deeplabcut (>=2.1.10.3, <=2.2.0rc2), deeplabcutcore (>=0.0.0, <=0.1.0) +5 more potentially affected by CVE-2019-15939 via opencv-python-headless (>=3.4.9.33, <=4.1.0.25)

opencv-python-headless PYPI version =3.4.9.33, =2.1.10.3, =0.0.0, =0.6.1, =1.5.1, =1.0.38, =1.0.44 Source cves: CVE-2019-15939 Source advisory: MEND:CVE-2019-15939...

j5 (0.7.1), pyvisauto (1.0.1) +3 more potentially affected by CVE-2019-15939 via opencv-contrib-python-headless (>=3.4.2.17, <=4.1.0.25)

opencv-contrib-python-headless PYPI version =3.4.2.17, =1.0.2, =0.3.0, =0.6.1 Source cves: CVE-2019-15939 Source advisory: MEND:CVE-2019-15939...

Debian: Security Advisory (DLA-1886-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

deeplabcut (>=2.1.10.3, <=2.2.0rc2), deeplabcutcore (>=0.0.0, <=0.1.0) +5 more potentially affected by CVE-2019-14493 via opencv-python-headless (>=3.4.9.33, <=4.1.0.25)

opencv-python-headless PYPI version =3.4.9.33, =2.1.10.3, =0.0.0, =0.6.1, =1.5.1, =1.0.38, =1.0.44 Source cves: CVE-2019-14493 Source advisory: MEND:CVE-2019-14493...

j5 (0.7.1), pyvisauto (1.0.1) +3 more potentially affected by CVE-2019-14493 via opencv-contrib-python-headless (>=3.4.2.17, <=4.1.0.25)

opencv-contrib-python-headless PYPI version =3.4.2.17, =1.0.2, =0.3.0, =0.6.1 Source cves: CVE-2019-14493 Source advisory: MEND:CVE-2019-14493...

multi-template-matching (>=1.5.1, <=1.5.3) potentially affected by CVE-2019-14492 via opencv-python-headless (4.1.0.25)

opencv-python-headless PYPI version 4.1.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python-headless and may be impacted: - multi-template-matching =1.5.1, =1.5.3 Source cves: CVE-2019-14492 Source advisory: MEND:CVE-2019-14492...

satsense (0.9.0), ximilar-client (>=1.0.2, <=1.10.1) potentially affected by CVE-2019-14492 via opencv-contrib-python-headless (>=3.4.2.17, <=3.4.3.18)

opencv-contrib-python-headless PYPI version =3.4.2.17, =1.0.2, =1.10.1 Source cves: CVE-2019-14492 Source advisory: MEND:CVE-2019-14492...

pyvisauto (1.0.1), ximilar-client (>=1.10.2, <=1.10.12) +1 more potentially affected by CVE-2019-14492 via opencv-contrib-python-headless (>=4.0.1.24, <=4.1.0.25)

opencv-contrib-python-headless PYPI version =4.0.1.24, =1.10.2, =0.6.0, =0.6.1 Source cves: CVE-2019-14492 Source advisory: MEND:CVE-2019-14492...

multi-template-matching (>=1.5.1, <=1.5.3) potentially affected by CVE-2019-14491 via opencv-python-headless (4.1.0.25)

opencv-python-headless PYPI version 4.1.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python-headless and may be impacted: - multi-template-matching =1.5.1, =1.5.3 Source cves: CVE-2019-14491 Source advisory: MEND:CVE-2019-14491...

satsense (0.9.0), ximilar-client (>=1.0.2, <=1.10.1) potentially affected by CVE-2019-14491 via opencv-contrib-python-headless (>=3.4.2.17, <=3.4.3.18)

opencv-contrib-python-headless PYPI version =3.4.2.17, =1.0.2, =1.10.1 Source cves: CVE-2019-14491 Source advisory: MEND:CVE-2019-14491...

pyvisauto (1.0.1), ximilar-client (>=1.10.2, <=1.10.12) +1 more potentially affected by CVE-2019-14491 via opencv-contrib-python-headless (>=4.0.1.24, <=4.1.0.25)

opencv-contrib-python-headless PYPI version =4.0.1.24, =1.10.2, =0.6.0, =0.6.1 Source cves: CVE-2019-14491 Source advisory: MEND:CVE-2019-14491...

WS-2019-0602

In Ghost headless CMS, versions 2.2.3 through 2.20.0 are vulnerable to improper access control, due to sensitive information returned through a low privileged HTTP request. A privileged attacker can read private, public and session keys of only-admin actions...

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger...

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger this by closing the browser while running the attached poc; I'm not sure if there's a...

GHSA-G95J-P8F6-PWH4 headless-browser-lite downloads Resources over HTTP

Affected versions of headless-browser-lite insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution...

Headless Chrome: DevOps Love It, So Do Hackers, Here’s Why

Google Chrome is the most popular web browser and has been so for almost a decade. Each new version of Chrome brings new usability, security and performance features. This article focuses on the “headless mode” feature that Google released more than a year ago; and, since day one has become very...

Node.js third-party modules: Code Injection Vulnerability in zombie Package

I would like to report a code injection vulnerability in zombie. It allows crawled websites to access privileged APIs such as the file system or child process. Module module name: zombie version: 6.1.2 npm page: https://www.npmjs.com/package/zombie Module Description Insanely fast, headless...

CVE-2016-10661

phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

Man-in-the-Middle (MitM)

headless-browser-lite is vulnerable to man-in-the-middle MitM attack. This is possible because it does not prevent downloading of executables via HTTP if the attacker is on the network or positioned in between the user and the remote server. Consequently, it may potentially cause remote code...

CVE-2016-10625

headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested...