CVE-2020-12882

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow...

Cross site scripting

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow...

CVE-2020-12882

CVE-2020-12882 concerns Submitty up to version 20.04.01, where an SVG document upload in submissions enables cross-site scripting. The collected sources consistently describe an XSS vulnerability originating from insufficient validation of client-side data during SVG uploads, as demonstrated by a...

CVE-2020-12882

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow...

Cross-Site Scripting (XSS)

t3g/svg-sanitizer is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via SVG markup due to lack of sanitization of the markup...

TYPO3 SVG Sanitizer Component Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in the SVG Sanitizer component in TYPO3 1.0.2 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data ...

Cross-Site Scripting in SVG Sanitizer

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. An updated version 1.0.3 is available from the TYPo3 extension manager and at...

GHSA-59CF-M7V5-WH5W Cross-Site Scripting in SVG Sanitizer

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. An updated version 1.0.3 is available from the TYPo3 extension manager and at...

CVE-2020-11070

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site...

CVE-2020-11070

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site...

Cross site scripting

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site...

CVE-2020-11070 Cross-Site Scripting in SVG Sanitizer

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site...

CVE-2020-11070

CVE-2020-11070 affects TYPO3 SVG Sanitizer extension. The vulnerability arises when slightly invalid or incomplete SVG markup is not sanitized, allowing the browser to execute cross-site scripting. Affected versions are prior to 1.0.3. The issue stems from inadequate handling of malformed SVG dur...

Cross-Site Scripting in "SVG Sanitizer" (svg_sanitizer)

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it is still evaluated in browsers can lead to Cross-Site Scripting...

MGASA-2020-0204 Updated qt4 packages fix security vulnerabilities

Updated qt4 packages fix security vulnerabilities: A double-free or corruption during parsing of a specially crafted illegal XML document CVE-2018-15518. A malformed SVG image could cause a segmentation fault in qsvghandler.cpp CVE-2018-19869. A malformed GIF image might have caused a NULL pointe...

Updated qt4 packages fix security vulnerabilities

Updated qt4 packages fix security vulnerabilities: A double-free or corruption during parsing of a specially crafted illegal XML document CVE-2018-15518. A malformed SVG image could cause a segmentation fault in qsvghandler.cpp CVE-2018-19869. A malformed GIF image might have caused a NULL pointe...

The vulnerability of the SVGStartElement function in the GraphicsMagick graphics editor involves an operation that goes beyond the buffer boundaries in memory. This allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the SVGStartElement function in the GraphicsMagick graphics editor is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to information and compromise its integrity and...

Elementor < 2.9.8 - SVG Sanitizer Bypass leading to Authenticated Stored XSS

Jerome Bruandet, from NinTechNet, discovered a bypass in the SVG sanitizer, which could lead to an authenticated stored XSS issue from users with the uploadfiles capability...

U.S. Dept Of Defense: Arbitrary file upload and stored XSS via ███ support request

Summary: A malicious user can upload files of any type when submitting a support request. Impact This would allow the attacker to upload malicious executable files as well as .html or .svg files which would allow the attacker to execute malicious code on behalf of the ████ customer support...

Fedora 31 : php-horde-horde (2020-1a968aeb47)

horde 5.2.22 - jan SECURITY: Protect image processing service from rendering active SVG content within the browser. - jan SECURITY: Fix XSS vulnerabilities in administration interface. - jan Support Redis Sentinel configuration Michael Menge , Request 14998. - jan Use file hashing for detecting...