11125 matches found
CLSA-2023-1689258261 Fix CVE(s): CVE-2022-32546, CVE-2023-34151
SECURITY UPDATE: undefined behaviors of casting double to sizet in svg, mvg and other coders recurring bugs of CVE-2022-32546 - debian/patches/CVE-2023-34151.patch: properly cast double to sizet - CVE-2023-34151...
CVE-2023-2529
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2023-2529
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
Design/Logic Flaw
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2023-2529 Enable SVG Uploads <= 2.1.5 - Author+ Stored XSS via SVG
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2023-2529
CVE-2023-2529 concerns the WordPress plugin Enable SVG Uploads (<= 2.1.5). The issue is that uploaded SVGs are not sanitized, allowing a user with as little as Author privileges to upload an SVG containing an XSS payload. Reported details describe a stored XSS via SVG, with the vulnerable vers...
inkscape1 bug fix update
An update is available for inkscape1. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Inkscape is a vector graphics editor, with capabilities similar to...
CVE-2023-37269
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...
Cross site scripting
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...
GHSA-WJW2-4J7J-6GC3 Winter CMS stored XSS through privileged upload of SVG file
Impact Users with the backend.managebranding permission can upload SVGs as the application logo. Previously, SVG uploads were not sanitized, which could have allowed a stored XSS attack. Although this was a security issue, it's important to note that its severity is low. To exploit the...
Winter CMS stored XSS through privileged upload of SVG file
Impact Users with the backend.managebranding permission can upload SVGs as the application logo. Previously, SVG uploads were not sanitized, which could have allowed a stored XSS attack. Although this was a security issue, it's important to note that its severity is low. To exploit the...
CVE-2023-37269 Winter CMS vulnerable to stored XSS through privileged upload of SVG file
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...
CVE-2023-37269
Winter CMS is vulnerable to a stored XSS due to unsanitized SVG uploads in the branding logo function prior to v1.2.3. The issue requires an attacker with backend.manage_branding permission (or higher) and user interaction by visiting the URL of the malicious SVG; exploitation is further constrai...
CVE-2023-37269 Winter CMS vulnerable to stored XSS through privileged upload of SVG file
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...
PT-2023-25872 · Unknown · Winter Cms
Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.3 Description: The issue concerns a stored cross-site scripting XSS attack that could be executed by uploading malicious SVG files as the application logo. Users with the backend.manage branding permission can...
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Antlers sanitizer cannot effectively sanitize malicious SVG Summary The SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform XSS attacks using SVG, even when using the sanitize function. Details Regarding the previous discussion mentioned here,...
GHSA-6R5G-CQ4Q-327G Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Antlers sanitizer cannot effectively sanitize malicious SVG Summary The SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform XSS attacks using SVG, even when using the sanitize function. Details Regarding the previous discussion mentioned here,...
Cross-Site Scripting (XSS)
statamic/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability exists in the index function at Svg.php because the SVG tag does not sanitize malicious SVG which allows an attacker to inject and execute arbitrary JavaScript...
CVE-2023-36828
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the sanitize function. Versio...
Cross site scripting
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the sanitize function. Versio...