j5 (0.7.1), pyvisauto (>=1.0.1, <=1.0.3) +3 more potentially affected by CVE-2019-5064 via opencv-contrib-python-headless (>=3.4.2.17, <=4.1.2.30)

opencv-contrib-python-headless PYPI version =3.4.2.17, =1.0.1, =1.0.2, =0.3.0, =0.6.1 Source cves: CVE-2019-5064 Source advisory: MEND:CVE-2019-5064...

XSpear v1.3 - Powerfull XSS Scanning And Parameter Analysis Tool

XSpear is XSS Scanner on ruby gems Key features Pattern matching based XSS scanning Detect alert confirm prompt event on headless browser with Selenium Testing request/response for XSS protection bypass and reflectedor all params Reflected Params All paramsfor blind xss, anytings Filtered test...

Traxss - Automated XSS Vulnerability Scanner

Automated Vulnerability Scanner for XSS | Written in Python3 | Utilizes Selenium Headless Traxss is an automated framework to scan URLs and webpages for XSS Vulnerabilities. It includes over 575 Payloads to test with and multiple options for robustness of tests. View the gif above to see a previe...

deeplabcut (>=2.1.10.3, <=2.2.0rc2), deeplabcutcore (>=0.0.0, <=0.1.0) +5 more potentially affected by CVE-2019-16249 via opencv-python-headless (>=3.4.9.33, <=4.1.0.25)

opencv-python-headless PYPI version =3.4.9.33, =2.1.10.3, =0.0.0, =0.6.1, =1.5.1, =1.0.38, =1.0.44 Source cves: CVE-2019-16249 Source advisory: MEND:CVE-2019-16249...

j5 (0.7.1), pyvisauto (1.0.1) +3 more potentially affected by CVE-2019-16249 via opencv-contrib-python-headless (>=3.4.2.17, <=4.1.0.25)

opencv-contrib-python-headless PYPI version =3.4.2.17, =1.0.2, =0.3.0, =0.6.1 Source cves: CVE-2019-16249 Source advisory: MEND:CVE-2019-16249...

Debian: Security Advisory (DLA-1886-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

j5 (0.7.1), pyvisauto (1.0.1) +3 more potentially affected by CVE-2019-14493 via opencv-contrib-python-headless (>=3.4.2.17, <=4.1.0.25)

opencv-contrib-python-headless PYPI version =3.4.2.17, =1.0.2, =0.3.0, =0.6.1 Source cves: CVE-2019-14493 Source advisory: MEND:CVE-2019-14493...

pyvisauto (1.0.1), ximilar-client (>=1.10.2, <=1.10.12) +1 more potentially affected by CVE-2019-14491 via opencv-contrib-python-headless (>=4.0.1.24, <=4.1.0.25)

opencv-contrib-python-headless PYPI version =4.0.1.24, =1.10.2, =0.6.0, =0.6.1 Source cves: CVE-2019-14491 Source advisory: MEND:CVE-2019-14491...

WS-2019-0602

In Ghost headless CMS, versions 2.2.3 through 2.20.0 are vulnerable to improper access control, due to sensitive information returned through a low privileged HTTP request. A privileged attacker can read private, public and session keys of only-admin actions...

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger...

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger this by closing the browser while running the attached poc; I'm not sure if there's a...

GHSA-G95J-P8F6-PWH4 headless-browser-lite downloads Resources over HTTP

Affected versions of headless-browser-lite insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution...

Headless Chrome: DevOps Love It, So Do Hackers, Here’s Why

Google Chrome is the most popular web browser and has been so for almost a decade. Each new version of Chrome brings new usability, security and performance features. This article focuses on the “headless mode” feature that Google released more than a year ago; and, since day one has become very...

Node.js third-party modules: Code Injection Vulnerability in zombie Package

I would like to report a code injection vulnerability in zombie. It allows crawled websites to access privileged APIs such as the file system or child process. Module module name: zombie version: 6.1.2 npm page: https://www.npmjs.com/package/zombie Module Description Insanely fast, headless...

CVE-2016-10661

phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

Man-in-the-Middle (MitM)

headless-browser-lite is vulnerable to man-in-the-middle MitM attack. This is possible because it does not prevent downloading of executables via HTTP if the attacker is on the network or positioned in between the user and the remote server. Consequently, it may potentially cause remote code...

CVE-2016-10625

headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested...

CVE-2016-10625

headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested...

Remote code execution

headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested...

CVE-2016-10625

headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested...