1404 matches found
steal 安全漏洞
steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in steal version 2.2.4 that stems from prototype contamination in the function convertLater in npm-convert.js via the...
mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used
A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used, resulting in a denial of service...
CVE-2021-3574
A vulnerability was found in ImageMagick. Memory leaks are detected when executing a crafted file with the convert command, affecting availability...
CVE-2021-3574
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks...
DEBIAN-CVE-2021-3574
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks...
ImageMagick 安全漏洞
ImageMagick is a set of open-source image processing software from the American company ImageMagick. The software can read, convert, or write images in a variety of formats. A security vulnerability exists in ImageMagick 7.0.11-5, which stems from its use of the convert command to execute a craft...
CVE-2021-3574
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks...
CVE-2021-3574: Missing Release of Memory after Effective Lifetime
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks...
CVE-2021-3574
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks...
convert-svg-core vulnerable to remote code injection
The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an onload attribute. Puppeteer/Chromium used by convert-svg-core will execute any code within that tag, including malicious code. PoC Payload html where the id...
@bolstergroup/botstr.io-set-times (>=0.0.1, <=0.0.7), @bolstergroup/botstr.io-spotify (>=0.0.18, <=0.0.43) +42 more potentially affected by CVE-2022-25759 via convert-svg-core (>=0.3.3, <=0.5.0)
convert-svg-core NPM version =0.3.3, =0.0.1, =0.0.18, =1.0.44, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =0.0.1, =1.0.2, =0.3.0, =0.3.0, =1.0.3, =1.2.1 and more Source cves: CVE-2022-25759 Source advisory: OSV:GHSA-5GXC-FXCR-9326...
GHSA-5GXC-FXCR-9326 convert-svg-core vulnerable to remote code injection
The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an onload attribute. Puppeteer/Chromium used by convert-svg-core will execute any code within that tag, including malicious code. PoC Payload html where the id...
CVE-2022-25759
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload...
CVE-2022-25759
The CVE-2022-25759 issue affects the convert-svg-core npm package, specifically versions before 0.6.2. It enables remote code injection by processing an SVG containing a payload (notably via an onload attribute). Impact is remote code execution when using the vulnerable library in conjunction wit...
CVE-2022-25759
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload...
PT-2022-17494
Name of the Vulnerable Software and Affected Versions convert-svg-core versions prior to 0.6.2 Description The issue allows for Remote Code Injection via sending an SVG file containing the payload. This can be achieved by including malicious code within an onload attribute in the SVG file. When...
convert-svg 代码注入漏洞
convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in versions of convert-svg prior to 0.6.2, which stems from the fact that by sending SVG files containing payloads, convert-svg-core is vulnerable to remote...
CVE-2022-25759: Improper Control of Generation of Code
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload...
