Evernote for Windows patch resolves stored XSS vulnerability

guest · Nov 6, 2018

Evernote for Windows patch resolves stored XSS vulnerability
The severe flaw permitted attackers to create a persistent XSS issue
November 6, 2018
https://www.zdnet.com/article/evernote-for-windows-patch-resolves-stored-xss-vulnerability/

Evernote has patched a flaw in the Microsoft Windows version of the app which permitted stored XSS attacks to occur.
The vulnerability, CVE-2018-18524, has been resolved in Evernote for Windows 6.16.1 beta

As described in a blog post last week, the cross-site scripting (XSS) issue was uncovered as local files -- including win.ini and calc.exe -- were able to be read.

Successful XSS attacks can lead to account compromise, browser hijacking, and the execution of malware payloads via exploit kits.
In Evernote's case [...] malicious files could be shared with other accounts via work chats, leading to code execution.
Click to expand...

Log in or Sign up

Evernote for Windows patch resolves stored XSS vulnerability

guest Guest

Log in or Sign up

Evernote for Windows patch resolves stored XSS vulnerability

guest Guest

Useful Searches