@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24278 via convert-svg-core (>=0.3.3, <=0.5.0)

convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24278 Source advisory: MEND:CVE-2022-24278...

CVE-2022-24278

The CVE-2022-24278 entry concerns convert-svg-core

CVE-2022-24278 Directory Traversal

The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...

CVE-2022-24278 Directory Traversal

The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...

CVE-2022-24429

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24429 via convert-svg-core (>=0.3.3, <=0.5.0)

convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24429 Source advisory: MEND:CVE-2022-24429...

CVE-2022-24429

The CVE-2022-24429 entry concerns convert-svg-core before 0.6.3, which is vulnerable to Arbitrary Code Injection via a specially crafted SVG file. Affected component is the SVG-to-PNG rendering flow; root cause involves improper handling/removal of malicious SVG attributes, enabling an attacker t...

CVE-2022-24429 Arbitrary Code Injection

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

CVE-2022-24429 Arbitrary Code Injection

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

CVE-2022-24429

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

convert-svg code injection vulnerability

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in versions of convert-svg prior to 0.6.3, which stems from the use of specially crafted SVG files that can read arbitrary files from the file system and the...

convert-svg path traversal vulnerability

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in versions of convert-svg prior to 0.6.4 that stems from improper cleaning of SVG tags...

CVE-2022-24278: Improper Limitation of a Pathname to a Restricted Directory

The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...

PT-2022-16690

Name of the Vulnerable Software and Affected Versions convert-svg-core versions prior to 0.6.3 Description The issue allows for Arbitrary Code Injection when a specially crafted SVG file is used. An attacker can read arbitrary files from the file system and then display the file content as a...

CVE-2022-24429: Improper Control of Generation of Code

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

PT-2022-16578

Name of the Vulnerable Software and Affected Versions convert-svg-core versions prior to 0.6.4 Description The issue arises from improper sanitization of SVG tags, allowing for Directory Traversal attacks. This can be exploited by using a specially crafted SVG file. Recommendations For versions...

CLSA-2022-1654802345 Fix CVE(s): CVE-2022-28463, CVE-2020-27760

SECURITY UPDATE: Division by zero - debian/patches/CVE-2020-27760.patch: Fix divisions by zeros in magick/enhance.c - CVE-2020-27760 SECURITY UPDATE: Heap-based buffer overflow - debian/patches/CVE-2022-28463.patch: Fix buffer overflow - CVE-2022-28463 Fix several issues with undefined behavior: ...

Mattermost Resource Management Error Vulnerability (CNVD-2022-65349)

Mattermost is an open source collaboration platform from Mattermost, Inc. A resource management error vulnerability exists in versions prior to Mattermost 6.6.0, which stems from uncontrolled consumption of resources and can be exploited by an attacker to crash the server via a specially crafted...

@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-24278 via convert-svg-core (>=0.3.3, <=0.5.0)

convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-24278 Source advisory: SNYK:JS-CONVERTSVGCORE-2859830...

Directory Traversal

Overview convert-svg-core is a package that supports converting SVG into another format using headless Chromium. Affected versions of this package are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted...