Design/Logic Flaw

In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file...

CVE-2021-25971 Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature

In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file...

CVE-2021-25971 Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature

In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file...

PT-2021-16895 · Unknown · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS versions 2.0.1 through 2.6.0 Description: The media upload feature in Camaleon CMS crashes permanently when an attacker with low privileged access uploads a specially crafted .svg file, resulting in an Uncaught Exception. This...

Cross-site Scripting (XSS) - Reflected in tsolucio/corebos

Description Reflected XSS via upload of malicious SVG file. Proof of Concep 1: Upload SVG file via /corebos/index.php?module=Documents&action=DetailView&viewname=0&start=&record=8460& alertdocument.location; 2: Trigger the reflected XSS by visiting the malicious SVG file stored in the storage...

Cross-site Scripting (XSS) - Reflected in admidio/admidio

Description Am still able to reproduce the SVG-XSS vulnerability here https://huntr.dev/bounties/96221dff-0d40-4326-9a9e-f66608307980/ on my local system just downloaded the latest release on the website. Think you may have accidentally included SVG files into the whitelist. Proof of Concept POST...

Cross-site Scripting (XSS) - Stored in admidio/admidio

Description Hello, Looking at your project, I saw in the commits several anti-CSRF token addition but also a commit to not allow SVG file upload. However a blacklist in general is a bad idea, for example php, php3, ... are blocked but it is always possible to send a .php7 or .phps file ... Among...

openSUSE: Security Advisory for libqt5-qtsvg (openSUSE-SU-2021:3354-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED15: libQt5Svg5 / libqt5-qtsvg-devel / etc (SUSE-SU-2021:3354-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3354-1 advisory. - CVE-2021-3481: Fixed an out of bounds read in function QRadialFetchSimd from crafted svg file. bsc1184783 Tenable has extracted the preceding...

GHSA-G6V7-VQHX-6V6C XML External Entity Reference in org.opencms:opencms-core

An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...

XML External Entity Reference in org.opencms:opencms-core

An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...

in dompdf/dompdf

Description Improper restriction of external entities XXE in DomPDF's SVG parser allows it to perform an SSRF even if isRemoteEnabled set to false or even cause a deserialization attack in the SVG parser this time. Proof of Concept Payload 1 - SSRF only allowurlfopen required This embeds Google...

SUSE SLED12: libQt5Svg5 / libqt5-qtsvg-devel / etc (SUSE-SU-2021:3333-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3333-1 advisory. - CVE-2021-3481: Fixed an out of bounds read in function QRadialFetchSimd from crafted svg file. bsc1184783 Tenable has extracted t...

SUSE-SU-2021:3333-1 Security update for libqt5-qtsvg

This update for libqt5-qtsvg fixes the following issues: - CVE-2021-3481: Fixed an out of bounds read in function QRadialFetchSimd from crafted svg file. bsc1184783...

Alkacon OpenCms XML External Entity Vulnerability

Alkacon OpenCms is an open source content management system CMS developed in Java.Alkacon OpenCms is vulnerable to an XML external entity vulnerability that can be exploited by attackers to steal files from the server's file system by uploading crafted SVG documents...

CVE-2021-3312

An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...

CVE-2021-3312

An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...

Xxe

An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...

CVE-2021-3312

CVE-2021-3312 describes an XML External Entity (XXE) vulnerability in Alkacon OpenCms (11.0, 11.0.1, 11.0.2). The underlying issue allows remote authenticated users with edit privileges to exfiltrate files from the server’s filesystem by uploading a crafted SVG document. The vulnerability is tied...

Cross-site Scripting (XSS) - Stored in fisharebest/webtrees

Description Stored XSS via upload file .svg allows for arbitrary execution of JavaScript Proof of Concept // PoC.req POST /demo-dev/tree/demo/add-media-file/X9222 HTTP/2 Host: dev.webtrees.net Cookie: Secure-WT-ID=63trarcpiic93psog3t8okts4h User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15;...