Tcpdf Project Tcpdf vulnerabilities
11 known vulnerabilities affecting tcpdf_project/tcpdf.
Total CVEs
11
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH7MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2024-56521CRITICALCVSS 9.8fixed in 6.8.02024-12-27
CVE-2024-56521 [CRITICAL] CWE-295 CVE-2024-56521: An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOP
An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
nvdosv
CVE-2024-56520HIGHCVSS 7.3≥ 0, < 6.3.5+dfsg1-1+deb11u1≥ 0, < 6.6.2+dfsg1-1+deb12u1+1 more2024-12-27
CVE-2024-56520 [HIGH] CVE-2024-56520: An issue was discovered in tc-lib-pdf-font before 2
An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.
osv
CVE-2024-56527HIGHCVSS 7.5fixed in 6.8.02024-12-27
CVE-2024-56527 [HIGH] CWE-79 CVE-2024-56527: An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for
An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.
nvdosv
CVE-2024-56522HIGHCVSS 7.5fixed in 6.8.02024-12-27
CVE-2024-56522 [HIGH] CWE-843 CVE-2024-56522: An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) an
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
nvdosv
CVE-2024-56519HIGHCVSS 7.5fixed in 6.8.02024-12-27
CVE-2024-56519 [HIGH] CWE-79 CVE-2024-56519: An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family at
An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
nvdosv
CVE-2024-51058MEDIUMCVSS 6.2v6.7.52024-11-26
CVE-2024-51058 [MEDIUM] CWE-552 CVE-2024-51058: Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enab
Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through src tag, potentially exposing sensitive information.
nvdosv
CVE-2024-22641HIGHCVSS 7.5≤ 6.7.42024-05-28
CVE-2024-22641 [HIGH] CWE-434 CVE-2024-22641: TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if pars
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
nvdosv
CVE-2024-22640HIGHCVSS 7.5≤ 6.7.42024-04-19
CVE-2024-22640 [HIGH] CWE-1333 CVE-2024-22640: TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an un
TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.
nvdosv
CVE-2024-32489MEDIUMCVSS 6.1fixed in 6.7.42024-04-15
CVE-2024-32489 [MEDIUM] CWE-80 CVE-2024-32489: TCPDF before 6.7.4 mishandles calls that use HTML syntax.
TCPDF before 6.7.4 mishandles calls that use HTML syntax.
nvdosv
CVE-2018-17057CRITICALCVSS 9.8PoC≥ 0, < 6.2.26+dfsg-12018-09-14
CVE-2018-17057 [CRITICAL] CVE-2018-17057: An issue was discovered in TCPDF before 6
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
osv
CVE-2017-6100HIGHCVSS 7.5≤ 6.1.12017-02-23
CVE-2017-6100 [HIGH] CWE-668 CVE-2017-6100: tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
nvdosv