MAL-2024-2906 Malicious code in @tabby.ai/qaseio-playwright-reporter (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @tabby.ai/qaseio-playwright-reporter (npm)

--- -= Per source details. Do not edit below this line.=-...

URL to PNG Security Vulnerability

URL to PNG is an application by Jason Raimondi Personal Developer. A security vulnerability exists in URL to PNG prior to version 2.0.3, which originates from the ability to read arbitrary files via a file wrapper via Playwright's screenshot feature...

CVE-2024-37169: Improper Limitation of a Pathname to a Restricted Directory

@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol http or https. ...

Arbitrary file read via Playwright's screenshot feature exploiting file wrapper

Impact All users of url-to-png. Please see https://github.com/jasonraimondi/url-to-png/issues/47 Patches v2.0.3 requires input url to be of protocol http or https Workarounds Requires upgrade. References - https://github.com/jasonraimondi/url-to-png/issues/47 -...

nl.hsac:hsac-fitnesse-plugin (1.32.11), nl.praegus:toolchain-playwright-fixture (>=1.7.0, <=1.7.13) potentially affected by CVE-2024-28125 via org.fitnesse:fitnesse (20230503)

org.fitnesse:fitnesse MAVEN version 20230503 is affected by a known vulnerability. The following packages have a transitive dependency on org.fitnesse:fitnesse and may be impacted: - nl.hsac:hsac-fitnesse-plugin 1.32.11 - nl.praegus:toolchain-playwright-fixture =1.7.0, =1.7.13 Source cves:...

nl.praegus:toolchain-playwright-fixture (>=1.7.14, <=1.9.4) potentially affected by CVE-2024-28125 via org.fitnesse:fitnesse (20240707)

org.fitnesse:fitnesse MAVEN version 20240707 is affected by a known vulnerability. The following packages have a transitive dependency on org.fitnesse:fitnesse and may be impacted: - nl.praegus:toolchain-playwright-fixture =1.7.14, =1.9.4 Source cves: CVE-2024-28125 Source advisory:...

nl.praegus:toolchain-playwright-fixture (>=1.7.14, <=1.9.4) potentially affected by CVE-2024-28125 via org.fitnesse:fitnesse (20240707)

org.fitnesse:fitnesse MAVEN version 20240707 is affected by a known vulnerability. The following packages have a transitive dependency on org.fitnesse:fitnesse and may be impacted: - nl.praegus:toolchain-playwright-fixture =1.7.14, =1.9.4 Source cves: CVE-2024-28125 Source advisory:...

Malicious code in playwright-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44aadbfa206dce3a9b475d92ce277e6db2e0b0e1d8a3781be36355ea3ad4cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in playwright-internal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8277 Malicious code in playwright-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44aadbfa206dce3a9b475d92ce277e6db2e0b0e1d8a3781be36355ea3ad4cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in playwright.dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37b4aef0ce9f3bbd5c55675cd7eb07e8f66431b0b3e1784a6b820efb3a43fd73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-test-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e546ffc456cdd216967ecffe0f0d9182e4ee1b4314653099318c5cdd533443e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6758 Malicious code in ui-test-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e546ffc456cdd216967ecffe0f0d9182e4ee1b4314653099318c5cdd533443e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...