14978 matches found
CVE-2023-44383
October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...
Cross site scripting
October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...
CVE-2023-44383
October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...
CVE-2023-44383 October CMS stored XSS by authenticated backend user with improper configuration
October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...
CVE-2023-44383 October CMS stored XSS by authenticated backend user with improper configuration
October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...
CVE-2023-44383 October CMS stored XSS by authenticated backend user with improper configuration
October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...
CVE-2023-44383
Summary: CVE-2023-44383 affects October CMS versions affected by stored XSS when SVGs are uploaded to the Media Manager. What’s affected: October CMS (versions 3.0–3.5.x per sources) where the media manager stores SVG files. Root cause: Inadequate validation/ sanitization of uploaded SVG content ...
mupdf:pdf_fuzzer: Use-of-uninitialized-value in svg_parse_viewbox
Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5561869313900544 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
CVE-2023-44383: Improper Neutralization of Input During Web Page Generation
October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...
qt:qtsvg_svg_qsvgrenderer_render: Global-buffer-overflow in QSvgStyleSelector::nodeNames
Detailed Report: https://oss-fuzz.com/testcase?key=4922028708462592 Project: qt Fuzzing Engine: afl Fuzz Target: qtsvgsvgqsvgrendererrender Job Type: aflasanqt Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000002d70c98 Crash State: QSvgStyleSelector::nodeNames...
Cross-site Scripting in DOMSanitizer
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
GHSA-2GHM-R75J-PJX2 Cross-site Scripting in DOMSanitizer
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
Design/Logic Flaw
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-49146
DOMSanitizer (dom-sanitizer) before 1.0.7 is vulnerable to XSS via an SVG document due to mishandling of comments and greedy regular expressions. The fix is in 1.0.7 (see commit c2a98f27… and 1.0.6…1.0.7 comparison). Impact: potential XSS in contexts using DOMSanitizer prior to 1.0.7. Remediation...
Apache Batik SSRF
The vulnerability of the Apache Batik library for working with SVG images is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow attackers to execute an SSRF attack...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-49146: Improper Neutralization of Input During Web Page Generation
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...