MAL-2023-441 Malicious code in fiji-svg-sprite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb73bfc870df2d61553a74978910662d4cbfc26990235761e59fb780c377c650 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in fiji-svg-sprite

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in fiji-svg-sprite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb73bfc870df2d61553a74978910662d4cbfc26990235761e59fb780c377c650 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Grafana 8.1.0 < 9.2.10, 9.3.0 < 9.3.4 XSS Vulnerability (GHSA-8xmm-x63g-f6xv)

Grafana is prone to a stored cross-site scripting XSS vulnerability in the ResourcePicker component. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2022-23552

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

Cross site scripting

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

CVE-2022-23552 Grafana stored XSS in FileUploader component

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

CVE-2022-23552

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

CVE-2022-23552 Grafana stored XSS in FileUploader component

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

CVE-2022-23552 Grafana stored XSS in FileUploader component

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

CVE-2022-23552: Improper Neutralization of Input During Web Page Generation

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

PT-2023-8919

Name of the Vulnerable Software and Affected Versions Grafana versions 8.1 through 8.5.15 Grafana versions 9.2.0 through 9.2.9 Grafana versions 9.3.0 through 9.3.3 Description Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible becaus...

XSS in ResourcePicker in Grafana

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly...

cairo:svg-render-fuzzer: Heap-buffer-overflow in _fill_xrgb32_lerp_opaque_spans

Detailed Report: https://oss-fuzz.com/testcase?key=5753439881920512 Project: cairo Fuzzing Engine: honggfuzz Fuzz Target: svg-render-fuzzer Job Type: honggfuzzasancairo Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60500069f8b4 Crash State: fillxrgb32lerpopaquespans...

SVG Sanitization Bypass - XSS

Description In imgproxy application, we bypassed the svg sanitization function. In this way, attacker can craft malicious svg file and run javascript on the application. Proof of Concept Here is the content of the malicious svg file. After that you can call this svg file like below...

PT-2023-2370 · Imgproxy · Imgproxy

Name of the Vulnerable Software and Affected Versions: imgproxy versions prior to 3.14.0 Description: The issue is related to Cross-site Scripting XSS - Reflected, which can be exploited by a remote attacker to perform inter-site script attacks using a specially crafted svg file. This is due to...

GHSA-PGJV-JRG2-GQ3V dompurify vulnerable to Cross-site Scripting

dompurify prior to version 2.2.2 is vulnerable to cross-site scripting when converting from SVG namespace...

dompurify vulnerable to Cross-site Scripting

dompurify prior to version 2.2.2 is vulnerable to cross-site scripting when converting from SVG namespace...

Cross-site Scripting (XSS)

inlinesvg is vulnerable to Cross-Site Scripting. The vulnerability exists because the placeholder function in helpers.rb does not properly escape the filename attribute before being rendered, allowing an attacker to inject and execute malicious JavaScript through a malicious SVG file...

Inline SVG vulnerable to Cross-site Scripting

A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...