CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
ImageMagick HTTP/FTP Coders Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-3718)
[Affected Scope] ImageMagick versions before 6.9.3-10 and 7.x before 7.0.1-1
[Impact] Remote attackers can exploit this vulnerability to conduct Server-Side Request Forgery (SSRF) attacks, scanning internal networks and accessing restricted local services
[Mitigation] Upgrade ImageMagick to the latest patched version or disable HTTP/FTP coders via the policy.xml configuration file
ImageMagick EPHEMERAL Coder Arbitrary File Deletion Vulnerability (CVE-2016-3715)
[Affected Scope] ImageMagick before version 6.9.3-10 and 7.x before version 7.0.1-1
[Impact] Remote attackers can delete arbitrary files on the system by tricking the application into processing a crafted image
[Mitigation] Upgrade ImageMagick to the latest secure versions (6.9.3-10+, 7.0.1-1+) or disable the EPHEMERAL coder via policy.xml
ImageMagick Remote Code Execution (RCE) Vulnerability (CVE-2016-3714, 'ImageTragick') Analysis and Mitigation Guide
[Affected Scope] All systems running ImageMagick versions prior to 6.9.3-10 and 7.x prior to 7.0.1-1
[Impact] Remote attackers can execute arbitrary system commands with the privileges of the web server by uploading or processing a specially crafted image file
[Mitigation] Upgrade ImageMagick to the latest secure version (6.9.3-10+ or 7.0.1-1+) or disable vulnerable coders (MVG, MSL, etc.) via the policy.xml configuration file