Safe SVG < 1.9.10 - SVG Sanitisation Bypass

The sanitisation step of the plugin can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent mainly XSS, but depending on further use of uploaded SVG...

Stored XSS viva .svg file upload

Description The application allows .svg files to upload which lead to stored XSS Proof of Concept 1.Download the payload from this link:- https://drive.google.com/file/d/1c1BP5bxXBxtwLfRJTrEPgMWK1yVFDF2R/view?usp=sharing and upload it on your profile. 2.Now open the path of the uploaded image...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

Default credentials

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2022-27246

CVE-2022-27246 : The connected records confirm an issue in MISP prior to 2.4.156 where an SVG organization logo is not forbidden by default. This may allow embedded JavaScript in the SVG to execute, as described in the initial entry. The documents do not provide explicit impact details beyond the...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2022-27246: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

PT-2022-18326

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.156 Description An issue was discovered where an SVG org logo, which may contain JavaScript, is not forbidden by default. Recommendations For versions prior to 2.4.156, update to version 2.4.156 or later to resolve t...

SUSE-SU-2022:0895-1 Security update for python-lxml

This update for python-lxml fixes the following issues: - CVE-2021-43818: Removed SVG image data URLs since they can embed script content bsc1193752. - CVE-2021-28957: Fixed a potential XSS due to improper input sanitization bsc1184177. - CVE-2020-27783: Fixed a potential XSS due to improper HTML...

CVE-2021-40734

Adobe Audition version 14.4 and earlier is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...

CVE-2021-40734

Adobe Audition version 14.4 and earlier is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...

Memory corruption

Adobe Audition version 14.4 and earlier is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...

CVE-2021-40734

Adobe Audition 14.4 and earlier is affected by a memory corruption vulnerability when parsing SVG files, potentially allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction. Affected product: Adobe Audition (Windows/macOS). Root cause: memory c...

CVE-2021-40734 Adobe Audition Memory Corruption could lead to Arbitrary code execution

Adobe Audition version 14.4 and earlier is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...

CVE-2021-40766 Adobe Character Animator SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Character Animator version 4.4 and earlier versions are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction i...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to stored cross-site scripting. The vulnerability exists due to lack of xss validations for uploaded SVG files before they get stored which allows an attacker to inject and execute arbitrary javascript...

CVE-2021-40734: Access of Memory Location After End of Buffer

Adobe Audition version 14.4 and earlier is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...