414 matches found
CVE-2024-9539
An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to uplo...
CVE-2024-9539
An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to uplo...
PYSEC-2024-220
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users...
CVE-2024-47872 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users...
CVE-2024-47872 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users...
GHSA-GVV6-33J7-884G Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users download or view...
Cross Site Scripting(XSS)
LibreNMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper validation and sanitization of user-uploaded SVG files, allowing users with the "admin" role to upload these files as backgrounds for custom maps without sufficient security checks, which enables...
PT-2024-40192 · Unknown · Camaleon Cms +1
Name of the Vulnerable Software and Affected Versions: Camaleon CMS affected versions not specified Description: A stored cross-site scripting issue has been found in the image upload functionality, allowing normal registered users to upload SVG images containing JavaScript or HTML documents by...
Cross-site Scripting (XSS)
Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the image upload functionality. An attacker can execute arbitrary JavaScript on behalf o...
USN-6200-1: ImageMagick vulnerabilities | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that ImageMagick incorrectly handled the “-authenticate” option for password-protected PDF files. An attacker could possibly use this issue to inject additional...
The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows attackers to carry out attacks using cross-site scripting.
The vulnerability of the GLPI system’s request and incident handling functionality lies in the lack of cleaning during the loading of SVG files, as well as the integration of JavaScript into user avatars. Exploiting this vulnerability allows a malicious actor to carry out an attack using cross-si...
Ubuntu 20.04 LTS / 22.04 LTS : ImageMagick vulnerabilities (USN-6200-2)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6200-2 advisory. USN-6200-1 fixed vulnerabilities in ImageMagick. Unfortunately these fixes were incomplete for Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. This...
GHSA-52CW-PVQ9-9M5V Silverstripe uses TinyMCE which allows svg files linked in object tags
Impact TinyMCE v6 has a configuration value convertunsafeembeds set to false which allows svg files containing javascript to be used in or tags, which can be used as a vector for XSS attacks. Note that tags are not allowed by default. After patching the default value of convertunsafeembeds will b...
SS-2024-001 - TinyMCE allows svg files linked in object tags
More info at https://www.silverstripe.org/download/security-releases/ss-2024-001...
CVE-2024-3111
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues...
PT-2024-23779 · WordPress · Interactive Content
Name of the Vulnerable Software and Affected Versions: Interactive Content WordPress plugin versions prior to 1.15.8 Description: The issue arises from the lack of validation for uploads, which could allow Contributors and above to update malicious SVG files. This leads to Stored Cross-Site...
H5P < 1.15.8 - Contributor+ Stored XSS
Description The plugin does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues PoC 1. Upload an H5P archive containing a malicious SVG file w/an XSS 2. Example:...
RHEL 7 : perl-image-info (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - perl-Image-Info: XXE in SVG files CVE-2016-9181 Note that Nessus has not tested for this issue but has instead reli...
