CVE-2022-44268

CVE-2022-44268 This repository contains a Proof of Concept POC for a vulnerability in ImageMagick v. 7.1.0-49, a widely used open-source image manipulation library. The vulnerability allows an attacker to embed the content of an arbitrary file into a resized image when ImageMagick parses a PNG...

ImageMagick 7.1.0-49 PNG Text Chunk Arbitrary File Read

ImageMagick version 7.1.0-49 contains an arbitrary file disclosure vulnerability through a crafted PNG tEXt chunk. This proof of concept generates a PNG that requests a target file and parses the resulting image to recover its contents. https://packetstorm.news/download/235007...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick

ImageMagick PNG Text Chunk Arbitrary File Read CVE-2022-44268...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng12 (UTSA-2026-093167)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093167 advisory. The pngsettext2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to caus...

Azure Linux 3.0 Security Update: fltk (CVE-2016-10087)

The version of fltk installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2016-10087 advisory. - The pngsettext2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before...

SUSE CVE-2014-9601

Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed...

Exiv2 Denial of Service Vulnerability (CNVD-2018-18043)

Exiv2 is a set of C++ libraries and command line applications for managing image metadata by software developer Andreas Huggel, which provides for reading and writing image metadata in a variety of formats including EXIF, IPTC and XMP. A security vulnerability exists in the...

CVE-2018-13832: Improper Neutralization of Input During Web Page Generation

Multiple Persistent cross-site scripting XSS issues in the Techotronic all-in-one-favicon aka All In One Favicon plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text...

PT-2018-12212

Name of the Vulnerable Software and Affected Versions All In One Favicon plugin version 4.6 Description The issue concerns multiple persistent cross-site scripting XSS problems. Remote attackers can inject arbitrary web script or HTML via specific text fields, including Apple-Text, GIF-Text,...

CVE-2011-3048

The pngsettext2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocati...