Dmitry Prokhorov

**Name of the Vulnerable Software and Affected Versions** Nuxt OG Image versions prior to 6.2.5 **Description** The Nuxt OG Image component, used for generating Open Graph images with Vue templates in Nuxt, contains a potential for Denial of Service (DoS). This issue stems from a lack of restrictions on the width and height parameters when generating images via the `/og/d/` endpoint (and `/og-image/` in older versions). Sending a request with excessively large width and height values can exhaust server resources during image generation, leading to a DoS condition. The vulnerability was demonstrated by sending a GET request to the `/og/d/og.png` API endpoint with increased `width` and `height` parameters, such as `width=20000&height=20000`. This caused memory exhaustion on the test server. **Recommendations** Versions prior to 6.2.5: Implement a limitation on the width and length of the generated image.

**Name of the Vulnerable Software and Affected Versions** Nuxt OG Image versions prior to 6.2.5 **Description** The Nuxt OG Image package contains a flaw in the image-generation component accessible via the API endpoint `/ og/d/` (and `/og-image/` in older versions). This issue allows for the injection of arbitrary attributes into the HTML page body through manipulation of GET parameters. Specifically, the vulnerability arises from incorrect parsing of these parameters, leading to potential HTML and JavaScript code injection. The `onmouseover` and `autofocus` parameters can be exploited to inject attributes directly into the generated HTML page. **Recommendations** Versions prior to 6.2.5: Upgrade to version 6.2.5 or later to address the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kodex Posts likes versions through 2.5.0 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows Reflected XSS. **Recommendations** For versions through 2.5.0, update to a version later than 2.5.0 to resolve the issue.