CVE-2024-29273

The collaborative office suite dzzoffice version 2.02.1 SC UTF8 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of effective filtering and escaping of user-supplied data, specifically allowing an attacker to inject a crafted SVG document containing an XSS payload int...

CVE-2024-29273: Improper Neutralization of Input During Web Page Generation

There is Stored Cross-Site Scripting XSS in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document...

Debian: Security Advisory (DSA-5642-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-22845 · Dzzoffice · Dzzoffice

Name of the Vulnerable Software and Affected Versions: dzzoffice version 2.02.1 SC UTF8 Description: There is Stored Cross-Site Scripting XSS in the uploadfile to "index.php", with the XSS payload in an SVG document. Recommendations: For dzzoffice version 2.02.1 SC UTF8, consider disabling the...

[SECURITY] [DSA 5642-1] php-dompdf-svg-lib security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5642-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 20, 2024 https://www.debian.org/security/faq -...

CVE-2024-23642

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

CVE-2024-23642 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

CVE-2024-23642 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

CVE-2024-23642

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

CVE-2024-23642

GeoServer stores a Stored Cross-Site Scripting (XSS) vulnerability in the Simple SVG Renderer. The issue affects versions prior to 2.23.4 and 2.24.1, where an authenticated administrator with workspace‑level privileges can store a JavaScript payload in the GeoServer catalog that executes in anoth...

CVE-2024-23642 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS)

Summary A stored cross-site scripting XSS vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap SVG Output...

GHSA-FG9V-56HW-G525 GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS)

Summary A stored cross-site scripting XSS vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap SVG Output...

CVE-2024-23642: Improper Neutralization of Input During Web Page Generation

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

DSA-5642-1 php-dompdf-svg-lib - security update

Bulletin has no description...

Debian dsa-5642 : php-dompdf-svg-lib - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5642 advisory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5642-1...

PT-2024-19993 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.4 and 2.24.1 Description: A stored cross-site scripting XSS issue exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog. This...

CVE-2023-7085

The Scalable Vector Graphics SVG WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-7085

The Scalable Vector Graphics (SVG) WordPress plugin, in versions through 3.4 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to properly sanitize uploaded SVG files , which allows users with privileges as low as Author to upload malicious files contai...

CVE-2014-1745

A use-after-free vulnerability was found in the SVG implementation within WebKitGTK. This flaw allows remote attackers to exploit the removal of an SVGFontFaceElement object, which occurs through specific vectors that trigger the deletion of the object during rendering. Mitigation Mitigation for...