15011 matches found
CVE-2021-43841
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...
CVE-2021-43841
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...
Default configuration
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...
CVE-2021-43841 XSS by SVG upload in xwiki-platform
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...
CVE-2021-43841
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...
CVE-2021-43841
CVE-2021-43841 — XWiki Platform SVG upload XSS . In the default XWiki configuration, an attacker could upload an SVG containing a script that executes when a user performs a file download. The issue has been mitigated by patching the default configuration to stop displaying SVG files in the brows...
CVE-2021-43841 XSS by SVG upload in xwiki-platform
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...
CVE-2021-43841: Improper Neutralization of Input During Web Page Generation
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...
PT-2022-11917
Name of the Vulnerable Software and Affected Versions XWiki affected versions not specified Description The issue allows an attacker to upload an SVG file containing a script that is executed when the download action is performed on the file, due to the default XWiki configuration. This can be...
PT-2022-2948
Name of the Vulnerable Software and Affected Versions Adobe InDesign versions 17.2.1 and earlier Adobe InDesign versions 16.4.1 and earlier Description The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user...
CVE-2021-24686
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24686
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24686
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24686
The CVE-2021-24686 entry concerns the WordPress SVG Support plugin prior to 2.3.20, where the plugin fails to escape the CSS Class to target setting when output in an attribute. This allows XSS by high-privilege users, even if unfiltered_html is disallowed. Public sources in connected docs confir...
GHSA-7X22-PMW5-66MQ Cross-site Scripting in showdoc
Stored XSS via upload attachment with format .svg in File Library...
Cross-site Scripting in showdoc
Stored XSS via upload attachment with format .svg in File Library...
WordPress Plugin SVG Support Cross-Site Script Vulnerability
WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress SVG Support plugin in versions prior to 2.3.20 suffers from a cross-site scripting vulnerability, which stems from a lack of data validation filtering of user-supplied data and output...
CVE-2021-24686: Improper Neutralization of Input During Web Page Generation
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
Bluffy - Convert Shellcode Into Different Formats!
Bluffy is a utility which was used in experiments to bypass Anti-Virus products statically by formatting shellcode into realistic looking data formats. Proof-of-concept tools, such as 0xBoku's NinjaUUIDRunner and ChoiSG's UuidShellcodeExec, inspired the initial concept for Bluffy. So far, we...