CVE-2022-42890

CVE-2022-42890 is a vulnerability in Apache Batik (XML Graphics Project) that allows an attacker to run arbitrary Java code from untrusted SVG via JavaScript. The issue affects Apache Batik prior to version 1.16; multiple advisories note upgrading to 1.16 or newer as the remediation (e.g., Debian...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

CVE-2022-39197-RCE First This project was modified from...

CVE-2022-38901

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

Cross site scripting

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

CVE-2022-38901

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

CVE-2022-38901: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

CVE-2022-38901

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

PT-2022-24614 · Liferay · Liferay Digital Experience Platform

Name of the Vulnerable Software and Affected Versions: Liferay Digital Experience Platform version 7.3.10 SP3 Description: A Cross-site scripting XSS issue exists in the file upload functionality of the Document and Media module, allowing remote attackers to inject arbitrary JS script or HTML int...

Adobe InCopy Buffer Overflow

The vulnerability of the Adobe InCopy text creation and editing software is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created SVG file...

PT-2022-6964 · Mozilla +3 · Firefox +3

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 106 Description: A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have led to memory corruption or a potentially exploitable crash...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

CVE-2022-39197 RCE POC Usage - Prepare Payload 1...

WordPress Taskbuilder Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Taskbuilder plugin versions prior to 1.0.8 have a cross-site scripting vulnerability that stems fro...

CVE-2022-41200

Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic .svg, svg.x3d file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based...

Stack overflow

Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic .svg, svg.x3d file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based...

CVE-2022-41200: Improper Restriction of Operations within the Bounds of a Memory Buffer

Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic .svg, svg.x3d file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based...

CVE-2022-41200

Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic .svg, svg.x3d file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based...

WordPress SVG Support Plugin < 2.5 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:benbodhi:svgsupport"; ifdescription...

CVE-2022-41200

SAP 3D Visual Enterprise Viewer (version 9) is affected by CVE-2022-41200 due to improper memory management when parsing manipulated SVG/.svg.x3d files from untrusted sources, enabling Remote Code Execution via a stack-based overflow or re-use of a dangling pointer to overwritten memory. The issu...

CVE-2022-3137

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user such as subscriber creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file...

CVE-2022-3137: Improper Neutralization of Input During Web Page Generation

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user such as subscriber creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file...