Publify Core does not strip metadata from images

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-2815 · ADVISORY
• publify/publify commit af69097 · WEB
• publify/publify_core commit 33f897c · WEB
• publify/publify · PACKAGE
• rubysec/ruby-advisory-db · WEB
• huntr.dev/bounties/22fdcc39-8c1a-4e4c-8eae-be3fd764f8b4 · WEB

Autres vulnérabilités de publify_core

• CVE-2024-39311MOYENNE 5.4Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of …
• CVE-2023-0569MOYENNE 6.5Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
• CVE-2023-0299CRITIQUE 9.8Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.
• CVE-2022-1812CRITIQUE 9.8Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.
• CVE-2022-1811MOYENNE 5.4Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.