15005 matches found
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS which leads to excessive backtracking when attempting to sanitize certain SVG attributes. This can lead to CPU resource consumption. Details Denial of Service DoS describes a family of attacks,...
GHSA-228G-948R-83GX Improper neutralization of data URIs may allow XSS in Loofah
Summary Loofah = 2.1.0, = 2.19.1. Severity The Loofah maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type image/svg+xml is misleading to developers · Issue 266 ·...
Cross-site Scripting (XSS)
Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper neutralization of data URIs, via the image/svg+xml media type. Details...
Inefficient Regular Expression Complexity in rails-html-sanitizer
Summary Certain configurations of rails-html-sanitizer = 1.4.4...
Inefficient Regular Expression Complexity in Loofah
Summary Loofah = 2.19.1...
PT-2022-16044
Name of the Vulnerable Software and Affected Versions Loofah versions prior to 2.19.1 Description Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. It contains an inefficient regular expression that is susceptible to excessiv...
UBUNTU-CVE-2022-45283
GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smilparsetimelist parameter at /scenegraph/svgattributes.c...
Nextcloud: Contacts only sanitizes PHOTO svg if mime type is all lower case
Vulnerability description not provided...
WordPress SVG Icons Plugin Arbitrary File Upload (CVE-2022-0863)
An arbitrary file upload vulnerability exists in WordPress SVG Icons plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
WordPress SVG Support Plugin 2.5 - 2.5.1 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:benbodhi:svgsupport"; ifdescription...
Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike
CVE-2022-39197 RCE POC Reference Links https://mp...
USN-5736-1: ImageMagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain values when processing PDF files. If a user or automated system using ImageMagick were tricked into opening a specially crafted PDF file, an attacker could exploit this to cause a denial of service. This issue only affected Ubuntu 14....
An unrestricted upload file lead to a stored XSS via SVG file.
Description During the test, I discovered that the upload function accepted svg files without any sanitization, allowing me to inject javascript code into the svg file and store it, as well as execute the javascript code via the svg file. Proof of Concept // PoC.js...
Stored XSS in kiwiTCMS
Description Stored XSS, also known as persistent XSS, is the more damaging of the XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Due to a sanitization problem it is possible to perform a Stored XSS. The problem is that the upload function permit...
SVG Parser SVG Parse Buffer Overflow DoS
The vulnerability of the svgparsepreserveaspectratio function in the SVG Parser component of the GPAC multimedia platform is related to improper cleaning or release of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...
SUSE-SU-2022:4075-1 Security update for rubygem-loofah
This update for rubygem-loofah fixes the following issues: - CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements bsc1154751...
WordPress SVG Support Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...
GHSA-GMF5-Q34V-VWVP Cross-site Scripting in Zenario
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting XSS via svg, Users & Contacts...
