15011 matches found
Caldera code-related vulnerabilities
Caldera is a suite of software from the French company Caldera that provides color management, imaging and processing solutions for printer devices. A code issue exists in Caldera where the Debrief plug-in receives base64-encoded "SVG" parameters that are parsed incorrectly when the product...
CVE-2021-42560: Improper Restriction of XML External Entity Reference
An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks e.g., File Exfiltration, Server Side Request Forgery, Out of Band...
CVE-2022-22116
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...
Cross site scripting
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...
CVE-2022-22116 Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...
CVE-2022-22116
Directus Vulnerability: CVE-2022-22116 affects Directus versions 9.0.0-alpha.4 through 9.4.1 with a stored XSS via SVG file uploads in the media upload flow. Root cause: improper handling of SVG uploads allowing injection of arbitrary JavaScript, executed when a victim opens the image URL. Impact...
CVE-2022-22116
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...
CVE-2022-22116 Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...
PT-2022-15253
Name of the Vulnerable Software and Affected Versions Directus versions 9.0.0-alpha.4 through 9.4.1 Description The issue is related to a stored Cross-Site Scripting XSS vulnerability via SVG file upload in the media upload functionality. A low-privileged attacker can inject arbitrary JavaScript...
scratch-svg-renderer cross-site scripting vulnerability
scratch-svg-renderer is a code library used by the Scratch team to convert SVG to DOM elements. scratch-Svg-Renderer suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications, which can be exploited to execute client-si...
CVE-2022-22116: Improper Neutralization of Input During Web Page Generation
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...
XSS via SVG Construction contract
Handle thankyou Vulnerability details Impact SVG is a unique type of image file format that is often susceptible to Cross-site scripting. If a malicious user is able to inject malicious Javascript into a SVG file, then any user who views the SVG on a website will be susceptible to XSS. This can...
@cybergenios/scratch-gui (>=1.8.20, <=1.8.30), @cybergenios/www (>=1.0.2, <=1.0.3) +47 more potentially affected by CVE-2020-27428 via scratch-svg-renderer (>=0.1.0-prerelease.20180524210316, <=0.2.0)
scratch-svg-renderer NPM version =0.1.0-prerelease.20180524210316, =1.8.20, =1.0.2, =1.3.0, =0.1.0-raspberrypifoundation.20210805151219, =0.1.0, =1.0.0-alpha.1, =0.0.1, =0.1.0, =0.0.1-0, =3.0.10, =0.1.0, =0.1.1 and more Source cves: CVE-2020-27428 Source advisory: OSV:GHSA-H3VQ-WV8J-36GW...
@cybergenios/scratch-gui (>=1.8.20, <=1.8.30), @cybergenios/www (>=1.0.2, <=1.0.3) +47 more potentially affected by CVE-2020-27428 via scratch-svg-renderer (>=0.1.0-prerelease.20180524210316, <=0.2.0)
scratch-svg-renderer NPM version =0.1.0-prerelease.20180524210316, =1.8.20, =1.0.2, =1.3.0, =0.1.0-raspberrypifoundation.20210805151219, =0.1.0, =1.0.0-alpha.1, =0.0.1, =0.1.0, =0.0.1-0, =3.0.10, =0.1.0, =0.1.1 and more Source cves: CVE-2020-27428 Source advisory: GHSA-H3VQ-WV8J-36GW...
Cross-site Scripting in Scratch-Svg-Renderer
A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...
GHSA-H3VQ-WV8J-36GW Cross-site Scripting in Scratch-Svg-Renderer
A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...
OESA-2022-1482 python-lxml security update
XML processing library combining libxml2/libxslt with the ElementTree API. Security Fixes: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG...
Cross-site Scripting (XSS)
mermaid is vulnerable to cross-site scripting. The vulnerability exists in the sanitizeUrl function in the svgDraw.js, allowing an attacker to inject and execute malicious javascript through the malicious diagrams...