CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

Design/Logic Flaw

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

Unauthorized File Access

Overview PhantomJS is a headless WebKit scriptable with a JavaScript API. It has fast and native support for various web standards: DOM handling, CSS selector, JSON, Canvas, and SVG. Affected versions of this package are vulnerable to Unauthorized File Access. PhantomJS through 2.1.1 has an...

CVE-2019-17221

CVE-2019-17221 affects PhantomJS up to version 2.1.1. The vulnerability is an arbitrary file read in the webpage module’s page.open() function, exploitable via an XMLHttpRequest to a file:// URI. An attacker can provide a crafted HTML file as input, causing PhantomJS to read arbitrary files on th...

CVE-2019-17221

Removed by vendor...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

CVE-2019-17221: Files or Directories Accessible to External Parties

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

PT-2019-15014

Name of the Vulnerable Software and Affected Versions PhantomJS versions 2.1.1 and earlier Description The issue allows for arbitrary file read, demonstrated by an XMLHttpRequest for a file:// URI. It exists in the page.open function of the webpage module, which loads a specified URL and calls a...

Downloads Resources over HTTP in phantomjs-cheniu

Affected versions of phantomjs-cheniu insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on t...

GHSA-W364-8VFV-GVF5 Downloads Resources over HTTP in phantomjs-cheniu

Affected versions of phantomjs-cheniu insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on t...

XXRF Shots - Tool to Test SSRF Vulnerabilities

What is SSRF vulnerability? Server Side Request Forgery SSRF is a type of vulnerability class where attacker sends crafted request from a vulnerable web application, including the unauthorised access to the internal resources behind the firewall which are inaccessible directly from the external...

phantomjs-cheniu remote code execution vulnerability

phantomjs-cheniu is a headless Webkit script with JavaScript API. A security vulnerability exists in phantomjs-cheniu, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker can exploit the vulnerability by intercepting the response a...

Man-in-the-Middle (MitM)

phantomjs-cheniu is vulnerable to man-in-the-middle MitM attacks. This is because they download binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

CVE-2016-10661

phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

Remote code execution

phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

CVE-2016-10661

Summary: CVE-2016-10661 affects phantomjs-cheniu, a headless WebKit with JS API, which downloads binary resources over HTTP. The unencrypted HTTP channel enables MITM interception, allowing an attacker with network position to swap the requested binary and potentially trigger remote code executio...

CVE-2016-10661

phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

PT-2018-4839

Name of the Vulnerable Software and Affected Versions phantomjs-cheniu affected versions not specified Description The issue concerns phantomjs-cheniu, a Headless WebKit with JS API, which downloads binary resources over HTTP. This leaves it vulnerable to Man-In-The-Middle MITM attacks, potential...