11168 matches found
WordPress WP SVG images plugin <= 3.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via uploaded SVG file
Authenticated Stored Cross-Site Scripting XSS vulnerability via uploaded SVG file discovered by Rasi in WordPress WP SVG images plugin versions = 3.3. Solution Update the WordPress WP SVG images plugin to the latest available version at least 3.4...
Cerberus FTP Server Enterprise Cross-Site Scripting Vulnerability
Cerberus FTP Server is a Windows-based FTP server from Cerberus USA that supports encrypted FTP sessions via FTPS and SFTP. A cross-site scripting vulnerability exists in Cerberus FTP Server Enterprise versions prior to 10.0.19, 11.x series versions prior to 11.0.4, which can be exploited by an...
Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS)
Exploit Title: Cerberus FTP web Service 11 - 'svg' Stored Cross-Site Scripting XSS Date: 08/06/2021 Exploit Author: Mohammad Hossein Kaviyany Vendor Homepage: www.cerberusftp.com Software Link: https://www.cerberusftp.com/download/ Version:11.0 releases prior to 11.0.4, 10.0 releases prior to...
CVE-2019-25046
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document...
CVE-2019-25046
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document...
CVE-2019-25046
Cerberus FTP Server Enterprise Web Client versions before 10.0.19 and 11.x before 11.0.4 are affected by an SVG-based XSS vulnerability. The issue arises from processing SVG documents in the Web Client, enabling cross-site scripting. Mitigation: upgrade to Cerberus FTP Server Enterprise 10.0.19 o...
Cerberus FTP Server Enterprise 跨站脚本漏洞
Cerberus FTP Server is a Windows-based FTP server from Cerberus USA that supports encrypted FTP sessions via FTPS and SFTP. A cross-site scripting vulnerability exists in Cerberus FTP Server Enterprise versions prior to 10.0.19, 11.x series versions prior to 11.0.4, which can be exploited by an...
SUSE: Security Advisory (SUSE-SU-2018:1319-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2015:0593-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GHSA-HM2H-F456-6J88 Cross-site scripting in Plone
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
Cross-site scripting in Plone
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
Cross-site Scripting (XSS) - Stored in idempiere/idempiere
✍️ Description Stored xss via svg file upload 🕵️♂️ Proof of Concept you can upload this svg file https://github.com/ranjit-git/poc/blob/master/evilsvgfile.svg .\ Check this 1 minute video to reproduce the bug https://drive.google.com/file/d/1nKXfSUjU5vDEMMY6cAmRs6d3MCPoj0uv/view?usp=sharing 💥...
Cross-site Scripting (XSS)
plone is vulnerable to cross-site scripting. An attacker is able to inject malicious script via uploading an SVG or HTML document. This allows an attacker to exploit it to inject and execute javascript...
Plone cross-site scripting vulnerability (CNVD-2021-37274)
Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A stored cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited by uploading SVG or HTML documents to conduct...
Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
✍️ Description dolibarr is vulnerable to XSS. It is possible to upload SVG files containing JavaScript code. 🕵️♂️ Proof of Concept SVG file content: html alertdocument.domain; 1. With an authenticated user, access http://localhost/societe/card.php?action=create&leftmenu=. 2. Write any content in...
CVE-2021-33512
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
CVE-2021-33512
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
Cross site scripting
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...