403 matches found
CVE-2021-36787: Improper Neutralization of Input During Web Page Generation
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document...
CVE-2021-26699
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used...
Server side request forgery (ssrf)
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used...
CVE-2021-26699
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used...
CVE-2021-26699: Server-Side Request Forgery (SSRF)
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used...
CVE-2019-25046
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document...
CVE-2019-25046
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document...
CVE-2019-25046: Improper Neutralization of Input During Web Page Generation
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document...
CVE-2021-25278
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...
CVE-2021-25278: Improper Neutralization of Input During Web Page Generation
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...
Design/Logic Flaw
An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...
CVE-2020-14988: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...
Cross-site Scripting (XSS)
xwiki-commons is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary script via an SVG document to the upload feature of the comment section...
Design/Logic Flaw
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137: Improper Neutralization of Input During Web Page Generation
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2019-16955
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...
Cross site request forgery (csrf)
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...
CVE-2019-16955: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...
