14963 matches found
CVE-2024-37741
OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture...
CVE-2024-37741
OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture...
CVE-2024-3111
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues...
CVE-2024-3111
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues...
CVE-2024-3111 H5P < 1.15.8 - Contributor+ Stored XSS
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues...
CVE-2024-3111 H5P < 1.15.8 - Contributor+ Stored XSS
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues...
CVE-2024-3111
The Interactive Content (also known as H5P ) WordPress plugin versions prior to 1.15.8 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of validation for uploads, which allows users with Contributor privileges and above to upload or update malicious SVG files . This ...
WordPress Plugin H5P Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...
PT-2024-23779 · WordPress · Interactive Content
Name of the Vulnerable Software and Affected Versions: Interactive Content WordPress plugin versions prior to 1.15.8 Description: The issue arises from the lack of validation for uploads, which could allow Contributors and above to update malicious SVG files. This leads to Stored Cross-Site...
CVE-2024-3111: Improper Neutralization of Input During Web Page Generation
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues...
WordPress WebP & SVG Support plugin <= 1.4.0 - Author+ Stored XSS via SVG vulnerability
Author+ Stored XSS via SVG vulnerability discovered by Bob Matyas, Rayhan Ramdhany Hanaputra in WordPress Plugin WebP & SVG Support versions = 1.4.0...
CVE-2024-3633
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2024-3633
The WebP & SVG Support WordPress plugin, in versions through 1.4.0 , contains a vulnerability where it fails to properly sanitise uploaded SVG files . This flaw allows users with privileges as low as Author to upload malicious SVG files containing XSS payloads , leading to a Stored Cross-Site Scr...
CVE-2024-3633 WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2024-3633 WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2024-3633: Improper Neutralization of Input During Web Page Generation
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
WordPress WebP & SVG Support Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)
Software WebP & SVG Support Type Plugin Vulnerable versions = 1.4.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3633 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 29e8ee332f89 Credits Bob Matyas Rayhan...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : Roundcube vulnerabilities (USN-6848-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6848-1 advisory. Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A remote...
USN-6848-1: Roundcube vulnerabilities
Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. CVE-2023-5631 Rene...
