Design/Logic Flaw

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a use tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the...

CVE-2023-50252

The CVE-2023-50252 issue affects the PHP SVG library php-svg-lib prior to version 0.5.1. When processing a tag that references an tag, the library merges attributes from into . If the href in is not sanitized, this can lead to an unsafe file read and a PHAR deserialization vulnerability in PH...

CVE-2023-50252 php-svg-lib unsafe attributes merge when parsing `use` tag

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50252

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50252 php-svg-lib unsafe attributes merge when parsing `use` tag

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50251

The CVE-2023-50251 issue affects php-svg-lib (prior to v0.5.1), a PHP library for parsing/rendering SVGs. Root cause: parsing the attributes of a use tag can trigger recursive references when an id/link points to the same object, creating an infinite recursion; memory exhaustion can follow, poten...

CVE-2023-50251 php-svg-lib possible DoS caused by infinite recursion when parsing SVG document

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a use tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the...

CVE-2023-50251

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a "use" tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust th...

CVE-2023-50251 php-svg-lib possible DoS caused by infinite recursion when parsing SVG document

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a use tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the...

CVE-2023-50251 php-svg-lib possible DoS caused by infinite recursion when parsing SVG document

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a use tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the...

php-svg-lib security vulnerability

php-svg-lib is an open source SVG file parsing/rendering library from dompdf. A security vulnerability exists in versions of php-svg-lib prior to 0.5.1, which stems from the fact that parsing attributes passed to the use tag within an svg document may cause the system to enter infinite recursion,...

CVE-2023-50252: External Control of System or Configuration Setting

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

CVE-2023-50251: Uncontrolled Recursion

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a use tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the...

CVE-2023-6654

A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The...

CVE-2023-6654

PHPEMS vulnerable in Library: deserialization flaw in lib/session.cls.php of Session Data Handler across PHPEMS 6.x–9.0. Deserialization manipulation allows remote abuse; exploit disclosed publicly (VDB-247357). Several sources corroborate: CVE-2023-6654 entry notes remote attack and public explo...

PHPEMS 代码问题漏洞

PHPEMS is a PHP online mock exam system. PHPEMS suffers from a deserialization vulnerability that stems from unsafe deserialization processing of lib/session.cls.php when receiving serialized data submitted by a user, which can be exploited by an attacker to cause code execution...

CVE-2023-6654: Deserialization of Untrusted Data

A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The...

Malicious code in cronos-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28e64c01e4b9cd54a06e2eca183963b81038522ef15da56fc116a385458c783d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in cronos-lib

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8672 Malicious code in cronos-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28e64c01e4b9cd54a06e2eca183963b81038522ef15da56fc116a385458c783d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...