Dmitry Prokhorov

**Name of the Vulnerable Software and Affected Versions** Nuxt OG Image versions prior to 6.2.5 **Description** The Nuxt OG Image component, used for generating Open Graph images with Vue templates in Nuxt, contains a potential for Denial of Service (DoS). This issue stems from a lack of restrictions on the width and height parameters when generating images via the `/og/d/` endpoint (and `/og-image/` in older versions). Sending a request with excessively large width and height values can exhaust server resources during image generation, leading to a DoS condition. The vulnerability was demonstrated by sending a GET request to the `/og/d/og.png` API endpoint with increased `width` and `height` parameters, such as `width=20000&height=20000`. This caused memory exhaustion on the test server. **Recommendations** Versions prior to 6.2.5: Implement a limitation on the width and length of the generated image.

**Name of the Vulnerable Software and Affected Versions** Nuxt OG Image versions prior to 6.2.5 **Description** The Nuxt OG Image package contains a flaw in the image-generation component accessible via the API endpoint `/ og/d/` (and `/og-image/` in older versions). This issue allows for the injection of arbitrary attributes into the HTML page body through manipulation of GET parameters. Specifically, the vulnerability arises from incorrect parsing of these parameters, leading to potential HTML and JavaScript code injection. The `onmouseover` and `autofocus` parameters can be exploited to inject attributes directly into the generated HTML page. **Recommendations** Versions prior to 6.2.5: Upgrade to version 6.2.5 or later to address the vulnerability.

**Nome do software vulnerável e versões afetadas** Versões do Kodex Posts até a 2.5.0 **Descrição** O problema está relacionado à neutralização inadequada de entradas durante a geração de páginas da Web, também conhecida como Cross-site Scripting (XSS). Isso permite XSS refletido. **Recomendações** Para versões até a 2.5.0, atualize para uma versão posterior à 2.5.0 para resolver o problema.