CVE-2023-36308

disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence

• CWE-129

• https://github.com/disintegration/imaging/issues/165Exploit, Issue Tracking, Third Party Advisory
• https://github.com/disintegration/imaging/releases/tag/v1.6.2Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GX2SYGRCNFUAGELLDOBIERCSCYSGKFY/
• https://github.com/disintegration/imaging/issues/165Exploit, Issue Tracking, Third Party Advisory
• https://github.com/disintegration/imaging/releases/tag/v1.6.2Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GX2SYGRCNFUAGELLDOBIERCSCYSGKFY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3GX2SYGRCNFUAGELLDOBIERCSCYSGKFY/

Published

Sep 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36293SQL injection vulnerability in wmanager v.1.0.7 and before a…7.5
• CVE-2023-36298DedeCMS v5.7.109 has a File Upload vulnerability, leading to…8.8
• CVE-2023-36299A File Upload vulnerability in typecho v.1.2.1 allows a remo…8.8
• CVE-2023-36301Talend Data Catalog before 8.0-20230221 contain a directory …7.5
• CVE-2023-36306A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon…6.1
• CVE-2023-36307ZPLGFA 1.1.1 allows attackers to cause a panic (because of a…5.5
• CVE-2023-36309There is a Cross Site Scripting (XSS) vulnerability in the "…6.1
• CVE-2023-3631Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-36310There is a Cross Site Scripting (XSS) vulnerability in the "…6.1
• CVE-2023-36311There is a SQL injection (SQLi) vulnerability in the "column…9.8
• CVE-2023-36312There is a Cross Site Scripting (XSS) vulnerability in the v…5.4
• CVE-2023-36313PHPJabbers Document Creator v1.0 is vulnerable to Cross Site…6.1