9453 matches found
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...
BrokenType
BrokenType BrokenType es un conjunto de herramientas diseñadas para probar la robustez y seguridad del software de rasterización de fuentes, especialmente bases de código propensas a problemas de corrupción de memoria escritas en C/C++ y lenguajes similares. Consta de los siguientes componentes:...
CVE-2026-44950
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
CVE-2026-59679
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-44950
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
EUVD-2026-75306
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
CVE-2026-44950
CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...
CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
EUVD-2026-75300
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-59679
CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...
CVE-2026-59679
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-79515
A flaw was found in the stb component. An out-of-bounds read vulnerability in the stbttGetGlyphShape function allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted TrueType Font TTF file. This can lead to the affected application becoming unresponsive or crashin...
dompdf-rce
Exploit de RCE para dompdf Este repositorio contiene una aplicación de demostración vulnerable que utiliza dompdf 1.2.0 y un exploit que logra ejecución remota de código mediante un archivo políglota ttf+php. Para más detalles, visite https://positive.security/blog/dompdf-rce Instrucciones 1...
CVE-2026-79591
A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...
CVE-2026-79591
A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 , caused by insufficient validation of a file-controlled font index. A potential fix is referenced in a GitHub pull request (libxls PR #164 ), alongside issue #161 . No CVSS metrics or conf...
EUVD-2026-75745
A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...
nexts-cve-2025-66478-exploit
这是一个使用 create-next-app 引导的 Next.js 项目。 快速开始 首先，运行开发服务器： root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev 在浏览器中打开 http://localhost:3000 查看结果。 你可以通过修改 app/page.tsx 来编辑页面。当你编辑文件时，页面会自动更新。 该项目使用 next/font 自动优化和加载 Geist，这是 Vercel 的一个新字体家族。 了解更多 要了解更多关于 Next.js 的信息，请查看以下资源： Next.js 文档 - 了解...
CVE-2025-63708
CVE-2025-63708 CVE ID: CVE-2025-63708 分配日期: 2025-12-11 问题类型: CWE-79（跨站脚本） 受影响产品: “AI Font Matcher”（发布于2025-10-10，nid=18425） 产品页面: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html 发现日期: 2025-10-11 研究人员: Dylan Davis 概要 该应用程序在处理来自 webfont...