11170 matches found
CVE-2019-18855
The CVE-2019-18855 issue affects the WordPress Safe SVG plugin (safe-svg) up to version 1.9.4, with a Denial of Service vulnerability arising from handling of potentially unwanted elements or attributes in SVG uploads. Root cause is a DoS condition; affected installations are those running vulner...
CVE-2019-18855
A Denial Of Service vulnerability exists in the safe-svg aka Safe SVG plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes...
CVE-2019-18856
The CVE-2019-18856 vulnerability affects the Drupal SVG Sanitizer module (8.x-1.0-alpha1 and earlier). The root cause is mishandling access to external resources when using the SVG use element, resulting in a Denial of Service. Vectors, affected versions, and a concrete remediation are not detail...
CVE-2019-18856
A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled...
CVE-2019-18857
darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript:alert substring...
CVE-2019-18857
The CVE refers to darylldoyle svg-sanitizer before 0.12.0, where the parser mishandles script and data values in attributes, evidenced by unusual whitespace such as javascript :alert. This vulnerability is documented across multiple feeds (NVD, Red Hat, GHSA, OSV, etc.) and is associated with cro...
WordPress Safe SVG plugin <=1.9.5 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by 0xd0ff9 in WordPress Safe SVG plugin versions =1.9.5. Solution Update the WordPress Safe SVG plugin to the latest available version at least 1.9.6...
PT-2019-15703 · Safe-Svg · Safe-Svg
Name of the Vulnerable Software and Affected Versions: safe-svg plugin versions prior to 1.9.5 Description: A Denial Of Service issue exists, related to potentially unwanted elements or attributes. Recommendations: For versions prior to 1.9.5, update to version 1.9.5 or later to resolve the issue...
PT-2019-15702 · Safe-Svg · Safe-Svg
Name of the Vulnerable Software and Affected Versions: safe-svg plugin versions through 1.9.4 Description: A Denial Of Service issue exists, related to unlimited recursion for a '' substring. Recommendations: For versions through 1.9.4, update to a version later than 1.9.4 to resolve the issue...
GHSA-6268-V434-45M5 Cross-site Scripting in Grav
Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...
Cross-site Scripting in Grav
Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...
Cross-site scripting in Jupyter Notebook
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...
Safe SVG < 1.9.6 - XSS Protection Bypass
By using entities in payload XSS will success to bypass the protection of the Safe SVG Plugin Video POC for Video PoC for v1.9.5 : https://www.youtube.com/watch?v=hnQA2hc-4k...
Safe SVG < 1.9.6 - XSS Protection Bypass
By using entities in payload XSS will success to bypass the protection of the Safe SVG Plugin PoC Video POC for Video PoC for v1.9.5 : https://www.youtube.com/watch?v=hnQA2hc-4k...
Design/Logic Flaw
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via an SVG image and HTML file that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser...
CVE-2019-13080
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via an SVG image and HTML file that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser...
Mozilla Firefox ESR < 31.5.3 SVG Bypass Privilege Escalation
Binary data 701252.prm...
Mozilla Firefox ESR < 31.7 Multiple Vulnerabilities
Binary data 701255.prm...