CVE-2017-18355: Exposure of Sensitive Information to an Unauthorized Actor

Installed packages are exposed by nodemodules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "where" attribute of package.json files...

CVE-2017-18353: Undefined Security Weakness

Rendertron 1.0.0 includes an ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application...

CVE-2017-18352: Improper Neutralization of Input During Web Page Generation

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...

PT-2018-6847

Name of the Vulnerable Software and Affected Versions: Rendertron version 1.0.0 Description: The issue allows for reflected Cross Site Scripting XSS from invalid URLs due to error reporting. Recommendations: For Rendertron version 1.0.0, update to a version that fixes the error reporting issue to...

Rendertron Absolute Path Disclosure Vulnerability

Rendertron is Google's open source Chrome rendering solution designed to instantly render web pages. Rendertron 1.0.0 suffers from an absolute path disclosure vulnerability, which stems from nodemodules in Rendertron exposing installed packages, which can be exploited by a remote attacker to read...

Rendertron Local File Inclusion Vulnerability

Rendertron is Google's open source Chrome rendering solution designed to instantly render web pages. Rendertron 1.0.0 suffers from a local file inclusion vulnerability that can be exploited by remote attackers to read arbitrary files via an alternate protocol...

CVE-2017-18354: Improper Limitation of a Pathname to a Restricted Directory

Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion LFI bug where arbitrary files can be read by a remote attacker...

PT-2018-6848

Name of the Vulnerable Software and Affected Versions: Rendertron version 1.0.0 Description: The issue allows any unauthorized remote attacker to disable the core service of the application by visiting the " ah/stop" API endpoint with a GET request. This endpoint is used to shutdown the Chrome...

PT-2018-6850

Name of the Vulnerable Software and Affected Versions: Rendertron version 1.0.0 Description: The issue allows remote attackers to read absolute paths on the server by examining the where attribute of package.json files in the node modules directory. Recommendations: For Rendertron version 1.0.0,...

PT-2018-6849

Name of the Vulnerable Software and Affected Versions: Rendertron version 1.0.0 Description: The issue allows for the use of alternative protocols, such as file://, which introduces a Local File Inclusion bug. This enables a remote attacker to read arbitrary files. Recommendations: For Rendertron...