Cod3Beat

**Name of the Vulnerable Software and Affected Versions** BestWebSoft Google Captcha versions 1.78 and earlier **Description** The issue is related to an Authentication Bypass by Spoofing vulnerability that allows Identity Spoofing. This vulnerability affects the Google Captcha plugin, enabling potential identity spoofing attacks. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For BestWebSoft Google Captcha versions 1.78 and earlier, update to a version later than 1.78 to resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** php-svg-lib versions prior to 0.5.1 **Description** The issue arises when parsing attributes passed to a `use` tag inside an SVG document, allowing an attacker to cause the system to go into infinite recursion. This could exhaust the memory available to the executing process and/or the server itself, potentially leading to resource exhaustion if multiple requests are sent to render the payload. **Recommendations** For versions prior to 0.5.1, update to version 0.5.1 to resolve the issue. As a temporary workaround, consider restricting the parsing of `use` tags with `href` or `xlink:href` attributes to prevent infinite recursion.

**Name of the Vulnerable Software and Affected Versions** php-svg-lib versions prior to 0.5.1 **Description** The issue arises when handling `<use>` tags that reference `<image>` tags, as it merges attributes from the `<use>` tag to the `<image>` tag. This is particularly problematic when the `href` attribute from the `<use>` tag has not been sanitized, leading to an unsafe file read. This can cause a PHAR Deserialization issue in PHP prior to version 8. **Recommendations** For versions prior to 0.5.1, update to version 0.5.1 to resolve the issue. As a temporary workaround, consider sanitizing the `href` attribute from the `<use>` tag to prevent unsafe file reads.