CVE-2013-6452

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file...

Cross site scripting

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file...

CVE-2013-6453

MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML...

CVE-2013-6452

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file...

CVE-2013-6452

CVE-2013-6452 affects MediaWiki prior to 1.19.10, 1.2x prior to 1.21.4, and 1.22.x prior to 1.22.1. The vulnerability enables remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file (XSS). Mitigation: upgrade to fixed MediaWiki versions listed in GLSA 201502-04 or v...

CVE-2013-6452

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file...

CVE-2013-6452

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file...

Ubuntu 12.04 LTS / 12.10 : gtk+3.0 update (USN-2149-2)

USN-2149-1 fixed a vulnerability in librsvg. This update provides a compatibility fix for GTK+ to work with the librsvg security update. It was discovered that librsvg would load XML external entities by default. If a user were tricked into viewing a specially crafted SVG file, an attacker could...

MediaWiki 'includes/upload/UploadBase.php'跨站脚本漏洞

BUGTRAQ ID：65910 CVE ID：CVE-2014-2242 MediaWiki是一款Wiki程序。 MediaWiki 'includes/upload/UploadBase.php'脚本跨站脚本漏洞。由于程序未能限制SVG文件使用无效的命名空间，远程攻击者可通过上传特制的SVG文件利用该漏洞实施跨站脚本攻击。 0 MediaWiki Mediawiki = 1.19.11 MediaWiki Mediawiki 1.20.x MediaWiki Mediawiki 1.21.x1.21.6 MediaWiki Mediawiki 1.22.x1.22.3 厂商补丁：...

CVE-2013-6074

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file...

Cross site scripting

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file...

CVE-2013-6074

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file...

CVE-2013-2031

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox...

Cross site scripting

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox...

Debian DSA-2724-1 : chromium-browser - several vulnerabilities

Several vulnerabilities have been discovered in the Chromium web browser. - CVE-2013-2853 The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n carriage return, newline, carriage return, newline. - CVE-2013-2867 Chrome does not properly prevent pop-under windows. -...

Debian Security Advisory DSA 2724-1 (chromium-browser - several vulnerabilities)

Several vulnerabilities have been discovered in the Chromium web browser. CVE-2013-2853 The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n carriage return, newline, carriage return, newline. CVE-2013-2867 Chrome does not properly prevent pop-under windows...

Mac OS X : Safari < 6.0.4 SVG File Handling Arbitrary Code Execution

Binary data 800995.prm...

Safari < 6.0.4 SVG File Handling Arbitrary Code Execution

Binary data 6762.prm...

PT-2013-1827 · Inkscape +1 · Inkscape +1

Name of the Vulnerable Software and Affected Versions: Inkscape versions prior to 0.48.4 Description: The issue concerns an XML external entity XXE injection attack in the rasterization process. This allows local users to read arbitrary files via an external entity in a SVG file. Recommendations:...

[SECURITY] Fedora 16 Update: inkscape-0.48.4-1.fc16

Inkscape is a vector graphics editor, with capabilities similar to Illustrator, CorelDraw, or Xara X, using the W3C standard Scalable Vector Graphics SVG file format. It is therefore a very useful tool for web designers and as an interchange format for desktop publishing. Inkscape supports many...