15008 matches found
CVE-2022-0863 WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution...
CVE-2022-0863
The WP SVG Icons WordPress plugin (versions ≤ 3.2.3) is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded custom icon packs. An admin/high-privilege user can upload a ZIP containing malicious PHP code, leading to remote code execution. Publ...
Arbitrary Code Injection
convert-svg-core is vulnerable to arbitrary code injection. The vulnerability exists because the library does not properly remove the malicious attributes from the SVG element before being rendered, allowing an attacker to read files from the file system and show the file content as a PNG file by...
Directory Traversal
convert-svg-core is vulnerable to directory traversal. The vulnerability exists in Converter.js because the SVG tags are not properly sanitized which allows an attacker to access file directories via a specially crafted SVG file...
CVE-2022-0863: Unrestricted Upload of File with Dangerous Type
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution...
WordPress plugin WP SVG Icons code issue vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP SVG Icons plugin version 3.2.3 and prior versions contain a remote code execution...
@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24278 via convert-svg-core (>=0.3.3, <=0.5.0)
convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24278 Source advisory: OSV:GHSA-5F47-RCG5-9M24...
@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24278 via convert-svg-core (>=0.3.3, <=0.5.0)
convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24278 Source advisory: GHSA-5F47-RCG5-9M24...
Directory traversal in convert-svg-core
The package convert-svg-core before 0.6.4 is vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...
GHSA-5F47-RCG5-9M24 Directory traversal in convert-svg-core
The package convert-svg-core before 0.6.4 is vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...
GHSA-54PX-MHWV-5V8X Code injection via SVG file in convert-svg-core
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...
Code injection via SVG file in convert-svg-core
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...
@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24429 via convert-svg-core (>=0.3.3, <=0.5.0)
convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24429 Source advisory: GHSA-54PX-MHWV-5V8X...
@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24429 via convert-svg-core (>=0.3.3, <=0.5.0)
convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24429 Source advisory: OSV:GHSA-54PX-MHWV-5V8X...
CVE-2022-24429
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...
CVE-2022-24278
The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...
Code injection
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...
Directory traversal
The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...
CVE-2022-24278
The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...