19 matches found
CVE-2023-4683-Test
CVE-2023-4683-Test This repo holds an easy to use POC for CVE-2023-4683. Just git clone this repo and either extract webp-test or run setup-webp-test.sh. webp-test already has the necessary files git commit 7ba44f80f3b94fc0138db159afea770ef06532a0 of https://chromium.googlesource.com/webm/libwebp...
NotEnough
Huffman table hacking tool This tool calculates tricky canonical huffman histogram, which is able to trigger OOB Out Of Band write for vulnerable libwebp library i.e. libwebp = 1.3.1. This vulnerability is known as CVE-2023-4863 or CVE-2023-41064. We can overflow the pre-allocated huffman table b...
CVE-2023-4863
CVE-2023-4863 checkout webp git clone https://chromium.googlesource.com/webm/libwebp/ webptest cd webptest/ checkout vulnerable version git checkout 7ba44f80f3b94fc0138db159afea770ef06532a0 enable AddressSanitizer sed -i 's/^EXTRAFLAGS=./& -fsanitize=address/' makefile.unix build webp make -f...
CVE-2026-110635 webp-converter before 3.0.0 OS Command Injection via File Names and Options
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell...
EUVD-2019-0219
Malware in sbrugna...
dwebp-bin downloads Resources over HTTP
Affected versions of dwebp-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...
grunt-dwebp (>=1.0.0, <=1.1.2), gulp-dwebp (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-10633 via dwebp-bin (1.0.0)
dwebp-bin NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dwebp-bin and may be impacted: - grunt-dwebp =1.0.0, =1.0.0, =1.0.2 Source cves: CVE-2016-10633 Source advisory: GHSA-4PF7-579W-F4GM...
grunt-dwebp (>=1.0.0, <=1.1.2), gulp-dwebp (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-10633 via dwebp-bin (1.0.0)
dwebp-bin NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dwebp-bin and may be impacted: - grunt-dwebp =1.0.0, =1.0.0, =1.0.2 Source cves: CVE-2016-10633 Source advisory: OSV:GHSA-4PF7-579W-F4GM...
GHSA-4PF7-579W-F4GM dwebp-bin downloads Resources over HTTP
Affected versions of dwebp-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...
Man-in-the-Middle (MitM)
dwebp-bin is vulnerable to man-in-the-middle MitM attacks. This is because they download binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...
CVE-2016-10633
dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...
CVE-2016-10633
dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...
Remote code execution
dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...
CVE-2016-10633
CVE-2016-10633 affects dwebp-bin, a Node.js wrapper for dwebp that converts WebP to PNG. The vulnerability arises because it downloads binary resources over HTTP, enabling MITM tampering. An attacker on the network could swap the requested binary with a malicious one, potentially triggering remot...
CVE-2016-10633
dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...
CVE-2016-10633
dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...
CVE-2016-10633: Missing Encryption of Sensitive Data
dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...
PT-2018-4811
Name of the Vulnerable Software and Affected Versions dwebp-bin versions affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code executio...
Downloads Resources over HTTP
Overview Affected versions of dwebp-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...