Xwiki Platform Cross-Site Scripting Vulnerability (CNVD-2022-13409)

Xwiki Platform is a wiki platform for creating web collaboration applications from the French company Xwiki. Xwiki Platform is vulnerable to cross-site scripting, which can be exploited to upload SVGs containing scripts executed when performing download operations on files when using the default...

WordPress SVG Support plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress SVG Support plugin in versions prior to 2.3.20 suffers from a cross-site scripting vulnerability, which stems from a lack of data validation filtering of user-supplied data and output...

AlmaLinux 8 : librsvg2 (ALSA-2020:4709)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4709 advisory. - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The...

CVE-2021-45919

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

CVE-2021-45919

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

CVE-2021-45919

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

Design/Logic Flaw

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

CVE-2021-45919

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

CVE-2021-45919

Studio 42 elFinder versions up to 2.1.31 are affected by a cross-site scripting (XSS) vulnerability involving SVG data handling. The vulnerability stems from insecure handling of SVG document data, enabling client-side code execution. Affected product is elFinder (Studio 42), with the issue docum...

WordPress SVG Support Plugin < 2.3.20 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:benbodhi:svgsupport"; ifdescription...

Cross-site Scripting (XSS)

spip is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the malicious SVG file...

XWiki XSS Vulnerability (GHSA-9jq9-c2cv-pcrj)

XWiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

CVE-2021-43841

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...

CVE-2021-43841

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...

Default configuration

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...

CVE-2021-43841 XSS by SVG upload in xwiki-platform

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...

CVE-2021-43841

CVE-2021-43841 — XWiki Platform SVG upload XSS . In the default XWiki configuration, an attacker could upload an SVG containing a script that executes when a user performs a file download. The issue has been mitigated by patching the default configuration to stop displaying SVG files in the brows...

CVE-2021-43841 XSS by SVG upload in xwiki-platform

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that...

CVE-2021-24686

The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24686

The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...