (>=2.0.0-beta.1, <=2.0.7), @ngx-electron/cli (>=0.0.3, <=0.0.10) +22 more potentially affected by CVE-2018-15685 via electron (>=2.0.0, <=2.0.7)

electron NPM version =2.0.0, =2.0.0-beta.1, =0.0.3, =0.0.2, =0.0.1, =0.0.1, =2.1.0, =0.0.4, =2.0.0-beta.1, =0.0.10, =19.1.0, =19.3.1 and more Source cves: CVE-2018-15685 Source advisory: OSV:GHSA-HV9C-QWQG-QJ3V...

CVE-2018-1000536

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

CVE-2018-1000536

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

Cross site scripting

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

CVE-2018-1000536

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

CVE-2018-1000534

Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here...

CVE-2018-1000536: Improper Neutralization of Input During Web Page Generation

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of th...

CVE-2018-1000534: Improper Neutralization of Input During Web Page Generation

Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here...

Electron NodeIntegration Remote Code Execution (CVE-2018-1000136)

A remote code execution vulnerability exists in Electron. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

@ftnk/electron-prebuilt-compile (1.7.3), @quarks/bpmn-extension (1.0.0) +67 more potentially affected by CVE-2018-1000136 via electron (>=1.7.0, <=1.7.12)

electron NPM version =1.7.0, =1.0.0, =1.0.1, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.1, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.4.0-next.ff386514 and...

Remote Code Execution (RCE)

Electron.js is vulnerable to remote code execution RCE. Github Electron has nodeIntegration enabled by default allowing Javascript to access operating system primitives. This affects all applications that bundle Electron...