Linux Distros Unpatched Vulnerability : CVE-2019-13111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service large heap allocation followed by a very long...

Malicious code in @aoflmkt/is-webp-qualified (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1686 Malicious code in @aoflmkt/is-webp-qualified (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-12060: Improper Neutralization of Input During Web Page Generation

The WP Media Optimizer .webp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpmowebp-css-resources’ and 'wpmowebp-js-resources' parameters in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible...

SUSE CVE-2024-53863

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

DEBIAN-CVE-2024-53863

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

USN-7112-1 libgd2 vulnerability

It was discovered that the GD Graphics Library did not perform proper bounds checking while handling BMP and WebP files. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service application crash...

USN-7112-1: GD Graphics Library vulnerability

It was discovered that the GD Graphics Library did not perform proper bounds checking while handling BMP and WebP files. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service application crash...

CVE-2024-9361: Missing Authorization

The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveconfiguration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticate...

NewStart CGSL MAIN 6.02 : libwebp Multiple Vulnerabilities (NS-SA-2024-0067)

The remote NewStart CGSL host, running version MAIN 6.02, has libwebp packages installed that are affected by multiple vulnerabilities: - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863. CVE-2023-5129 - Heap buffer overflow in...

RUSTSEC-2024-0443 webp crate may expose memory contents when encoding an image

Affected versions of this crate did not check that the input slice passed to "webp::Encoder::encode is large enough for the specified image dimensions. If the input slice is too short, the library will read out of bounds of the buffer and encode other memory contents as an image, resulting in...

amaryllis (0.1.0), archivist (0.0.1) +26 more potentially affected by unknown CVE via webp (>=0.1.3, <=0.2.6)

webp CARGO version =0.1.3, =0.1.0, =0.0.4-alpha, =0.24.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.21.0, =0.21.0, =0.21.0, =0.21.0, =0.22.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0443...

webp crate may expose memory contents when encoding an image

Affected versions of this crate did not check that the input slice passed to "webp::Encoder::encode is large enough for the specified image dimensions. If the input slice is too short, the library will read out of bounds of the buffer and encode other memory contents as an image, resulting in...

PT-2024-41506

Affected versions of this crate did not check that the input slice passed to "webp::Encoder::encode is large enough for the specified image dimensions. If the input slice is too short, the library will read out of bounds of the buffer and encode other memory contents as an image, resulting in...

ffmpeg:ffmpeg_AV_CODEC_ID_WEBP_fuzzer: Use-of-uninitialized-value in decode_entropy_coded_image

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5544067620995072 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDWEBPfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

WordPress WebP & SVG Support plugin <= 1.4.0 - Author+ Stored XSS via SVG vulnerability

Author+ Stored XSS via SVG vulnerability discovered by Bob Matyas, Rayhan Ramdhany Hanaputra in WordPress Plugin WebP & SVG Support versions = 1.4.0...

CVE-2024-3633

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-3633 WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-3633 WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-3633

The WebP & SVG Support WordPress plugin, in versions through 1.4.0 , contains a vulnerability where it fails to properly sanitise uploaded SVG files . This flaw allows users with privileges as low as Author to upload malicious SVG files containing XSS payloads , leading to a Stored Cross-Site Scr...