CVE-2021-40734

Adobe Audition 14.4 and earlier is affected by a memory corruption vulnerability when parsing SVG files, potentially allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction. Affected product: Adobe Audition (Windows/macOS). Root cause: memory c...

CVE-2021-40734 Adobe Audition Memory Corruption could lead to Arbitrary code execution

Adobe Audition version 14.4 and earlier is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...

CVE-2021-40766 Adobe Character Animator SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Character Animator version 4.4 and earlier versions are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction i...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to stored cross-site scripting. The vulnerability exists due to lack of xss validations for uploaded SVG files before they get stored which allows an attacker to inject and execute arbitrary javascript...

Cross-site Scripting (XSS)

sylius/sylius is vulnerable to cross-site scriptingXSS attacks. An attacker is able to inject and execute malicious javascript via a specifically crafted SVG file...

Cross-site Scripting in Zenario CMS

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

GHSA-X8WJ-CQMP-3WMM Cross-site Scripting in Zenario CMS

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

Sylius Cross-Site Scripting Vulnerability (CNVD-2022-20526)

Sylius is an open source e-commerce platform. Sylius suffers from a cross-site scripting vulnerability that could be exploited by attackers to upload SVG files containing XSS code in the administration panel to obtain user cookies and construct phishing attacks...

GHSA-4QRP-27R3-66FJ Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius

Impact There is a possibility to upload an SVG file containing XSS code in the admin panel. In order to perform an XSS attack, the file itself has to be opened in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. Patches T...

Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius

Impact There is a possibility to upload an SVG file containing XSS code in the admin panel. In order to perform an XSS attack, the file itself has to be opened in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. Patches T...

Cross site scripting

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...

CVE-2022-24749 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...

CVE-2022-24749

Sylius SVG XSS risk (CVE-2022-24749): Prior to versions 1.9.10, 1.10.11, and 1.11.2, uploading an SVG in the admin panel could execute XSS if the file was opened outside of an IMG tag or in a new card. The issue affects files displayed on admin and shop pages and is fixed in 1.9.10, 1.10.11, and ...

CVE-2022-24749 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...

CVE-2021-41952

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

CVE-2021-41952

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

CVE-2021-41952

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

Cross site scripting

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

CVE-2021-41952

CVE-2021-41952 relates to Zenario CMS 9.0.54156, where an XSS vulnerability exists through uploading SVG files. The technical detail in the connected advisories confirms that an attacker can craft a malicious SVG upload to trigger a cross-site scripting condition, enabling theft of victim cookies...

CVE-2021-41952

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...