CVE-2020-10857

Zulip Desktop (Windows/macOS/Linux) has a remote code execution vulnerability in all versions before 5.0.0. The issue stems from improper use of shell.openExternal and shell.openItem with untrusted content, which can allow an attacker to execute arbitrary code on the user’s system. The Red Hat an...

CVE-2020-10857

Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution...

CVE-2020-10857: Undefined Security Weakness

Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution...

PT-2021-9176

Name of the Vulnerable Software and Affected Versions Zulip Desktop versions prior to 5.0.0 Description The issue is related to the improper use of shell.openExternal and shell.openItem with untrusted content, leading to remote code execution. Recommendations For versions prior to 5.0.0, update t...

CVE-2020-15258

In Wire before 3.20.x, shell.openExternal was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by sending messages containing links with arbitrary protocols. The victim has to interact with the link and sees the URL that is opened. The...

CVE-2020-15258 Insecure use of shell.openExternal in Wire

In Wire before 3.20.x, shell.openExternal was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by sending messages containing links with arbitrary protocols. The victim has to interact with the link and sees the URL that is opened. The...

CVE-2020-15258: Improper Input Validation

In Wire before 3.20.x, shell.openExternal was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by sending messages containing links with arbitrary protocols. The victim has to interact with the link and sees the URL that is opened. The...

CVE-2020-25019

jitsi-meet-electron aka Jitsi Meet Electron before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...

CVE-2020-25019

CVE-2020-25019 affects jitsi-meet-electron (Jitsi Meet Electron) up to version 2.3.0. The vulnerability arises when the Electron shell.openExternal function is invoked without verifying that the target URL is http or https, in certain circumstances. Impact details are not fully elaborated in the ...

CVE-2020-25019

jitsi-meet-electron aka Jitsi Meet Electron before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...

CVE-2020-25019

jitsi-meet-electron aka Jitsi Meet Electron before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...

CVE-2020-25019: Insufficient Verification of Data Authenticity

jitsi-meet-electron aka Jitsi Meet Electron before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...

PT-2020-15894

Name of the Vulnerable Software and Affected Versions jitsi-meet-electron versions prior to 2.3.0 Description The issue arises when the Electron shell.openExternal function is called without verifying that the URL is for an http or https resource, under certain circumstances. Recommendations For...

Automattic: Remote Code Execution in Wordpress Desktop

An attacker can create a malicious page that when viewed or edited in Wordpress Desktop App will results in remote code execution. This issue looks to be around this line of code: https://github.com/Automattic/wp-desktop/blob/develop/desktop/window-handlers/external-links/index.jsL38 If...