244 matches found
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
CVE-2021-22204 : ExifTool versions 7.44 and later are vulnerable to arbitrary code execution when parsing a malicious image due to improper neutralization of user data in the DjVu file format. Several connected sources confirm this remote code execution vector within ExifTool’s handling of DjVu c...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
exiftool 代码注入漏洞
exiftool is a software application. Make metadata more accessible. An injection vulnerability exists in ExifTool versions 7.44 and earlier versions, which can be exploited by an attacker to arbitrarily execute code while parsing a malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
GitLab: RCE when removing metadata with ExifTool
Summary When uploading image files, GitLab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags. An issue with this is that ExifTool will ignore the file extension and try to determine what the file is based on the content, allowing f...
PT-2021-5828
Name of the Vulnerable Software and Affected Versions ExifTool versions 7.44 and up Description The issue is related to improper neutralization of user data in the DjVu file format, allowing arbitrary code execution when parsing malicious images. This could enable a remote attacker to access...
Security Vulnerability found in ExifTool
Debian Security Advisory reports: A vulnerability was discovered in libimage-exiftool-perl, a library and program to read and write meta information in multimedia files, which may result in execution of arbitrary code if a malformed DjVu file is processed...
Shopify: XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.com
Hello team, I found unrestricted file upload via avatar in https://accounts.shopify.com/accounts/, and XSS Stored in PNG IDAT chunks using exiftool , exiftool command exiftool -Comment=""alertprompt'XSS BY ZEROX4'" xsscommentexifmetadatadoublequote.png Payload example : �PNG �...
TuxResponse - Linux Incident Response
TuxResponse is incident response script for linux systems written in bash. It can automate incident response activities on Linux systems and enable you to triage systems quickly, while not compromising with the results. Usually corporate systems would have some kind of monitoring and control, but...
Metaforge - An OSINT Metadata Analyzing Tool That Filters Through Tags And Creates Reports
AnOSINT tool that analyzes metadata and creates dynamic reports" What is "metadata"? To put it simply, metadata is just information about data. The information comes from the tags that capture valuable information about each specific file. Each file has can have many different tags of data that c...
CVE-2018-20211
ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws3232.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 9.x was released starti...
CVE-2018-20211
ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws3232.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 9.x was released starti...
Code injection
ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws3232.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 9.x was released starti...
CVE-2018-20211
ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws3232.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 9.x was released starti...
CVE-2018-20211
CVE-2018-20211 affects ExifTool v8.32. Local privilege escalation via DLL hijacking: an attacker creates a TEMP\par-%username%\cache-exiftool-8.32 folder and places a malicious ws32_32.dll there, allowing privilege gain when a victim runs the tool. Root cause is loading a DLL from a user-writable...
Exiftool 8.3.2.0 DLL Hijacking
...
Pymeta - Search The Web For Files On A Domain To Download And Extract Metadata
Pymeta is a Python3 rewrite of the tool PowerMeta, created by dafthack in PowerShell. It uses specially crafted search queries to identify and download the following file types pdf, xls, xlsx, doc, docx, ppt, pptx from a given domain using Google and Bing. Once downloaded, metadata is extracted...