54 matches found
Rendertron Code Issues Vulnerabilities
Martin Splitt Rendertron is a GlobalMartin Splitt open source application providing a headless Chrome rendering solution designed to instantly render and serialize web pages. A code issue vulnerability exists in Rendertron versions prior to 3.0.0, which can be exploited by an attacker to force a...
GHSA-VQMR-957G-R7W3 Rendertron discloses absolute paths of files
Installed packages are exposed by nodemodules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "where" attribute of package.json files...
Rendertron discloses absolute paths of files
Installed packages are exposed by nodemodules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "where" attribute of package.json files...
GHSA-J88M-953W-8R2C rendertron XSS vulnerability
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...
rendertron XSS vulnerability
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...
rendertron LFI vulnerability
Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion LFI bug where arbitrary files can be read by a remote attacker...
GHSA-J87C-CJ65-VMH5 rendertron LFI vulnerability
Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion LFI bug where arbitrary files can be read by a remote attacker...
GHSA-4Q69-Q4Q7-X82C rendertron can remotely shut down Chrome instance
Rendertron 1.0.0 includes an ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application...
rendertron can remotely shut down Chrome instance
Rendertron 1.0.0 includes an ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application...
Rendertron Security Vulnerability
Rendertron is a Chrome rendering solution. The product focuses on on-the-fly rendering and serialization of web pages. A security vulnerability exists in Rendertron version 1.0.0, which can be exploited by remote attackers to disable the application's core services...
Local File Inclusion (LFI)
rendertron is vulnerable to local file inclusion LFI attacks. The vulnerability exists due to the ability to include file:/// via alternative protocols which allows unauthenticated users to read local files...
Cross-Site Scripting (XSS)
rendertron is vulnerable to cross-site scripting XSS. The vulnerability exists since the application not sanitize URLs and other parameters of the error reporting feature, allowing a remote attacker to inject arbitrary Javascript into a victim's browser...
CVE-2017-18355
Installed packages are exposed by nodemodules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "where" attribute of package.json files...
Code injection
Installed packages are exposed by nodemodules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "where" attribute of package.json files...
CVE-2017-18353
Rendertron 1.0.0 includes an ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application...
CVE-2017-18352
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...
Design/Logic Flaw
Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion LFI bug where arbitrary files can be read by a remote attacker...
Design/Logic Flaw
Rendertron 1.0.0 includes an ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application...
CVE-2017-18353
Rendertron 1.0.0 includes an ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application...