DEBIAN-CVE-2021-3596

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt and uses the value directly, which leads to a crash and segmentation fault...

CVE-2021-3596

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt and uses the value directly, which leads to a crash and segmentation fault...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

CVE-2021-44607

FUEL-CMS 1.5.1 is affected by a Cross-Site Scripting (XSS) vulnerability in the Assets page via an SVG file. The root cause, per CNVD-2022-71119, is lack of proper validation of client-side data by the web application. Affected product: FUEL-CMS (Codeligniter-based CMS). Concretely, the issue is ...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

PT-2022-12184

Name of the Vulnerable Software and Affected Versions FUEL-CMS version 1.5.1 Description A Cross Site Scripting XSS issue exists in the Assets page via an SVG file. This allows for potential malicious script execution. Recommendations For FUEL-CMS version 1.5.1, consider restricting the upload of...

PT-2022-11895

Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 4.2.1 Description A Cross Site Scripting XSS issue exists in the Create Page functionality of the admin Account via an SVG file. Recommendations For versions prior to 4.2.1, update to a version that contains a fix...

CVE-2021-44607: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

typo3 -- XSS vulnerability in svg-sanitize

The TYPO3 project reports: The SVG sanitizer library enshrined/svg-sanitize before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+x...

Sanitization bypass in SVG Sanitizer

The SVG sanitizer library enshrined/svg-sanitize before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+xml were not affected...

graphicsmagick:coder_SVG_fuzzer: Use-of-uninitialized-value in xmlParseInternalSubset

Detailed Report: https://oss-fuzz.com/testcase?key=5033510363070464 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderSVGfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: xmlParseInternalSubset...

CVE-2022-23646

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface UI Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in...

CVE-2022-23646

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface UI Misrepresentation of Critical Information. In order to be affected, the "next.config.js" file must have an "images.domains" array assigned and the image host assigned...

CVE-2022-23646: User Interface (UI) Misrepresentation of Critical Information

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface UI Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in...

PT-2022-16157

Name of the Vulnerable Software and Affected Versions Next.js versions 10.0.0 through 12.1.0 Description Next.js is a React framework vulnerable to User Interface UI Misrepresentation of Critical Information. To be affected, the next.config.js file must have an images.domains array assigned, and...

WS-2022-0082

Helpy application in versions 1.0 to 2.8.0 is affected by Stored XSS vulnerability, where an unprivileged user can upload an SVG file that contains malicious JavaScript while creating a ticket...

Lxml Class Cleaner XSS

The vulnerability of the Class Cleaner module implemented by the Lxml library for processing XML and HTML markup is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using...