Unrestricted file upload

A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content...

BIT-2023-5631

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcubewashtml.php behavior. This could allow a remote attackerto load arbitrary JavaScript code...

Fedora 38 : roundcubemail (2023-955e390a13)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-955e390a13 advisory. Version 1.6.4 - Fix PHP8 warnings 9142, 9160 - Fix default 'mime.types' path on Windows 9113 - Managesieve: Fix javascript error when relational or spamtest...

CVE-2023-44767: Improper Neutralization of Input During Web Page Generation

A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content...

CVE-2023-44767

A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content...

CVE-2023-44767

A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content...

PT-2023-29291 · Ritecms · Ritecms

Name of the Vulnerable Software and Affected Versions: RiteCMS version 3.0 Description: A File upload issue allows a local attacker to upload a SVG file containing XSS content. Recommendations: For RiteCMS version 3.0, consider restricting file uploads to prevent exploitation until a fix is...

Debian dla-3630 : roundcube - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3630 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3630-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-44767

A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content...

Debian DSA-5531-1 : roundcube - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5531 advisory. It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize HTML messages. This would allow an attacker to...

GHSA-6HVG-62Q8-95V7 svg_optimizer rubygem external XML entity (XXE) vulnerability

An issue in Fnando svgoptimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content...

svg_optimizer rubygem external XML entity (XXE) vulnerability

An issue in Fnando svgoptimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content...

CVE-2023-46267

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-5631. Reason: This candidate is a duplicate of CVE-2023-5631. Notes: All CVE users should reference CVE-2023-5631 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

PT-2023-29810

Name of the Vulnerable Software and Affected Versions Fnando svg optimizer version 0.2.6 Description The issue allows a remote attacker to escalate privileges when optimizing untrusted SVG content. Recommendations For Fnando svg optimizer version 0.2.6, update to a version that fixes the privileg...

External XML entity (XXE) vulnerability in svg_optimizer rubygem

An issue in Fnando svgoptimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content...

Security advisory: Loading invalid QML image source impacts Qt

An issue when loading an invalid QML image source has been reported and has been assigned the CVE id CVE-2023-45872. When an invalid source is used to indicate an image to be loaded is specified then it will end up trying to load it as a SVG file which will trigger a crash in Qt SVG. This does no...

CVE-2023-5631

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcubewashtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code...

CVE-2023-5631

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcubewashtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code...

Cross site scripting

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcubewashtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code...

CVE-2023-5631

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcubewashtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code...