290 matches found
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
Input validation
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
CVE-2021-22204 : ExifTool versions 7.44 and later are vulnerable to arbitrary code execution when parsing a malicious image due to improper neutralization of user data in the DjVu file format. Several connected sources confirm this remote code execution vector within ExifTool’s handling of DjVu c...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
exiftool 代码注入漏洞
exiftool is a software application. Make metadata more accessible. An injection vulnerability exists in ExifTool versions 7.44 and earlier versions, which can be exploited by an attacker to arbitrarily execute code while parsing a malicious image...
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
CVE-2021-22204: Improper Control of Generation of Code
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...
GitLab Unauthenticated Remote ExifTool Command Injection
This module exploits an unauthenticated file upload and command injection vulnerability in GitLab Community Edition CE and Enterprise Edition EE. The patched versions are 13.10.3, 13.9.6, and 13.8.8. Exploitation will result in command execution as the git user. Module Options msf use...
GitLab: RCE when removing metadata with ExifTool
Summary When uploading image files, GitLab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags. An issue with this is that ExifTool will ignore the file extension and try to determine what the file is based on the content, allowing f...
PT-2021-5828
Name of the Vulnerable Software and Affected Versions ExifTool versions 7.44 and up Description The issue is related to improper neutralization of user data in the DjVu file format, allowing arbitrary code execution when parsing malicious images. This could enable a remote attacker to access...
Security Vulnerability found in ExifTool
Debian Security Advisory reports: A vulnerability was discovered in libimage-exiftool-perl, a library and program to read and write meta information in multimedia files, which may result in execution of arbitrary code if a malformed DjVu file is processed...
Shopify: XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.com
Hello team, I found unrestricted file upload via avatar in https://accounts.shopify.com/accounts/, and XSS Stored in PNG IDAT chunks using exiftool , exiftool command exiftool -Comment=""alertprompt'XSS BY ZEROX4'" xsscommentexifmetadatadoublequote.png Payload example : �PNG �...
TuxResponse - Linux Incident Response
TuxResponse is incident response script for linux systems written in bash. It can automate incident response activities on Linux systems and enable you to triage systems quickly, while not compromising with the results. Usually corporate systems would have some kind of monitoring and control, but...
Metaforge - An OSINT Metadata Analyzing Tool That Filters Through Tags And Creates Reports
AnOSINT tool that analyzes metadata and creates dynamic reports" What is "metadata"? To put it simply, metadata is just information about data. The information comes from the tags that capture valuable information about each specific file. Each file has can have many different tags of data that c...
CVE-2018-20211
ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws3232.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 9.x was released starti...
CVE-2018-20211
ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws3232.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 9.x was released starti...