GHSA-X37X-QF4V-F54F Roundup Cross-site Scripting Vulnerability

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

PYSEC-2024-65

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

PYSEC-2024-65

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

UBUNTU-CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

GHSA-52CW-PVQ9-9M5V Silverstripe uses TinyMCE which allows svg files linked in object tags

Impact TinyMCE v6 has a configuration value convertunsafeembeds set to false which allows svg files containing javascript to be used in or tags, which can be used as a vector for XSS attacks. Note that tags are not allowed by default. After patching the default value of convertunsafeembeds will b...

Silverstripe uses TinyMCE which allows svg files linked in object tags

Impact TinyMCE v6 has a configuration value convertunsafeembeds set to false which allows svg files containing javascript to be used in or tags, which can be used as a vector for XSS attacks. Note that tags are not allowed by default. After patching the default value of convertunsafeembeds will b...

SS-2024-001 - TinyMCE allows svg files linked in object tags

More info at https://www.silverstripe.org/download/security-releases/ss-2024-001...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39126: Improper Neutralization of Input During Web Page Generation

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

PT-2024-40085

Name of the Vulnerable Software and Affected Versions: TinyMCE version 6 Description: The issue arises from a configuration value convert unsafe embeds set to false, allowing svg files with javascript to be used in or tags, potentially leading to XSS attacks. Note that tags are not allowed by...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39126

CVE-2024-39126 : The vulnerability affects Roundup prior to 2.4.0, enabling cross-site scripting through JavaScript in PDF, XML, and SVG documents. The description and connected records confirm the issue, but do not provide exploitation details, affected vendor-specific patch versions, or concret...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

WordPress Support SVG plugin < 1.1.0 - Stored XSS via SVG Upload vulnerability

Stored XSS via SVG Upload vulnerability discovered by Rayhan Ramdhany Hanaputra in WordPress Plugin Support SVG versions 1.1.0...

WordPress SVG Block plugin < 1.1.20 - Author+ Stored XSS via SVG File Upload vulnerability

Author+ Stored XSS via SVG File Upload vulnerability discovered by Rayhan Ramdhany Hanaputra in WordPress Plugin SVG Block versions 1.1.20...

WordPress SVG Block Plugin < 1.1.20 is vulnerable to Cross Site Scripting (XSS)

Software SVG Block Type Plugin Vulnerable versions 1.1.20 Fixed in 1.1.20 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4269 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 927bcf9065fa Credits Rayhan Ramdhany Hanaputra...

WordPress Support SVG Plugin < 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Support SVG Type Plugin Vulnerable versions 1.1.0 Fixed in 1.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4272 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9c36e42fd0ca Credits Rayhan Ramdhany Hanaputra...