bug-bounty448
google354
xss341
microsoft283
facebook246
apple171
exploit163
rce160
malware102
account-takeover95
cve91
bragging-post84
csrf83
browser77
writeup76
privilege-escalation68
react60
authentication-bypass57
cloudflare54
dos53
node52
ssrf51
docker51
phishing50
aws48
access-control47
oauth45
smart-contract45
supply-chain44
ethereum43
defi42
web342
sql-injection41
lfi37
idor35
smart-contract-vulnerability32
vulnerability-disclosure32
web-application31
burp-suite31
reverse-engineering31
clickjacking31
race-condition31
info-disclosure31
wordpress30
cloud29
input-validation29
information-disclosure29
web-security27
solidity27
cors26
0
8/10
vulnerability
GitHub Desktop on macOS allowed remote code execution via a crafted x-github-client:// URI with a malicious filepath parameter that bypassed repository directory restrictions and enabled execution of arbitrary application bundles. The vulnerability exploited Electron's shell.openExternal() function converting file paths to file:// URLs, allowing attackers to execute malicious OSX apps cloned from attacker-controlled repositories.
rce
remote-code-execution
uri-scheme-handling
path-traversal
electron
macos
osx
github-desktop
arbitrary-file-open
social-engineering
application-bundle-execution
GitHub Desktop
0xacb
HackerOne
H1-702
GitHub
Electron
CVE (unreferenced but likely assigned)
zhuowei