Server side request forgery (ssrf)

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...

CVE-2020-7739

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...

CVE-2020-7739

CVE-2020-7739 affects all versions of phantomjs-seo. The vulnerability allows an attacker to craft a URL that is passed to a PhantomJS instance, enabling Server-Side Request Forgery (SSRF). The connected sources (OSV, GHSA, NVD, UBUNTU-CVE, Veracode, etc.) consistently describe an SSRF condition ...

CVE-2020-7739 Server-side Request Forgery (SSRF)

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...

CVE-2020-7739

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...

CVE-2020-7739: Server-Side Request Forgery (SSRF)

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...

Server-side Request Forgery (SSRF)

Overview phantomjs-seo is an express middleware for prerendering pages with phantomjs for search engine crawling Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing...

openSUSE Security Update : grafana / grafana-piechart-panel / grafana-status-panel (openSUSE-2020-892)

This update for grafana, grafana-piechart-panel, grafana-status-panel fixes the following issues : grafana was updated to version 7.0.3 : - Features / Enhancements - Stats: include all fields. 24829, @ryantxu - Variables: change VariableEditorList row action Icon to IconButton. 25217, @hshoff - B...

Cross-site Scripting (XSS)

svg2png is vulnerable to cross-site scripting XSS. The attack exists because it renders XML snippet using phantomjs directly into an image without sanitizing it, allowing an attacker to inject arbitrary script inside SVG document...

Arbitrary File Read

html-pdf is vulnerable to arbitrary file read. An attacker is able to view local files by sending an XMLHttpRequest to fetch the contents and writing it into the HTML document during conversion of a file from HTML to PDF. This is due to using an emulated scriptable headless browser known as...

PlayStation: SSRF chained to hit internal host leading to another SSRF which allows to read internal images.

Report Summary: We found an SSRF at https://image.api.np.km.playstation.net/ Vulnerable endpoints: /images , /dis/images. using image GET parameter. Description This endpoint allows us to fetch a remote image over HTTP protocol using the image GET parameter and convert them to the desired format...

Paessler PRTG Network Monitor Access Control Error Vulnerability

Paessler PRTG Network Monitor is a full-featured network monitoring and management software from the German company Paessler. A security vulnerability exists in PRTG Network Monitor version 19.1.49 and prior versions, which stems from the program failing to perform sufficient cleanup operations...

CVE-2019-11074

A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYSTEM privileges although not controlling the contents of such files due to insufficient sanitisation when passing arguments to th...

Design/Logic Flaw

A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYSTEM privileges although not controlling the contents of such files due to insufficient sanitisation when passing arguments to th...

PhantomJS Arbitrary File Read Vulnerability

PhantomJS is a headless browser for automating web interactions. A security vulnerability exists in the 'page.open' function of the web module in PhantomJS 2.1.1 and earlier versions. The vulnerability can be exploited by an attacker to read arbitrary files on the file system with the help of...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

Unauthorized File Access

Overview PhantomJS is a headless WebKit scriptable with a JavaScript API. It has fast and native support for various web standards: DOM handling, CSS selector, JSON, Canvas, and SVG. Affected versions of this package are vulnerable to Unauthorized File Access. PhantomJS through 2.1.1 has an...

Design/Logic Flaw

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...