11168 matches found
CVE-2021-25993
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...
CVE-2021-25993
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...
Cross site scripting
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...
CVE-2021-25993
The CVE-2021-25993 entry documents a Stored XSS vulnerability in Requarks wiki.js (versions 2.0.0-beta.147 to 2.5.255). A low-privileged editor can upload an SVG containing malicious JavaScript during asset uploads, causing JWTs to be sent to the attacker server and potentially leading to account...
CVE-2021-25993 Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...
CVE-2021-25993 Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...
The vulnerability of Adobe Premiere Rush software, related to the execution of operations beyond buffer boundaries in memory, allows attackers to execute arbitrary code.
The vulnerability of Adobe Premiere Rush relates to the execution of operations beyond the buffer in memory when processing SVG files. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
CVE-2021-43855
Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This...
CVE-2021-43855
Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This...
CVE-2021-43855
Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This...
Cross site scripting
Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This...
CVE-2021-43855
Wiki.js 2.5.263 and earlier are vulnerable to a stored cross-site scripting (XSS) flaw via an SVG file upload using a forged MIME type. A crafted SVG can trigger JavaScript execution when viewed directly by other users; scripts do not run when the SVG is loaded through standard img tags. The issu...
CVE-2021-43855 Stored XSS via SVG in Requarks/wiki
Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This...
GPAC Denial of Service Vulnerability (CNVD-2021-103387)
GPAC is an open source multimedia framework. gfsvgdeleteattributevalue is invalid and can be exploited by attackers to cause segmentation errors and application crashes...
DEBIAN-CVE-2021-45267
An invalid memory address dereference vulnerability exists in gpac 1.1.0 via the svgnodestart function, which causes a segmentation fault and application crash...
GPAC 资源管理错误漏洞
GPAC is an open source multimedia framework. gfsvgdeleteattributevalue is invalid and can be exploited by attackers to cause segmentation errors and application crashes...
PT-2021-24221 · Gpac · Gpac
Name of the Vulnerable Software and Affected Versions: gpac version 1.1.0 Description: An invalid memory address dereference issue exists via the svg node start function, causing a segmentation fault and application crash. Recommendations: For gpac version 1.1.0, consider disabling the svg node...
CVE-2021-44925
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gfsvggetattributename function, which causes a segmentation fault and application crash...
UBUNTU-CVE-2021-44925
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gfsvggetattributename function, which causes a segmentation fault and application crash...
TikTok: Cross site scripting via file upload in subdomain ads.tiktok.com
A file upload XSS cross-site scripting vulnerability was found in TikTok ads ticketing platform. Due to missing checks it was possible to upload .svg files which contained XSS payload. We thank @blubluuu for reporting this to our team and confirming its resolution...