CVE-2024-4636 Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘allowmemetypes’ function in versions up to, and including, 3.12.10 due to insufficient input sanitization and output escaping. This makes it possible...

WordPress Image Optimization by Optimole plugin <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG Upload vulnerability discovered by wesley wcraft in WordPress Plugin Optimole versions = 3.12.10...

CVE-2024-4487

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

CVE-2024-4487

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

CVE-2024-4487: Improper Neutralization of Input During Web Page Generation

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

Image Optimization by Optimole < 3.13.0 - Author+ Stored Cross-Site Scripting via SVG Upload

Description The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘allowmemetypes’ function in versions up to, and including, 3.12.10 due to insufficient input sanitization and output escaping. This makes...

WordPress Blocksy Companion plugin <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via SVG Uploads vulnerability discovered by wesley wcraft in WordPress Plugin Blocksy Companion versions = 2.0.45...

cairo:svg-render-fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5747637872558080 Project: cairo Fuzzing Engine: libFuzzer Fuzz Target: svg-render-fuzzer Job Type: libfuzzerubsancairo Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x581218eeb000 Crash State: NULL Sanitizer: undefined UBSAN...

CVE-2024-4487

CVE-2024-4487 affects Blocksy Companion for WordPress. The vulnerability is a Stored Cross-Site Scripting via SVG uploads in Blocksy Companion versions up to and including 2.0.45, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contribu...

PT-2024-31289 · WordPress · Blocksy Companion

Name of the Vulnerable Software and Affected Versions: Blocksy Companion plugin for WordPress versions up to, and including, 2.0.45 Description: The issue is related to Stored Cross-Site Scripting via SVG uploads due to insufficient input sanitization and output escaping. This allows authenticate...

RHEL 6 : perl-image-info (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - perl-Image-Info: XXE in SVG files CVE-2016-9181 Note that Nessus has not tested for this issue but has instead reli...

RHEL 7 : librsvg2 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - librsvg2: DoS parsing SVGs with circular definitions rsvgcssnormalizefontsize function CVE-2016-4348 - Th...

Blocksy Companion < 2.0.46 - Contributor+ Stored Cross-Site Scripting via SVG Uploads

Description The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

GLSA-202405-26 : qtsvg: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202405-26 qtsvg: Multiple Vulnerabilities - Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and...

Oracle Linux 9 : webkit2gtk3 (ELSA-2024-2126)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2126 advisory. 2.42.5-1 - Update to 2.42.5 Resolves: RHEL-3960 2.42.4-1 - Update to 2.42.4 Resolves: RHEL-3960 Resolves: RHEL-19366 2.42.3-1 - Update to 2.42.3...

CVE-2024-4097

The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-2324

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers t...

CVE-2024-2324

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers t...

CVE-2024-4097: Improper Neutralization of Input During Web Page Generation

The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-2324: Improper Neutralization of Input During Web Page Generation

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers t...