11161 matches found
GHSA-RRWX-8WM4-QHH4 GleamTech FileUltimate Cross-site Scripting
The FileExplorer component in GleamTech FileUltimate 6.1.5 allows XSS via an SVG document...
GleamTech FileUltimate Cross-site Scripting
The FileExplorer component in GleamTech FileUltimate 6.1.5 allows XSS via an SVG document...
GHSA-F6H3-66XR-HQR2 Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...
CVE-2020-15275
MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrad...
CVE-2022-24868
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user...
CVE-2019-12921
In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG...
Cross-site Scripting in Jirafeau
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
WordPress WP SVG Icons plugin <= 3.2.3 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability discovered by qerogram in WordPress WP SVG Icons plugin versions = 3.2.3. Solution Deactivate and delete. This plugin has been closed as of April 18, 2022 and is not available for download. This closure is temporary, pending a full review...
Oracle Linux 8 : qt5-qtsvg (ELSA-2022-1920)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1920 advisory. 5.15.2-4 - Fix out-of-bound write that may lead to DoS Resolves: bz2038487 Tenable has extracted the preceding description block directly from the Oracle Linux...
CVE-2022-30110
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
CVE-2022-30110
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
Cross site scripting
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
CVE-2022-30110
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
Remote Code Execution (RCE)
tiddlywiki is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the upload function allowing an attacker to inject maliciously crafted script via a crafted SVG file...
librsvg DoS via Cyclic References
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service infinite loop, stack consumption, and application crash via cyclic references in an SVG document...
GHSA-J984-Q4QC-6QXF librsvg DoS via Cyclic References
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service infinite loop, stack consumption, and application crash via cyclic references in an SVG document...
GHSA-PHHM-63XX-V9RR phpMyAdmin Reflected File Download attack
An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...