UBUNTU-CVE-2022-34475

SVG use tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects...

[SECURITY] Fedora 36 Update: golang-github-pelletier-toml-1.9.4-2.fc36

Go-toml provides the following features for using data parsed from TOML documents: - Load TOML documents from files and string data - Easily navigate TOML structure using Tree - Mashaling and unmarshaling to and from data structures - Line & column position data for all parsed elements - Query...

[SECURITY] Fedora 36 Update: golang-github-mmarkdown-mmark-2.2.10-5.fc36

Mmark is a powerful markdown processor written in Go, geared towards writing IETF documents. It is, however, also suited for writing complete books and ot her technical documentation, like the Learning Go book mmark source, and I-D text output...

Mozilla Thunderbird < 91.11

The version of Thunderbird installed on the remote Windows host is prior to 91.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-26 advisory. - The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showe...

Denial Of Service (DoS)

firefox is vulnerable to denial of service. The vulnerability exists during the navigations between XML documents causing a use-after-free which then leads an application crash...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious...

PT-2022-20500

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 13.9.99.111 Description The issue arises from the improper escaping of a document's title in the search result of the MyDocmanSearch widget and in the administration page of locked documents. This could allow a malicio...

Tuleap 跨站脚本漏洞

Tuleap is an application lifecycle management system that facilitates agile software development, design projects, V-models, requirements management and IT service management.A cross-site scripting vulnerability exists in versions prior to Tuleap 13.9.99.111, which stems from a failure to properl...

silverstripe framework 资源管理错误漏洞

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.8.1. An attacker can exploit this vulnerability to conduct remote attacks via specially crafted XML documents...

PT-2022-11429 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.8.1 through 4.10.9 Description: The issue is related to a quadratic blowup in the Convert::xml2array function, which can be exploited via a crafted XML document to enable a remote attack...

MantisBT XSS through crafted SVG documents in file_download.php

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the filedownload.php process. An attacker can execute arbitrary JavaScript code by attaching and triggering malicious SVG documents. Details Cross-site scripting or...

GHSA-QGHG-V7XV-Q98Q MantisBT XSS through crafted SVG documents in file_download.php

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

CVE-2022-33910

CVE-2022-33910 affects MantisBT before 2.25.5. Affected area: attaching crafted SVG documents to issue reports or bugnotes. Root cause: file_download.php opens the SVG in a browser tab instead of downloading it as a file, enabling JavaScript execution in the context of the user’s browser. Impact:...

CVE-2022-33910: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

The vulnerability of the library for viewing, printing, rendering, creating, and processing PDF files. The PDFTron SDK software from Autodesk allows a perpetrator to execute arbitrary code.

The vulnerability of the PDFTron SDK software’s library for viewing, printing, rendering, creating, and processing PDF files is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code in the context of the current...

MAL-2022-3578 Malicious code in head-dlb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c4e3fe4404a2dcb3ba9f86c02229e85e2bf8bceff38f5f7f0e00afec38faec7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb586cca0b2de02fff1057f548dba4887dd3b2ffaec498d2fb80432bef8ec9f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d766a559ac60a5a49bdcf49f60e171420b152d4eb98b8f941c094927f0a5058 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5989 Malicious code in search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d766a559ac60a5a49bdcf49f60e171420b152d4eb98b8f941c094927f0a5058 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...