Cross site scripting

Cross-Site Scripting XSS vulnerability in KubiQ's PNG to JPG plugin = 4.0 at WordPress via Cross-Site Request Forgery CSRF. Vulnerable parameter &jpgquality...

CVE-2022-29430

CVE-2022-29430 describes a cross-site scripting vulnerability in the WordPress PNG to JPG plugin (versions up to 4.0). The flaw allows stored XSS when CSRF enables an admin action that updates plugin settings, with the vulnerable parameter being “jpg_quality.” Root cause is lack of CSRF protectio...

CVE-2022-29430 WordPress PNG to JPG plugin <= 4.0 - Cross-Site Request Forgery (CSRF) leading to Persistent Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability in KubiQ's PNG to JPG plugin = 4.0 at WordPress via Cross-Site Request Forgery CSRF. Vulnerable parameter &jpgquality...

SUSE-SU-2022:1762-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2022-28463: Fixed buffer overflow in coders/cin.c bsc1199350. Bugfixes: - Use pnggeteXIf1 when available bsc1197147...

Improper Input Validation in Apache Batik

XML external entity XXE vulnerability in the SVG to 1 PNG and 2 JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file...

GHSA-WFW6-MMMP-87XM Improper Input Validation in Apache Batik

XML external entity XXE vulnerability in the SVG to 1 PNG and 2 JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file...

Tiki Wiki CMS XSS Vulnerability

Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS...

Pillow denial of service via PNG bomb

Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed...

GHSA-H5RF-VGQX-WJV2 Pillow denial of service via PNG bomb

Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed...

CVE-2022-29430

Cross-Site Scripting XSS vulnerability in KubiQ's PNG to JPG plugin = 4.0 at WordPress via Cross-Site Request Forgery CSRF. Vulnerable parameter quality...

PNG to JPG < 4.1 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check in place when updating its settings, allowing attackers to make a logged in admin do such action via a CSRF attack which could lead to Stored XSS issues due to the lack of sanitisation and escaping in some of them...

WordPress PNG to JPG plugin <= 4.0 - Cross-Site Request Forgery (CSRF) leading to Persistent Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF leading to Persistent Cross-Site Scripting XSS vulnerability discovered by Ex.Mi Patchstack in WordPress PNG to JPG plugin versions = 4.0. Solution Update the WordPress PNG to JPG plugin to the latest available version at least 4.1...

IBM Java 6.0 < 6.0.16.20 / 6.1 < 6.1.8.20 / 7.0 < 7.0.9.30 / 7.1 < 7.1.3.30 / 8.0 < 8.0.2.10 Multiple Vulnerabilities (Jan 1, 2016)

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.20 / 6.1 6.1.8.20 / 7.0 7.0.9.30 / 7.1 7.1.3.30 / 8.0 8.0.2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update January 2016 advisory. - The J9 JVM in IBM SDK, Java Technolo...

Security advisory: Recently reported zlib compression issue impacts Qt

zlib has recently reported that it has a security issue when deflating which could cause memory corruption if the input has many distant matches. This is reported in a bit more detail here: and has been assigned the CVE id CVE-2018-25032. This has been fixed in an update to zlib 1.2.12 This affec...

DEBIAN-CVE-2022-27938

stbimage.h aka the stb image loader 2.19, as used in libsixel and other products, has a reachable assertion in stbicreatepngimageraw...

UBUNTU-CVE-2022-27938

stbimage.h aka the stb image loader 2.19, as used in libsixel and other products, has a reachable assertion in stbicreatepngimageraw...

CVE-2022-27938

stbimage.h aka the stb image loader 2.19, as used in libsixel and other products, has a reachable assertion in stbicreatepngimageraw...

stb_image.h 安全漏洞

stb is a single-file public domain library for C/C ++. stbimage.h is one of the image loaders. A security vulnerability exists in stbimage.h aka stb image loader 2.19, which stems from an assertion error in stbicreatepngimageraw...

WordPress LearnPress Plugin < 4.1.5 Arbitrary Image Renaming Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Home Owners Collection Management System Remote Code Execution Vulnerability (CNVD-2022-19486)

A remote code execution vulnerability exists in Home Owners Collection Management System, a homeowner collection management system, which can be exploited by attackers to execute arbitrary code via a crafted PNG file...