Dolibarr <= 10.0.3 Stored XSS Vulnerability

Dolibarr is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...

Google Chrome Blink Resource Management Error Vulnerability (CNVD-2019-44525)

Google Chrome is a Web browser from Google, a U.S. company. Blink is a browser layout engine rendering engine jointly developed by Google and Norway's OperaSoftware. A resource management error vulnerability exists in the thirdparty/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h file for...

Cross-site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The vulnerability exists as it is possible to upload a SVG with a XSS payload and cause the script to be executed when rendered in viewimage.php...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

Cross site scripting

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2019-19206

Dolibarr ERP/CRM 10.0.3 is vulnerable to a stored XSS via viewimage.php?file=, caused by JavaScript execution in an SVG image used for a profile picture. This is a cross-site scripting issue documented across multiple sources (CVE-2019-19206). The provided connected documents confirm the affected...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

Zomato: HTML injection leads to reflected XSS

The following payload was used to bypass the WAF: html "...

CVE-2019-15587

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...

The vulnerability of the GetStyleTokens function (coders/svg.c:311:12) in the cross-platform library for working with graphics, GraphicsMagick, allows a hacker to trigger a service failure.

The vulnerability of the GetStyleTokens function coders/svg.c:311:12 in the cross-platform library for working with graphics, GraphicsMagick, arises due to an operation going beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause a service...

WordPress safe-svg denial of service vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. safe-svg is an SVG Scalable Vector Graphics upload plugin used in it. A denial of service vulnerability exists in WordPress safe-svg...

Design/Logic Flaw

An issue exists in thirdparty/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when trying to access a removed smil element...

CVE-2011-1803

CVE-2011-1803 is a vulnerability in WebKit’s SVGSMILElement handling (third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h) that can occur in Google Chrome before Blink M11/M12 when trying to access a removed SMIL element. The issue is reported across multiple corroborating sources an...

CVE-2011-1803

An issue exists in thirdparty/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when trying to access a removed smil element...

Cross-Site Scripting (XSS)

enshrined/svg-sanitize is vulnerable to cross-site scripting XSS. The vulnerability exists due to the possible inclusion of as a whitespace to bypass the regular expression used to detect scripts...

CVE-2019-15587: CAPI contains a vulnerable Loofah gem | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Description Cloud Foundry Cloud Controller CAPI, versions prior to 1.88.0, contain a vulnerable version of the Loofah gem for Ruby. Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Affected Cloud Foundr...

APSB19-53 Security update available for Adobe Bridge CC

Adobe has released a security update for Adobe Bridge CC. This update addresses multiple vulnerabilities rated Important that occur when parsing malformed SVG images. Successful exploitation could lead to information disclosure in the context of current user...