Server-Side Request Forgery

gotenberg is vulnerable to Server-Side Request Forgery. The vulnerability exists due to an insecure exposure of password when converting html into a PDF using the /html endpoint...

CVE-2020-14161

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

CVE-2020-14161: Improper Neutralization of Input During Web Page Generation

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

Julien Neuhart gotenberg Code Issues Vulnerabilities

Julien Neuhart gotenberg is Julien Neuhart open source an application interface. Used to convert HTML, Markdown and Office documents to PDF. gotenberg has a security vulnerability , the vulnerability stems from the vulnerability to attacks through the /convert/html endpoint forged server-side...

@dfeidao/server (>=4.5.201902251312, <=4.6.201910181238), @fabrix/spool-pdf (>=1.5.0-alpha.1, <=1.5.0) +27 more potentially affected by CVE-2020-7763 via phantom-html-to-pdf (>=0.1.2, <=0.6.1)

phantom-html-to-pdf NPM version =0.1.2, =4.5.201902251312, =1.5.0-alpha.1, =5.0.201901071713, =5.0.201812141540, =1.0.1-server20190117165116, =1.0.201901260938, =1.0.0, =1.0.0, =3.0.0-beta.1, =3.0.0-beta.1, =2.0.0, =1.0.202005312012, =1.0.3, =1.0.7, =1.6.8 and more Source cves: CVE-2020-7763 Sour...

Arbitrary File Read in phantom-html-to-pdf

This affects the package phantom-html-to-pdf before 0.6.1. PoC js var fs = require'fs' var conversion = require"phantom-html-to-pdf"; conversion.allowLocalFilesAccess = false conversion html: "document.writewindow.location='c:/windows/win.ini'" , functionerr, pdf var output =...

GHSA-6H7F-QWQM-35PP Arbitrary File Read in phantom-html-to-pdf

This affects the package phantom-html-to-pdf before 0.6.1. PoC js var fs = require'fs' var conversion = require"phantom-html-to-pdf"; conversion.allowLocalFilesAccess = false conversion html: "document.writewindow.location='c:/windows/win.ini'" , functionerr, pdf var output =...

Arbitrary File Read

phantom-html-to-pdf is vulnerable to arbitrary file read. An attacker is able to gain access and read arbitrary files on the host by specifying the file path...

CVE-2020-7763

This affects the package phantom-html-to-pdf before 0.6.1...

CVE-2020-7763

This affects the package phantom-html-to-pdf before 0.6.1...

Design/Logic Flaw

This affects the package phantom-html-to-pdf before 0.6.1...

CVE-2020-7763

CVE-2020-7763 affects the npm package phantom-html-to-pdf and is an arbitrary file read vulnerability present in versions before 0.6.1. The weakness is demonstrated by a PoC (in the GitHub advisory and Snyk reference) that bypasses file access restrictions to read local host files (e.g., using wi...

CVE-2020-7763 Arbitrary File Read

This affects the package phantom-html-to-pdf before 0.6.1...

CVE-2020-7763: Improper Limitation of a Pathname to a Restricted Directory

This affects the package phantom-html-to-pdf before 0.6.1...

@dfeidao/server (>=4.5.201902251314, <=4.6.201910181238), @fabrix/spool-pdf (>=1.5.0-alpha.1, <=1.5.0) +23 more potentially affected by CVE-2020-7763 via phantom-html-to-pdf (>=0.1.2, <=0.6.0)

phantom-html-to-pdf NPM version =0.1.2, =4.5.201902251314, =1.5.0-alpha.1, =5.0.201901071713, =5.0.201812141540, =1.0.1-server20190117165116, =1.0.201901260938, =2.0.0, =1.0.202005312012, =1.0.3, =0.1.0, =0.4.0, =1.0.1, =1.0.3 - jsreport-fop-xsl-pdf 1.0.4 and more Source cves: CVE-2020-7763 Sourc...

Server-Side Request Forgery (SSRF)

Overview node-pdf-generator is a Web server to generate PDF's from HTML Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to...

Path Traversal in marcbachmann/node-html-pdf

Overview html-pdf is a Html to pdf converter in Node.js, this package is vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input...

CVE-2020-8853

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-8853

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...