CVE-2022-25759: Improper Control of Generation of Code

The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload...

PT-2022-17494

Name of the Vulnerable Software and Affected Versions convert-svg-core versions prior to 0.6.2 Description The issue allows for Remote Code Injection via sending an SVG file containing the payload. This can be achieved by including malicious code within an onload attribute in the SVG file. When...

convert-svg 代码注入漏洞

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in versions of convert-svg prior to 0.6.2, which stems from the fact that by sending SVG files containing payloads, convert-svg-core is vulnerable to remote...

[SECURITY] Fedora 35 Update: golang-github-mozillazg-pinyin-0.18.0-5.fc35

This package provides tools and Golang library to convert Chinese characters to Pinyin...

[SECURITY] Fedora 36 Update: golang-github-mozillazg-pinyin-0.19.0-4.fc36

This package provides tools and Golang library to convert Chinese characters to Pinyin...

FFmpeg rpza_decode_stream() Code Execution Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A code execution vulnerability exists in FFmpeg rpzadecodestream, which can be exploited by an attacker to trigger an out-of-bounds read memory access and execute arbitrary code on the syst...

GHSA-9FMG-89FX-R33W Quadratic blowup in Convert::xml2array()

Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...

Quadratic blowup in Convert::xml2array()

Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...

CVE-2021-41559

Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...

CVE-2021-41559

Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...

CVE-2021-41559

Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...

PT-2022-11429 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.8.1 through 4.10.9 Description: The issue is related to a quadratic blowup in the Convert::xml2array function, which can be exploited via a crafted XML document to enable a remote attack...

CVE-2021-41559: Quadratic blowup in Convert::xml2array()

More info at https://www.silverstripe.org/download/security-releases/cve-2021-41559...

Design/Logic Flaw

Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njsarrayconverttoslowarray at src/njsarray.c...

Malicious code in convert-to-asyncawait (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9786b53801afcf1eba650cb050f41322844210309a7e7d324f5c6177d830a0d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2176 Malicious code in convert-to-asyncawait (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9786b53801afcf1eba650cb050f41322844210309a7e7d324f5c6177d830a0d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-11392

Name of the Vulnerable Software and Affected Versions ok-file-formats version master 2021-9-12 Description The issue is related to a buffer overflow in the ok jpg convert data unit grayscale and ok jpg convert YCbCr to RGB functions. Recommendations For ok-file-formats version master 2021-9-12,...

Directory traversal in convert-svg-core

The package convert-svg-core before 0.6.4 is vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...

@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24278 via convert-svg-core (>=0.3.3, <=0.5.0)

convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24278 Source advisory: OSV:GHSA-5F47-RCG5-9M24...

GHSA-5F47-RCG5-9M24 Directory traversal in convert-svg-core

The package convert-svg-core before 0.6.4 is vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...