WP Coder < 2.5.3 - Code Deletion via CSRF

The plugin does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=wp-coder=del=1...

WP Coder < 2.5.3 - Code Deletion via CSRF

The plugin does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack https://example.com/wp-admin/admin.php?page=wp-coder&info=del&did=1...

WordPress WP Coder plugin <= 2.5.2 - Code Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Code Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof Zając in WordPress WP Coder plugin versions = 2.5.2. Solution Update the WordPress WP Coder plugin to the latest available version at least 2.5.3...

graphicsmagick:coder_BIGTIFF_fuzzer: Use-of-uninitialized-value in AccumulateRGB

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5331310461190144 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderBIGTIFFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-valu...

graphicsmagick:coder_BIGTIFF_fuzzer: Use-of-uninitialized-value in AssociateAlphaRegion

Detailed Report: https://oss-fuzz.com/testcase?key=4770230422863872 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderBIGTIFFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: AssociateAlphaRegion...

A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in TCellOwner and TLCellOwner, giving unsound access to cell memory. This could take the form of getting two mutable references to the same memory, or ...

GHSA-9C9F-7X9P-4WQP A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in TCellOwner and TLCellOwner, giving unsound access to cell memory. This could take the form of getting two mutable references to the same memory, or ...

DEBIAN-CVE-2022-32545

A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior...

UBUNTU-CVE-2022-32546

A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior...

Imagemagick Studio ImageMagick Input Validation Vulnerability

Imagemagick Studio ImageMagick is a suite of open-source image processing software from the American company Imagemagick Studio. The software can read, convert, or write images in a variety of formats. A security vulnerability exists in Imagemagick Studio ImageMagick that originates when handling...

graphicsmagick:coder_MSL_fuzzer: Heap-use-after-free in xmlParseInternalSubset

Detailed Report: https://oss-fuzz.com/testcase?key=5517147919482880 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderMSLfuzzer Job Type: libfuzzerasani386graphicsmagick Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0xf5700624 Crash State:...

CVE-2021-42648

Cross-site scripting XSS vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL...

CVE-2021-42648

Cross-site scripting XSS vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL...

CVE-2021-42648

Cross-site scripting XSS vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL...

CVE-2021-42648

Coder Code-Server is affected by a Cross-Site Scripting (XSS) vulnerability in versions before 3.12.0, exploitable via crafted URLs. Affected component: code-server frontend handling error messages; root cause: insufficient escaping of user-supplied input in error handling. Impact: arbitrary code...

CVE-2021-42648

Cross-site scripting XSS vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL...

CVE-2021-42648: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL...

PT-2022-11652

Name of the Vulnerable Software and Affected Versions Coder Code-Server versions prior to 3.12.0 Description A cross-site scripting XSS issue exists, allowing attackers to execute arbitrary code via a crafted URL. This enables the execution of malicious scripts, potentially leading to unauthorize...

graphicsmagick:coder_SVG_fuzzer: Heap-use-after-free in xmlParseInternalSubset

Detailed Report: https://oss-fuzz.com/testcase?key=4815113134145536 Project: graphicsmagick Fuzzing Engine: honggfuzz Fuzz Target: coderSVGfuzzer Job Type: honggfuzzasangraphicsmagick Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60b000000468 Crash State:...

graphicsmagick:coder_MNG_fuzzer: Use-of-uninitialized-value in ReadOnePNGImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5641595402190848 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderMNGfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...