openSUSE Security Update : python-bleach (openSUSE-2021-552)

This update for python-bleach fixes the following issues : - CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags boo1184547 Update to 3.1.5 : - replace missing setuptools dependency with packaging. Thank you Benjamin Peterson. Update to 3.1.4 boo1168280,...

CVE-2020-35418

Cross Site Scripting XSS in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file...

CVE-2020-35418

Cross Site Scripting XSS in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file...

Cross site scripting

Cross Site Scripting XSS in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file...

CVE-2020-35418

Cross Site Scripting XSS in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file...

CVE-2021-30140

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content such as SVG with HTML content, the payload is executed upon a click. This is fixed in 3.5...

Cross site scripting

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content such as SVG with HTML content, the payload is executed upon a click. This is fixed in 3.5...

CVE-2021-30140

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content such as SVG with HTML content, the payload is executed upon a click. This is fixed in 3.5...

UBUNTU-CVE-2021-3481

A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelperp.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics SVG file this flaw may lead to an unauthorized memory access. The highest threat...

CVE-2021-3481

A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelperp.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics SVG file this flaw may lead to an unauthorized memory access. The highest threat...

CVE-2021-3481

A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelperp.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics SVG file this flaw may lead to an unauthorized memory access. The highest threat...

The vulnerability of the SVG file on the MoinMoin wiki platform, due to deficiencies in the measures used to protect web page structures, allows attackers to compromise the integrity of the data.

The vulnerability of the SVG file on the wiki platform MoinMoin is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

Fedora 33 : 1:qt (2021-e0f30b4500)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-e0f30b4500 advisory. - An out of bounds read in function QRadialFetchSimd from crafted svg file may lead to information disclosure or other potential consequences. This update...

[SECURITY] Fedora 34 Update: qt5-qtsvg-5.15.2-4.fc34

Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices...

WordPress Mapplic 6.1 SSRF / Cross Site Scripting

Title : Mapplic Wordpress Plugins Stored XSS Injection via SSRF Date : 22/03/2021 Author : Eagle Eye Vendor Homepage : https://mapplic.com/ Version Affected : 6.1 and below Tested on : Google Chrome XSS Vuln from add/edit Map and bypass with host raw.githubusercontent.com 1.Login as user 2.Add...

Mapplic and Mapplic Lite - SSRF to Stored Cross-Site Scripting (XSS)

The Mapplic Lite = 1.0 and Mapplic = 6.2 plugins are affected by server-side request forgery issues, allowing low privilege users author+ to use an arbitrary remote map file, such as an SVG which could lead to Stored Cross-Site Scripting issues. PoC 1.Login as user author+ 2.Add Add/Edit Map -...

WordPress Mapplic 6.1 SSRF / Cross Site Scripting Vulnerability

Title : Mapplic Wordpress Plugins Stored XSS Injection via SSRF Author : Eagle Eye Vendor Homepage : https://mapplic.com/ Version Affected : 6.1 and below Tested on : Google Chrome XSS Vuln from add/edit Map and bypass with host raw.githubusercontent.com 1.Login as user 2.Add Add/Edit Map - From...

FTAPI Cross-Site Scripting Vulnerability

FTAPI is an end-to-end encrypted file transfer and data room solution with unlimited file size. A cross-site scripting vulnerability exists in the "Background Image" upload function in the "Submit Box Template Editor" in FTAPI 4.0 - 4.10. An attacker can exploit this vulnerability by uploading an...

Updated python-cairosvg packages fix security vulnerability

When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service REDoS. If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time CVE-2021-21236...

Fedora: Security Advisory for batik (FEDORA-2021-65ff5f10e2)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...