1875 matches found
CVE-2021-25978 Apostrophe - XSS
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed...
CamaleonCMS Denial of Service Vulnerability
CamaleonCMS is a RubyonRails-based advanced dynamic content management system CMS from the Camaleon CMS team.A denial-of-service vulnerability exists in Camaleon CMS versions 2.0.1 through 2.6.0, which stems from a vulnerability to uncaught exceptions in Camaleon CMS. An attacker with low privile...
Improper Error Handling
camaleoncms has improper error handling. The vulnerability exists due to an uncaught exception, allowing an attacker to upload a maliciously crafted .svg file...
CVE-2021-25971
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file...
Design/Logic Flaw
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file...
CVE-2021-25971 Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file...
CVE-2021-25971 Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file...
Cross-site Scripting (XSS) - Reflected in tsolucio/corebos
Description Reflected XSS via upload of malicious SVG file. Proof of Concep 1: Upload SVG file via /corebos/index.php?module=Documents&action=DetailView&viewname=0&start=&record=8460& alertdocument.location; 2: Trigger the reflected XSS by visiting the malicious SVG file stored in the storage...
openSUSE: Security Advisory for libqt5-qtsvg (openSUSE-SU-2021:3354-1)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
SUSE SLED15: libQt5Svg5 / libqt5-qtsvg-devel / etc (SUSE-SU-2021:3354-1)
The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3354-1 advisory. - CVE-2021-3481: Fixed an out of bounds read in function QRadialFetchSimd from crafted svg file. bsc1184783 Tenable has extracted the preceding...
SUSE-SU-2021:3333-1 Security update for libqt5-qtsvg
This update for libqt5-qtsvg fixes the following issues: - CVE-2021-3481: Fixed an out of bounds read in function QRadialFetchSimd from crafted svg file. bsc1184783...
Online Traffic Offense Management System 1.0 Cross Site Scripting
Exploit Title: Online Traffic Offense Management System 1.0 - Multiple XSS Unauthenticated Date: 07/10/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link:...
Online Traffic Offense Management System 1.0 - Multiple XSS (Unauthenticated)
Exploit Title: Online Traffic Offense Management System 1.0 - Multiple XSS Unauthenticated Date: 07/10/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link:...
Cross site scripting
Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting XSS. The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigge...
CVE-2021-37330
Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting XSS. The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigge...
GHSA-6675-WWQR-JHMF Cross-site Scripting in GilaCMS
A stored cross-site scripting XSS vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...
Memory corruption
Adobe Premiere Pro version 15.4 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a special...
CVE-2021-40710 Adobe Premiere Pro 2021 SVG File Parsing Leads to Memory Corruption
Adobe Premiere Pro version 15.4 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a special...