CVE-2024-29900

HIGH Year: 2024
CVSS v3 Score
7.5
High
Weakness Type
CWE-402
View all →

Vulnerability Description

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

Related Vulnerabilities

CVE-2021-23263

HIGH
CVSS:7.5(High)

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

CWE-4022021

CVE-2021-31407

HIGH
CVSS:7.5(High)

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application c...

CWE-4022021

CVE-2021-31410

HIGH
CVSS:7.5(High)

Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request.

CWE-4022021

CVE-2022-3596

HIGH
CVSS:7.5(High)

An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leadi...

CWE-4022022

CVE-2023-34467

HIGH
CVSS:7.5(High)

XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account...

CWE-4022023

CVE-2025-32360

HIGH
CVSS:8.1(High)

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared dra...

CWE-4022025