CVE-2017-18355

CVE-2017-18355 affects Rendertron 1.0.0. The issue allows remote attackers to disclose server file paths by inspecting the '_where' attribute of package.json files in node_modules, effectively enabling absolute path disclosure. The description and connected sources consistently describe this expo...

CVE-2017-18353

Rendertron 1.0.0 exposes an unauthenticated HTTP GET endpoint at _ah/stop that shuts down the Chrome instance handling render requests. Several linked advisories (SUSe CVE entry, GHSA advisory, OSV/OSVDB) and CNVD entries confirm this route allows any unauthorized remote attacker to disable the c...

CVE-2017-18354

Rendertron 1.0.0 is affected by a Local File Inclusion (LFI) vulnerability triggered by using alternative protocols such as file://, enabling remote attackers to read arbitrary local files. Technical details on affected components, exploit vectors, and fixes are not provided in the connected docu...