123 matches found
CVE-2023-23924 URI validation failure on SVG parsing in Dompdf
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing tags with uppercase letters. This may lead to arbitrary object unserialize on PHP 8, through the phar URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with...
Dompdf 代码问题漏洞
Dompdf is an HTML to PDF converter. A code issue vulnerability exists in Dompdf versions prior to 2.0.0 that stems from server-side request forgery SSRF...
Remote code injection in dompdf/dompdf
Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...
GHSA-X752-QJV4-C4HC Remote code injection in dompdf/dompdf
Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...
Remote code injection via remote fonts
Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...
The vulnerability of the PHP library for generating PDF documents from HTML markup and CSS styles, Dompdf, allows a hacker to execute arbitrary code.
The vulnerability of the PHP library for generating PDF documents from HTML markup and CSS styles, Dompdf, is related to the lack of protective measures for the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Unpatched RCE Bug in dompdf Project Affects HTML to PDF Converters
Researchers have disclosed an unpatched security vulnerability in "dompdf," a PHP-based HTML to PDF converter, that, if successfully exploited, could lead to remote code execution in certain configurations. "By injecting CSS into the data processed by dompdf, it can be tricked into storing a...
Path Traversal in lampnick/doctron
✍️ Description doctron is a golang tool that helps conversion of HTML to PDF or image. The input doesn't validate if it's a valid web URL. Trying to access local files using file:/// work. This allows getting a screenshot/PDF of the sensitive files on the system. 🕵️♂️ Proof of Concept A demo...
Server-Side Request Forgery
gotenberg is vulnerable to Server-Side Request Forgery. The vulnerability exists due to an insecure exposure of password when converting html into a PDF using the /html endpoint...
CVE-2020-14161
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...
Julien Neuhart gotenberg Code Issues Vulnerabilities
Julien Neuhart gotenberg is Julien Neuhart open source an application interface. Used to convert HTML, Markdown and Office documents to PDF. gotenberg has a security vulnerability , the vulnerability stems from the vulnerability to attacks through the /convert/html endpoint forged server-side...
@dfeidao/server (>=4.5.201902251312, <=4.6.201910181238), @fabrix/spool-pdf (>=1.5.0-alpha.1, <=1.5.0) +27 more potentially affected by CVE-2020-7763 via phantom-html-to-pdf (>=0.1.2, <=0.6.1)
phantom-html-to-pdf NPM version =0.1.2, =4.5.201902251312, =1.5.0-alpha.1, =5.0.201901071713, =5.0.201812141540, =1.0.1-server20190117165116, =1.0.201901260938, =1.0.0, =1.0.0, =3.0.0-beta.1, =3.0.0-beta.1, =2.0.0, =1.0.202005312012, =1.0.3, =1.0.7, =1.6.8 and more Source cves: CVE-2020-7763 Sour...
Arbitrary File Read in phantom-html-to-pdf
This affects the package phantom-html-to-pdf before 0.6.1. PoC js var fs = require'fs' var conversion = require"phantom-html-to-pdf"; conversion.allowLocalFilesAccess = false conversion html: "document.writewindow.location='c:/windows/win.ini'" , functionerr, pdf var output =...
GHSA-6H7F-QWQM-35PP Arbitrary File Read in phantom-html-to-pdf
This affects the package phantom-html-to-pdf before 0.6.1. PoC js var fs = require'fs' var conversion = require"phantom-html-to-pdf"; conversion.allowLocalFilesAccess = false conversion html: "document.writewindow.location='c:/windows/win.ini'" , functionerr, pdf var output =...
Arbitrary File Read
phantom-html-to-pdf is vulnerable to arbitrary file read. An attacker is able to gain access and read arbitrary files on the host by specifying the file path...
CVE-2020-7763
This affects the package phantom-html-to-pdf before 0.6.1...
CVE-2020-7763
This affects the package phantom-html-to-pdf before 0.6.1...
Design/Logic Flaw
This affects the package phantom-html-to-pdf before 0.6.1...
CVE-2020-7763
CVE-2020-7763 affects the npm package phantom-html-to-pdf and is an arbitrary file read vulnerability present in versions before 0.6.1. The weakness is demonstrated by a PoC (in the GitHub advisory and Snyk reference) that bypasses file access restrictions to read local host files (e.g., using wi...
