@dfeidao/server (>=4.5.201902251314, <=4.6.201910181238), @feidao-factory/server (>=5.0.201901071713, <=5.1.201902201403) +26 more potentially affected by CVE-2020-8129 via script-manager (>=0.2.0, <=0.8.6)

script-manager NPM version =0.2.0, =4.5.201902251314, =5.0.201901071713, =5.0.201812141540, =1.0.1-server20190117165116, =1.0.201901260938, =2.0.0, =1.6.2-patch.1, =1.0.0, =1.0.1, =1.0.0, =0.4.0, =1.1.1, =0.0.1, =1.0.1, =1.0.3 and more Source cves: CVE-2020-8129 Source advisory:...

Arbitrary File Read

jsreport-chrome-pdf is vulnerable to arbitrary file read. An attacker can send malicious requests via lib/conversion.js to read arbitrary local files...

CVE-2020-7762

This affects the package jsreport-chrome-pdf before 1.10.0...

CVE-2020-7762

This affects the package jsreport-chrome-pdf before 1.10.0...

Code injection

This affects the package jsreport-chrome-pdf before 1.10.0...

CVE-2020-7762

CVE-2020-7762 affects the package jsreport-chrome-pdf prior to version 1.10.0. The vulnerability enables an arbitrary file read via the vulnerability in the code path tied to lib/conversion.js, as documented by multiple sources (Snyk entry and GitHub advisory). Impact is: attacker can read local ...

CVE-2020-7762 Arbitrary File Read

This affects the package jsreport-chrome-pdf before 1.10.0...

CVE-2020-7762

This affects the package jsreport-chrome-pdf before 1.10.0...

@dfeidao/server (>=5.0.0, <=5.0.1), @mm-works/p000005 (>=1.0.202004231823, <=1.0.202004272011) +6 more potentially affected by CVE-2020-7762 via jsreport-chrome-pdf (>=1.0.0, <=1.9.0)

jsreport-chrome-pdf NPM version =1.0.0, =5.0.0, =1.0.202004231823, =1.0.202003051337, =1.6.2-patch.1, =2.0.0, =0.0.1, =0.0.2 - jsreport-worker 0.3.1 Source cves: CVE-2020-7762 Source advisory: SNYK:JS-JSREPORTCHROMEPDF-1037310...

Arbitrary File Read

Overview jsreport-chrome-pdf is a Affected versions of this package are vulnerable to Arbitrary File Read. An Arbitrary File Read vulnerability exists in lib/conversion.js. PoC document.writewindow.location='../../../../../etc/passwd' Remediation Upgrade jsreport-chrome-pdf to version 1.10.0 or...

@finviet-jsrpt/jsrpt-electron-pdf (>=1.0.0, <=1.0.6), @jsreport/jsreport-electron-pdf (>=4.0.0-beta.1, <=5.2.0) +18 more potentially affected by CVE-2020-8203 via lodash.pick (>=4.0.1, <=4.3.0)

lodash.pick NPM version =4.0.1, =1.0.0, =4.0.0-beta.1, =1.0.0-alpha.0, =0.1.0, =2.1.0, =1.0.0, =1.2.3, =2.3.0, =1.0.0-beta.1, =0.4.0, =0.1.0, =4.0.0-alpha.1, =4.0.0-alpha.5 and more Source cves: CVE-2020-8203 Source advisory: OSV:GHSA-P6MC-M468-83GW...

Remote Code Execution (RCE)

jsreport is vulnerable to remote code execution RCE. Of a variety of packages it consists, the Script-manager utilized for running user's scripts in a sandbox has an unintended require vulnerability and Puppeteer utilized for turning user's HTML into pdf files has SSRF Server Side Request Forgery...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

Server side request forgery (ssrf)

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

CVE-2020-8128

CVE-2020-8128 affects jsreport (

Node.js third-party modules: [jsreport] Remote Code Execution

I would like to report Remote Code Execution in jsreport It allows running js files remotely on a vulnerable server. Module module name: jsreport version: 2.5.0 npm page: https://www.npmjs.com/package/jsreport Module Description jsreport is a reporting server which lets developers define reports...