Subrion CMS XSS

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

GHSA-MXV3-QCMF-R6WJ Subrion CMS XSS

panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

GHSA-3GQ5-R59M-MMV2 Kirby XSS Vulnerability

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file...

Kirby XSS Vulnerability

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file...

Silverstripe CMS XSS Vulnerability

There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element...

Kirby XSS Vulnerability

A cross-site Scripting XSS vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file...

GHSA-275C-V3RC-XGHX Kirby XSS Vulnerability

A cross-site Scripting XSS vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file...

CVE-2022-28827 Adobe FrameMaker SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Framemaker versions 2029u8 and earlier and 2020u4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious fi...

GHSA-GVGF-FP4M-2HW6 OctoberCMS Cross-Site Scripting

Cross-Site Scripting exists in OctoberCMS 1.0.425 aka Build 425, allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account...

GHSA-QWGX-59JW-QFG9 Improper Restriction of XML External Entity Reference in Apache Batik

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a ful...

XWiki Cross-Site Scripting Vulnerability (CNVD-2022-72198)

Xwiki is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki version 12.10.2 contains a cross-site scripting vulnerability that could be exploited to launch a cross-site scripting attack against a target via the SVG document upload comment feature...

CVE-2022-28819

Adobe Character Animator versions 4.4.2 and earlier and 22.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicio...

CVE-2022-28819

Adobe Character Animator versions 4.4.2 and earlier and 22.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicio...

Cross site scripting

Adobe Character Animator versions 4.4.2 and earlier and 22.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicio...

CVE-2022-28819 Adobe Character Animator SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Character Animator versions 4.4.2 and earlier and 22.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicio...

CVE-2022-28819

CVE-2022-28819 affects Adobe Character Animator versions 4.4.2 (and earlier) and 22.3 (and earlier). The issue is an out-of-bounds write vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicio...

CVE-2022-28819 Adobe Character Animator SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Character Animator versions 4.4.2 and earlier and 22.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicio...

AlmaLinux 8 : qt5-qtsvg (ALSA-2022:1920)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1920 advisory. - Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath...

e107 CMS 3.2.1 Arbitrary File Upload / Cross Site Scripting

Exploit Title: e107 CMS v3.2.1 - Multiple Vulnerabilities Date: 30/04/2022 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://e107.org/ Software Link: https://e107.org/download Version: 3.2.1 Tested on: Windows 10 using XAMPP, Apache/2.4.48 Win64...

RHEL 8 : python27:2.7 (RHSA-2022:1821)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1821 advisory. Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic...