398 matches found
SUSE CVE-2020-1766
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...
SUSE CVE-2021-3596
A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt and uses the value directly, which leads to a crash and segmentation fault...
WordPress Interactive SVG Image Map Builder Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software Interactive SVG Image Map Builder Type Plugin Vulnerable versions = 1.0 Fixed in 1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25704 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9e6397036265 Credits Lokesh...
PT-2023-1267 · Dompdf +1 · Dompdf +1
Name of the Vulnerable Software and Affected Versions: Dompdf version 2.0.1 Dompdf versions prior to 8.0.0 Description: The issue is related to the incorrect order of authorization checks before syntax analysis and canonization when processing tags with uppercase letters in SVG parsing. This can...
Cross-site Scripting (XSS)
core.wcm.components.core is vulnerable to cross-site scripting. The vulnerability exists because the stream function of AdaptiveImageServlet.java does not properly encode the imageName attribute, allowing an attacker to inject and execute malicious javascript through the crafted SVG image...
CVE-2022-34179
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...
CVE-2022-34179
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...
Path traversal
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...
CVE-2022-34179
CVE-2022-34179 affects Jenkins Embeddable Build Status Plugin, version 2.0.3 and earlier. The vulnerability arises from an unrestricted style query parameter used to select SVG image styles, enabling relative path traversal to SVGs on the Jenkins controller filesystem. Exploitation is possible wi...
CVE-2022-34179
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...
CVE-2022-34179: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...
CVE-2022-30110
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
WordPress Tripetto plugin跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Tripetto plugin 5.1.4 and previous versions contain a cross-site scripting vulnerability th...
CVE-2021-36895
Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...
Cross site scripting
Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...
CVE-2021-36895
CVE-2021-36895: Unauthenticated XSS in WordPress Tripetto plugin versions <= 5.1.4 via SVG image upload. Root cause per CNVD/CNNVD entries is lack of filtering/escaping for uploaded SVG data. Affected: Tripetto WordPress plugin
CVE-2021-36895 WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload
Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...
CVE-2021-36895: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...
PT-2022-10593
Name of the Vulnerable Software and Affected Versions Tripetto plugin versions 5.1.4 and earlier Description The issue is an Unauthenticated Cross-Site Scripting XSS vulnerability. It occurs via SVG image upload. Recommendations For Tripetto plugin versions 5.1.4 and earlier, update to a version...