CVSS: 6.6EPSS: 0%CPEs: 1EXPL: 1CVE-2025-23040 – Maliciously crafted remote URLs could lead to credential leak in GitHub Desktop
https://notcve.org/view.php?id=CVE-2025-23040
15 Jan 2025 — GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote whic... • https://github.com/GabrieleDattile/CVE-2025-23040 • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0849 – Leanote 2.7.0 - Local File Read
https://notcve.org/view.php?id=CVE-2024-0849
07 Feb 2024 — Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. La versión 2.7.0 de Leanote permite obtener archivos locales arbitrarios. Esto es posible porque la aplicación es vulnerable a LFR. • https://fluidattacks.com/advisories/alesso • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-73: External Control of File Name or Path •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-49314
https://notcve.org/view.php?id=CVE-2023-49314
28 Nov 2023 — Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack. Asana Desktop 2.1.0 en macOS permite la inyección de código gracias a Electron Fuses específicos. Existe una protección inadecuada contra la inyección de código a través de configuraciones como RunAsNode y EnableNodeCliInspectArguments y, ... • https://github.com/louiselalanne/CVE-2023-49314 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31647
https://notcve.org/view.php?id=CVE-2022-31647
27 Apr 2023 — Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659. • https://docs.docker.com/desktop/release-notes/#docker-desktop-460 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34292
https://notcve.org/view.php?id=CVE-2022-34292
27 Apr 2023 — Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder parameter for DockerDesktop.vhdx, a similar issue to CVE-2022-31647. • https://docs.docker.com/desktop/release-notes/#docker-desktop-460 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37326
https://notcve.org/view.php?id=CVE-2022-37326
27 Apr 2023 — Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation. • https://docs.docker.com/desktop/release-notes/#docker-desktop-460 • CWE-863: Incorrect Authorization •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38730
https://notcve.org/view.php?id=CVE-2022-38730
27 Apr 2023 — Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition. • https://docs.docker.com/desktop/release-notes/#docker-desktop-460 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40725 – PingID Desktop PIN attempt lockout bypass.
https://notcve.org/view.php?id=CVE-2022-40725
25 Apr 2023 — PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated. • https://docs.pingidentity.com/r/en-us/pingid/desktop_app_1.7.4 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-306: Missing Authentication for Critical Function •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28122
https://notcve.org/view.php?id=CVE-2023-28122
19 Apr 2023 — A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with local access to a Windows device running said application to submit arbitrary commands as SYSTEM.This vulnerability is fixed in Version 0.62.3 and later. • https://community.ui.com/releases/Security-Advisory-Bulletin-029-029/a47c68f2-1f3a-47c3-b577-eb70599644e4 • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28123
https://notcve.org/view.php?id=CVE-2023-28123
19 Apr 2023 — A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting.This vulnerability is fixed in Version 0.62.3 and later. • https://community.ui.com/releases/Security-Advisory-Bulletin-029-029/a47c68f2-1f3a-47c3-b577-eb70599644e4 • CWE-732: Incorrect Permission Assignment for Critical Resource •