An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HUipath Assistant
APPUipath21.4.4
Powiązane podatności
UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --de...
UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary user...
An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-uploa...
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and T...