741 matches found
PYSEC-2026-1239 changedetection.io path traversal using file URI scheme without supplying hostname
Summary The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and ALLOWFILEURI false or not defined. Details The check used for URL protocol, issafeurl, allows file: as ...
PYSEC-2026-1240 changedetection.io Path Traversal
Summary When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked Details The root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here wher...
Astra Linux – Vulnerability in Firefox
The Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user’s browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability...
Astra Linux – Vulnerability in Zabbix
The WebDriver for the Browser object expects an error object to be initialized when the webdriversessionquery function fails. However, this function can fail for various reasons without an error description. As a result, wd-error will be NULL, and attempting to access it will cause a crash...
EUVD-2025-177648
Malicious code in neptune-webdriver-manager-vuetify-boson npm...
EUVD-2025-179712
Malicious code in cli-webdriver-manager-lint-staged-auth npm...
EUVD-2025-177752
Malicious code in morgan-spectron-webdriver-primatology-aldebaran npm...
EUVD-2025-179312
Malicious code in despina-publish-spectron-webdriver-dotenv-safe npm...
EUVD-2025-175617
Malicious code in webdriver-manager-cosmos-mongoose-got npm...
EUVD-2025-175618
Malicious code in webdriver-manager-bulma-pino-pretty-hercules npm...
EUVD-2025-176542
Malicious code in sails-soap-link-webdriver-mocha npm...
EUVD-2025-178250
Malicious code in juno-areology-dorado-webdriver-mocha npm...
EUVD-2025-176261
Malicious code in spectron-webdriver-async-primatology-canopus npm...
EUVD-2025-175608
Malicious code in webdriver-mocha-apollo-server-shelljs npm...
EUVD-2025-179439
Malicious code in cygnus-umbra-webdriver-mocha-docusaurus npm...
EUVD-2025-178562
Malicious code in helios-webdriver-mocha-superposition-phylogenetics npm...
MAL-2025-189615 Malicious code in spectron-webdriver-commitlint-apollo-mysql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2f9393dc8a7a4eaa19f6f45d6cfee1f7b390f6d38c9d5c9e9a13032f53e195c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180039
Malicious code in blackhole-jupiter-spectron-webdriver-meteor npm...