11170 matches found
Cross-Site Scripting
moin is vulnerable to cross-site scripting XSS. An attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user views the malicious SVG file on the wiki...
Debian DSA-4787-1 : moin - security update
Two vulnerabilities were discovered in moin, a Python clone of WikiWiki. - CVE-2020-15275 Catarina Leite discovered that moin is prone to a stored XSS vulnerability via SVG attachments. - CVE-2020-25074 Michael Chapman discovered that moin is prone to a remote code execution vulnerability via the...
Cross-Site Scripting in scratch-svg-renderer
Overview This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function. Recommendation Upgrade to version...
scratch-paint (>=0.2.0-prerelease.20180531225024, <=0.2.0-prerelease.20180607153112), scratch-render (>=0.1.0-prerelease.20180531210700, <=0.1.0-prerelease.20180605145739) potentially affected by CVE-2020-7750 via scratch-svg-renderer (>=0.1.0-prerelease.20180524210316, <=0.1.0-prerelease.20180605140533)
scratch-svg-renderer NPM version =0.1.0-prerelease.20180524210316, =0.2.0-prerelease.20180531225024, =0.1.0-prerelease.20180531210700, =0.1.0-prerelease.20180605145739 Source cves: CVE-2020-7750 Source advisory: OSV:GHSA-J977-G5VJ-J27G...
GHSA-J977-G5VJ-J27G Cross-Site Scripting in scratch-svg-renderer
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...
Cross-Site Scripting in scratch-svg-renderer
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...
CVE-2020-15275
MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrad...
moinmoin -- multiple vulnerabilities
MoinMoin reports: Security fix for CVE-2020-25074: fix remote code execution via cache action Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability...
Cross-site Scripting (XSS)
dompurify is vulnerable to Cross-Site ScriptingXSS. The vulnerability exists when converting from the SVG namespace, allowing an attacker to inject and execute arbitrary Javascript...
Denial Of Service (DoS)
librsvg is vulnerable to denial of service. An attacker is able to cause a resource exhaustion via a malicious SVG file containing nested patterns...
XML Entity Expansion (XEE)
Qt is is vulnerable to XML entity expansion. The vulnerability exists due to mishandling of 'QXmlStreamReader' allowing a malicious attacker to send crafted SVG to cause an xml bomb attack...
Moderate: Red Hat Security Advisory: librsvg2 security update
An update for librsvg2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
librsvg: Resource exhaustion via crafted SVG file with nested patterns
In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially...
RHEL 8 : librsvg2 (RHSA-2020:4709)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4709 advisory. The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Resource exhaustion via...
librsvg2 security update
An update is available for librsvg2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The librsvg2 packages provide a Scalable Vector Graphics SVG library based o...
RLSA-2020:4709 Moderate: librsvg2 security update
The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Resource exhaustion via crafted SVG file with nested patterns CVE-2019-20446 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...
Debian DLA-2422-1 : qtsvg-opensource-src security update
Malformed SVG images were able to cause a segmentation fault in qtsvg-opensource-src, the QtSvg module for displaying the contents of SVG files in Qt. For Debian 9 stretch, this problem has been fixed in version 5.7.120161021-2.1. We recommend that you upgrade your qtsvg-opensource-src packages...
PT-2020-5775 · Moinmoin +2 · Moinmoin +2
Name of the Vulnerable Software and Affected Versions: MoinMoin versions prior to 1.9.11 Description: The issue is related to the insufficient protection measures of web page structures in the MoinMoin wiki platform, specifically concerning the upload of SVG files. An attacker with write...
Cross-Site Scripting (XSS)
scratch-svg-renderer is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript via an SVG document due to the lack of escaping in the transformMeasurements function...
CVE-2020-7750
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...