Vulnerabilities > Thecodingmachine
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-08-26 | CVE-2020-14160 | Server-Side Request Forgery (SSRF) vulnerability in Thecodingmachine Gotenberg An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources. | 5.0 |
| 2021-08-26 | CVE-2020-14161 | Cross-site Scripting vulnerability in Thecodingmachine Gotenberg It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint. | 4.3 |
| 2021-02-26 | CVE-2021-23345 | Server-Side Request Forgery (SSRF) vulnerability in Thecodingmachine Gotenberg All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>. | 5.0 |
| 2021-01-07 | CVE-2020-13452 | Incorrect Default Permissions vulnerability in Thecodingmachine Gotenberg In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution. | 7.5 |
| 2021-01-07 | CVE-2020-13451 | Incomplete Cleanup vulnerability in Thecodingmachine Gotenberg An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros. | 7.5 |
| 2021-01-07 | CVE-2020-13450 | Path Traversal vulnerability in Thecodingmachine Gotenberg A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. | 7.5 |
| 2021-01-07 | CVE-2020-13449 | Path Traversal vulnerability in Thecodingmachine Gotenberg A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files. | 5.0 |