330 matches found
Cross site scripting
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15...
UBUNTU-CVE-2020-16145
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15...
CVE-2020-16145
CVE-2020-16145 affects Roundcube Webmail prior to 1.3.15 and 1.4.8, where a crafted SVG in HTML messages can trigger stored XSS during display. Advisories confirm fixes in 1.3.15 and 1.4.8; remediation is to upgrade to these versions or newer. Occurrence details are supported by OpenSUSE/Tenable/...
CVE-2020-15015
The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document...
CVE-2020-15006
Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php...
Cross site scripting
Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php...
CVE-2020-15006
Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php...
CVE-2019-20860
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service application hang via a crafted SVG document...
Code injection
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service application hang via a crafted SVG document...
CVE-2019-20860
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service application hang via a crafted SVG document...
Cross site scripting
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow...
CVE-2020-11887
svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document...
Cross site scripting
svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document...
EulerOS 2.0 SP3 : qt (EulerOS-SA-2020-1431)
According to the version of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to...
Use-after-free
WebKitGTK+ is vulnerable to use-after-free. It is due to flaws caused via a 1 font-face or 2 use element in an SVG document, allowing an attacker to use malicious web content to crash or, potentially, execute arbitrary code with the privileges of the user running the application...
EulerOS 2.0 SP8 : qt (EulerOS-SA-2020-1299)
According to the version of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to...
EulerOS 2.0 SP5 : qt (EulerOS-SA-2020-1323)
According to the version of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to...
CVE-2020-8777
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document...
Design/Logic Flaw
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document...