CVE-2020-20695

A stored cross-site scripting XSS vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...

CVE-2021-39823

Adobe svg-native-viewer 8182d14dfad5d1e10f53ed830328d7d9a3cfa96d and earlier versions are affected by a heap buffer overflow vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is...

Buffer overflow

Adobe Photoshop versions 21.2.11 and earlier and 22.5 and earlier are affected by a Buffer Overflow vulnerability when parsing a specially crafted SVG file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user...

CVE-2021-40709 Adobe Photoshop Buffer Overflow leads to Arbitrary Code Execution

Adobe Photoshop versions 21.2.11 and earlier and 22.5 and earlier are affected by a Buffer Overflow vulnerability when parsing a specially crafted SVG file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user...

Adobe Photoshop 21.x < 21.2.12 / 22.x < 22.5.1 Vulnerability (APSB21-84)

The version of Adobe Photoshop installed on the remote Windows host is prior to 21.2.12/22.5.1. It is, therefore, affected by a vulnerability as referenced in the apsb21-84 advisory. - Adobe Photoshop versions 21.2.11 and earlier and 22.5 and earlier are affected by a Buffer Overflow vulnerabilit...

Adobe Photoshop 21.x < 21.2.12 / 22.x < 22.5.1 Vulnerability (macOS APSB21-84)

The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 21.2.12/22.5.1. It is, therefore, affected by a vulnerability as referenced in the apsb21-84 advisory. - Adobe Photoshop versions 21.2.11 and earlier and 22.5 and earlier are affected by a Buffer Overflow...

Cross-site Scripting (XSS) - Stored in alanaktion/phproject

✍️ Description stored xss via svg file upload 🕵️‍♂️ Proof of Concept Here i uses demo site https://demo.phproject.org .\ 1. First goto any project and upload a svg file https://github.com/ranjit-git/poc/blob/master/evilsvgfile.svg .\ 2. Now open this svg file using url like...

CVE-2021-36077

Adobe Bridge version 11.1 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in local application denial of service in the context of the current user. User interaction is required to exploit this vulnerability...

Improper access control

Adobe Media Encoder version 15.1 and earlier is affected by an improper memory access vulnerability when parsing a crafted .SVG file. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a...

CVE-2021-36077

Adobe Bridge 11.x before 11.1.1 is vulnerable to a memory corruption issue caused by improper handling of crafted SVG files, potentially allowing local denial of service in the context of the current user. Exploitation requires user interaction. This is CVE-2021-36077 and is listed among vulnerab...

CVE-2021-36077 Adobe Bridge SVG File Memory Corruption Could Lead To Application Denial Of Service

Adobe Bridge version 11.1 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in local application denial of service in the context of the current user. User interaction is required to exploit this vulnerability...

CVE-2021-37794

A stored cross-site scripting XSS vulnerability exists in FileBrowser v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the...

CVE-2021-36010 Adobe Illustrator SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Illustrator version 25.2.3 and earlier is affected by an out-of-bounds read vulnerability that could lead to disclosure of memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must ope...

Cross-Site Scripting in Extension "femanager" (femanager)

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website...

Cross-site Scripting (XSS) - Stored in kalcaddle/kodexplorer

✍️ Description XSS via SVG file Upload 🕵️‍♂️ Proof of Concept upload the svg file with xss payload and open it with browser alertdocument.domain; 💥 Impact Custom JS code execution embedded with in the svg file...

WordPress WP SVG images Plugin Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL server set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress WP S...

Huawei EulerOS: Security Advisory for netpbm (EulerOS-SA-2021-2107)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Server-Side Request Forgery (SSRF) in chatwoot/chatwoot

✍️ Description SSRF via SVG file upload 🕵️‍♂️ Proof of Concept create a new inbox, change its avatar to an SVG file with SSRF payload in it. and open the image in a new tab. 💥 Impact Host redirect...

EulerOS Virtualization for ARM 64 3.0.2.0 : netpbm (EulerOS-SA-2021-2107)

According to the version of the netpbm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the...

Open Redirect in kalcaddle/kodexplorer

✍️ Description Open redirection via SVG file uplaod which redirects users to different site. 🕵️‍♂️ Proof of Concept Steps to reproduce: 1. download and upload the file https://drive.google.com/file/d/1yt4-5lgFS7ZGJog1uXAQ5rMxKGgVq/view?usp=sharing 2. View the file. 💥 Impact This vulnerability is...