15008 matches found
PT-2022-21098
Name of the Vulnerable Software and Affected Versions Known versions 1.2.2 through 1.3.1 Description An issue in the isSVG function allows attackers to execute arbitrary code via a crafted SVG file. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Recommendations For...
CVE-2022-32115: Improper Neutralization of Input During Web Page Generation
An issue in the isSVG function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file...
Vega Charts Kibana Cross-Site Scripting Vulnerability
Vega is a Javscript-based software from the Vega team that can be used to create interactive visual displays. The software can use JSON format to describe the data visualization and use HTML5 Canvas or SVG to generate interactive views. A cross-site scripting vulnerability exists in Vega Charts...
Known XSS vulnerabilities
Known is a social publishing platform open-sourced by Known in the United States. A security vulnerability exists in Known v1.3.1 and below, which stems from an issue with the isSVG function that allows an attacker to execute arbitrary code via a crafted SVG file...
CVE-2022-33098: Improper Neutralization of Input During Web Page Generation
Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting XSS vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture...
Magnolia CMS 6.2.19 Cross Site Scripting Vulnerability
Exploit Title: Magnolia CMS = 6.2.19 - Stored Cross-Site Scripting XSS Exploit Author: Giulio Garzia 'Ozozuz' Vendor Homepage: https://www.magnolia-cms.com/ Software Link:...
Stored XSS via SVG File
Description By uploading SVG files, the users can perform Stored XSS attack. Payload Copy the following code and save as filename.svg. alertdocument.domain Proof of Concept 1 Login as admin. 2 upload the payload injected SVG file at...
Fedora: Security Advisory for golang-github-ajstarks-deck (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Magnolia CMS 6.2.19 Cross Site Scripting
Exploit Title: Magnolia CMS = 6.2.19 - Stored Cross-Site Scripting XSS Date: 08/05/2022 Exploit Author: Giulio Garzia 'Ozozuz' Vendor Homepage: https://www.magnolia-cms.com/ Software Link:...
Fedora: Security Advisory for golang-github-tdewolff-minify (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
UBUNTU-CVE-2022-34473
The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however it incorrectly did not sanitize xlink:href attributes. This vulnerability affects Firefox 102...
UBUNTU-CVE-2022-34475
SVG use tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects...
CVE-2022-34473
The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however it incorrectly did not sanitize xlink:href attributes. This vulnerability affects Firefox 102...
CVE-2022-34475
SVG use tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects...
Cross-Site Scripting (XSS)
microweber/microweber is vulnerable to stored cross-site scripting. The vulnerability exists in plupload.php because SVG content is not properly sanitized which allows an attacker to inject and execute malicious javascript on the users who will open the link of the SVG file...
[SECURITY] Fedora 36 Update: golang-github-tdewolff-minify-2.11.10-3.fc36
Minify is a minifier package written in Go. It provides HTML5, CSS3, JS, JSON, SVG and XML minifiers and an interface to implement any other minifier. Minification is the process of removing bytes from a file such as whitespace without changing its output and therefore shrinking its size and...
[SECURITY] Fedora 36 Update: golang-github-ajstarks-deck-0-0.12.20210114git30c9fc6.fc36
Deck is a library for clients to make scalable presentations, using a standard markup language. Clients read deck files into the Deck structure, and traverse the structure for display, publication, etc. Clients may be interactive or produce standard formats such as SVG or PDF...
WordPress Allow SVG Files plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Luan Pedersini in WordPress Allow SVG Files plugin versions = 1.1. Solution Deactivate and delete. This plugin has been closed as of July 1, 2022 and is not available for download. This closure is temporary, pending a full...
xss via svg file
Description xss via svg file Proof of Concept 1. goto your account and create a document under a collection .\ 2. Now edit this document and upload bellow svg file in this document content as image filename--evil.svg alert'Thais app is probably vulnerable to XSS attackss!'; 3. after upload open...
