CVE-2024-56521

An issue exists in TCPDF versions prior to 6.8.0 where the software unsafely sets CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER when libcurl is used. This improper certificate validation (CWE-295) can lead to critical security risks. While the vulnerability is present in several Linux distrib...

CVE-2024-56527

The TCPDF PHP library (versions before 6.8.0 ) contains a vulnerability where the Error() function fails to use htmlspecialchars when processing error messages. This insufficient cleansing of user-supplied data during web page generation can allow a remote attacker to execute arbitrary code . Rem...

CVE-2024-32489

The TCPDF PHP library, a tool for generating PDF files on-the-fly, contains a vulnerability where it mishandles calls using HTML syntax . Specifically, the library fails to properly cleanse or remove script-related HTML tags , which can allow a malicious actor to perform cross-site scripting (XSS...

CVE-2024-56519

The TCPDF PHP library, used for generating PDF documents, is vulnerable because the setSVGStyles function fails to sanitize the SVG font-family attribute. This lack of proper input validation allows an attacker to perform cross-site scripting (XSS) attacks remotely. Remediation is available throu...

CVE-2024-56522

The TCPDF PHP library, used for generating PDF documents, is vulnerable to security bypasses because the unserializeTCPDFtag() function fails to use a constant-time function when comparing TCPDF tag hashes. Instead, it utilizes loose comparison (!= ), which can be exploited by a remote attacker t...