CVE-2022-43984 Browsershot 3.57.3 - Server Side XSS to LFR via HTML

Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protoc...

PT-2022-27054 · Unknown · Browsershot

Name of the Vulnerable Software and Affected Versions: Browsershot version 3.57.3 Description: The issue allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to...

CVE-2022-43984

This CVE affects Browsershot 3.57.3. The issue arises because JS content imported from external sources passed to Browsershot::html may contain file:// URLs, and the application does not validate this, enabling an external attacker to remotely obtain arbitrary local files. Documents consistently ...

CVE-2022-43983

CVE-2022-43983 affects Browsershot v3.57.2. The flaw arises because HTML content passed to Browsershot::html is not validated for file:// URLs, enabling an external attacker to remotely obtain arbitrary local files. Documented impact includes high severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I...

CVE-2022-43984 Browsershot 3.57.3 - Server Side XSS to LFR via HTML

Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protoc...

CVE-2022-43983 Browsershot 3.57.2 - Server Side XSS to LFR via HTML

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol...

Spatie Browsershot 跨站脚本漏洞

Spatie Browsershot is a codebase based on Php, Javascript that converts browser pages into PDF or image formats by the Belgian Spatie team. A security vulnerability exists in Spatie Browsershot version 3.57.2, which stems from not validating the URL protocol passed to the Browsershot::url method,...

Spatie Browsershot 跨站脚本漏洞

Spatie Browsershot is a code library based on Php and Javascript that can convert a browser page into PDF or image format by the Belgian Spatie team. Spatie Browsershot version 3.57.2 there is a security vulnerability, the vulnerability stems from the application does not verify that the HTML...

CVE-2022-41706

CVE-2022-41706 affects Browsershot version 3.57.2, where the URL protocol passed to Browsershot::url is not validated. This allows an external attacker to remotely obtain arbitrary local files. The available documents describe the vulnerability and impact (remote local file access) but do not pro...

CVE-2022-41706 Browsershot 3.57.2 - Server Side XSS to LFR via URL

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

CVE-2022-43984 Browsershot 3.57.3 - Server Side XSS to LFR via HTML

Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protoc...

PT-2022-26035 · Unknown · Browsershot

Name of the Vulnerable Software and Affected Versions: Browsershot version 3.57.2 Description: The issue allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

CVE-2022-41706 Browsershot 3.57.2 - Server Side XSS to LFR via URL

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

browsershot local file inclusion vulnerability

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF...

GHSA-RV74-MH27-4JPV browsershot local file inclusion vulnerability

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF...

CVE-2020-7790

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF...

CVE-2020-7790

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF...

Code injection

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF...

CVE-2020-7790 Arbitrary File Read

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF...

CVE-2020-7790

CVE-2020-7790 affects spatie/browsershot (v0.0.0 range) where specifying a file:// URL can cause arbitrary files to be included in the resulting PDF, indicating a local-file inclusion in the rendering path. Root cause: unsanitized handling of file:// URLs enabling access to arbitrary filesystem p...