MAL-2024-11774 Malicious code in playwright-1.47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 838a2bf47ce546affea44fb08edc2964e2c467300c9028a29fc869db92f92a23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in playwright-1.46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b54a73f91f92e3252ca7711496e9a2cc0e1eabd2637f94a2bfdce96d1a94791 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11773 Malicious code in playwright-1.46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b54a73f91f92e3252ca7711496e9a2cc0e1eabd2637f94a2bfdce96d1a94791 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11772 Malicious code in playwright-1.45 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a60a2a7e0e26a3252aaec3534c214513245613c9850f72abbdefc21de170d304 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in playwright-1.45 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a60a2a7e0e26a3252aaec3534c214513245613c9850f72abbdefc21de170d304 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in eslint-plugin-internal-playwright

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

io.github.eireglas:givwenzen (>=2.0, <=2.0.1), nl.hsac:hsac-fitnesse-fixtures (>=5.2.24, <=5.2.35) +3 more potentially affected by CVE-2024-42499 via org.fitnesse:fitnesse (20221219)

org.fitnesse:fitnesse MAVEN version 20221219 is affected by a known vulnerability. The following packages have a transitive dependency on org.fitnesse:fitnesse and may be impacted: - io.github.eireglas:givwenzen =2.0, =5.2.24, =2.0.15, =1.0, =1.6.6 Source cves: CVE-2024-42499 Source advisory:...

nl.hsac:hsac-fitnesse-plugin (1.32.11), nl.praegus:toolchain-playwright-fixture (>=1.7.0, <=1.7.13) potentially affected by CVE-2024-42499 via org.fitnesse:fitnesse (20230503)

org.fitnesse:fitnesse MAVEN version 20230503 is affected by a known vulnerability. The following packages have a transitive dependency on org.fitnesse:fitnesse and may be impacted: - nl.hsac:hsac-fitnesse-plugin 1.32.11 - nl.praegus:toolchain-playwright-fixture =1.7.0, =1.7.13 Source cves:...

nl.praegus:toolchain-playwright-fixture (>=1.7.14, <=1.9.4) potentially affected by CVE-2024-39610 via org.fitnesse:fitnesse (20240707)

org.fitnesse:fitnesse MAVEN version 20240707 is affected by a known vulnerability. The following packages have a transitive dependency on org.fitnesse:fitnesse and may be impacted: - nl.praegus:toolchain-playwright-fixture =1.7.14, =1.9.4 Source cves: CVE-2024-39610 Source advisory:...

nl.praegus:toolchain-playwright-fixture (>=1.7.14, <=1.9.4) potentially affected by CVE-2024-42499 via org.fitnesse:fitnesse (20240707)

org.fitnesse:fitnesse MAVEN version 20240707 is affected by a known vulnerability. The following packages have a transitive dependency on org.fitnesse:fitnesse and may be impacted: - nl.praegus:toolchain-playwright-fixture =1.7.14, =1.9.4 Source cves: CVE-2024-42499 Source advisory:...

Malicious code in eslint-plugin-internal-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1777e495156cf7146557c4b12278bbf9af5efe01c047f211bda8e66eb5503f8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10659 Malicious code in eslint-plugin-internal-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1777e495156cf7146557c4b12278bbf9af5efe01c047f211bda8e66eb5503f8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for CVE-2024-39700

CVE-2024-39700 Proof of Concept Repositories created using th...

CVE-2024-39919 Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an ALLOWLIST where the host can specify which services the user is permitted to capture screenshots of. By...

CVE-2024-39919 Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an ALLOWLIST where the host can specify which services the user is permitted to capture screenshots of. By...

CVE-2024-39919 Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an ALLOWLIST where the host can specify which services the user is permitted to capture screenshots of. By...

CVE-2024-39918 Path Traveral in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the ImageId in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in ...

CVE-2024-39918

CVE-2024-39918 affects @jmondi/url-to-png. The root cause is lack of sanitization in the ImageId input (extract_query_params.ts), enabling path traversal that lets an attacker store a generated PNG in arbitrary server-accessible locations. Public disclosures across NVD/Red Hat/OSV/Veracode indica...

CVE-2024-39918 Path Traveral in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the ImageId in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in ...

CVE-2024-39919: Exposure of Sensitive Information to an Unauthorized Actor

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an ALLOWLIST where the host can specify which services the user is permitted to capture screenshots of. By...