Code injection

PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svgfile' parameter...

VulnCheck KEV: CVE-2013-1675

Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site...

GHSA-W6CX-QG2Q-RVQ8 Path Traversal in @finastra/ssr-pages

A path traversal issue can occur when providing untrusted input to the svg property as an argument to the buildMessagePageOptions function. References - https://github.com/Finastra/ssr-pages/pull/1 - https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780...

Cross-site Scripting (XSS) - Stored

Description SVG sanitizer cloud be bypassed via flowing SVG file that leads to stored XSS Proof of Concept Upload the above SVG file in your profile, view it, and click anywhere on the page then XSS will be triggered : Impact This vulnerability is capable of performing arbitrary actions on behalf...

Ssr Pages Builder 路径遍历漏洞

Ssr Pages is an Html page builder for Ssr server-side rendering. a path traversal vulnerability exists in Ssr Pages, which stems from a path traversal issue that can occur when untrusted input is provided to the svg attribute as an argument to the buildMessagePageOptions function, which can be...

WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin <= 0.9.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin versions = 0.9.5. Solution Update the WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin to the latest available version at least 0.9.6...

WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin <= 0.9.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin versions = 0.9.5. Solution Update the WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin to the latest available...

FreeBSD : typo3 -- XSS vulnerability in svg-sanitize (0eab001a-9708-11ec-96c9-589cfc0f81b0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0eab001a-9708-11ec-96c9-589cfc0f81b0 advisory. - svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all...

TYPO3 SVG Sanitizer Vulnerability (TYPO3-PSA-2022-001)

TYPO3 is prone to a sanitization bypass vulnerability in SVG Sanitizer. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

DEBIAN-CVE-2021-3596

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt and uses the value directly, which leads to a crash and segmentation fault...

CVE-2021-3596

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt and uses the value directly, which leads to a crash and segmentation fault...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

CVE-2021-44607

FUEL-CMS 1.5.1 is affected by a Cross-Site Scripting (XSS) vulnerability in the Assets page via an SVG file. The root cause, per CNVD-2022-71119, is lack of proper validation of client-side data by the web application. Affected product: FUEL-CMS (Codeligniter-based CMS). Concretely, the issue is ...

CVE-2021-44607

A Cross Site Scripting XSS vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file...

typo3 -- XSS vulnerability in svg-sanitize

The TYPO3 project reports: The SVG sanitizer library enshrined/svg-sanitize before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+x...

Sanitization bypass in SVG Sanitizer

The SVG sanitizer library enshrined/svg-sanitize before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+xml were not affected...

CVE-2022-23646

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface UI Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in...