CVE-2020-14161

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

CVE-2020-13449

A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files...

CVE-2020-13452

In Gotenberg through 6.2.1, insecure permissions for tini writable by user gotenberg potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution...

CVE-2024-21527

Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-si...

Server-Side Request Forgery (SSRF)

github.com/gotenberg/gotenberg/v8 is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper handling of requests made to the /convert/html endpoint, allowing attackers to exploit local file inclusion by referencing localhost files such as...

GO-2024-2996 CVE-2024-21527 in github.com/gotenberg/gotenberg

CVE-2024-21527 in github.com/gotenberg/gotenberg...

CVE-2024-21527

CVE-2024-21527 affects github.com/gotenberg/gotenberg/v8/pkg/gotenberg, v8/pkg/modules/chromium, and v8/pkg/modules/webhook prior to 8.1.0. The issue is Server-side Request Forgery (SSRF) via the /convert/html endpoint when a request targets a localhost file, enabling local file inclusion and acc...

CVE-2024-40639

Rejected reason: This CVE is a duplicate of another CVE...

CVE-2024-40639

This CVE entry is rejected/not used; it does not represent an active vulnerability.

CVE-2024-40639

...

CVE-2024-40639

...

CVE-2024-24792 vulnerabilities

Vulnerabilities for packages: hugo, hugo-extended, chainctl, gotenberg, ollama...

GHSA-9PHM-FM57-RHG8 vulnerabilities

Vulnerabilities for packages: hugo, hugo-extended, chainctl, gotenberg, ollama...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, litefs, secrets-store-csi-driver, dynamic-localpv-provisioner-fips, wave-fips, sops, fulcio, secrets-store-csi-driver-provider-gcp, prometheus-redis-exporter-fips, crossplane-provider-aws, kind, shfmt, prometheus-node-exporter-fips, runc,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when a request is made to a file via localhost, such as . By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read o...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when a request is made to a file via localhost, such as . By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read o...

Server-Side Request Forgery

gotenberg is vulnerable to Server-Side Request Forgery. The vulnerability exists due to an insecure exposure of password when converting html into a PDF using the /html endpoint...

CVE-2020-14161

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

CVE-2020-14161

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

CVE-2020-14160

An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources...