Cross-site Scripting (XSS)

privatebin is vulnerable to cross-site scripting. No sanitization in handling Attachment before sending for preview in SVG in AttachmentViewer allows malicious script execution in instance context...

PT-2022-18244 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost version 4.39.0 Description: The issue concerns an arbitrary file upload vulnerability in the file upload module, potentially allowing attackers to execute arbitrary code via a crafted SVG file. However, the vendor states that uploading...

Adobe Photoshop 22.x < 22.5.7 / 23.x < 23.3 Multiple Vulnerabilities (APSB22-20)

The version of Adobe Photoshop installed on the remote Windows host is prior to 22.5.7/23.3. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb22-20 advisory. - Adobe Photoshop versions 22.5.6 and earlierand 23.2.2 and earlier are affected by a use-after-free...

CVE-2022-24833

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

Cross site scripting

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

CVE-2022-24833 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

CVE-2022-24833 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

CVE-2022-1045

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0...

CVE-2022-1045

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0...

Cross site scripting

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0...

CVE-2022-1045 Stored XSS viva .svg file upload in polonel/trudesk

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0...

CVE-2022-1045 Stored XSS viva .svg file upload in polonel/trudesk

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0...

CVE-2022-1045

The CVE-2022-1045 entry relates to a Stored XSS in GitHub polonel/trudesk prior to v1.2.0, caused by insufficient filtering/escaping in the SVG file upload function. Affected component: Trudesk (SVG upload logic). Impact described in connected sources includes the ability for an attacker to injec...

Stored XSS viva .svg file upload

Description The application allows .svg files to upload which leads to stored XSS Proof of Concept 1.Download the payload from this link:- https://drive.google.com/file/d/1c1BP5bxXBxtwLfRJTrEPgMWK1yVFDF2R/view?usp=sharing 2.Login to the application with Co-admin account and go to "Settings" -...

CVE-2022-28284

SVG's use element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with...

UBUNTU-CVE-2022-28284

SVG's use element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with...

Mozilla Firefox 安全特征问题漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security feature issue vulnerability exists in Mozilla Firefox versions 92.0 through 98.0.2, which stems from an error that allows the element of SVG to load unexpected content and execute it under...

XSS via Embedded SVG in SVG Diagram Format

Description It is possible to embed SVG images in diagrams. When those are exported or used in a diagram in SVG format, the content of the embedded SVG image is included inline. This means the SVG markup gets inserted directly into the markup of the enclosing SVG. Since the SVG content is not...

Stored XSS viva .svg file upload

Description The application allows .svg files to upload which leads to stored XSS. Proof of Concept 1.Download the payload XSS.svg from below drive link and go to "Files". 2.Now click on "Add file" and upload the downloaded payload. 3.Then see the uploaded file details and open the file path once...

Joomla! Cross-site scripting vulnerability (CNVD-2022-64101)

A cross-site scripting vulnerability exists in Joomla! versions 4.0.0 to 4.1.0, which stems from the handling of SVG images without sufficient cleanup and escaping of user-supplied data, and could be exploited to upload malicious SVG images on vulnerable websites and execute arbitrary HTML and...