11171 matches found
Design/Logic Flaw
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads by administrators of SVG files that may contain HTML data with a SCRIPT element...
CVE-2018-19146
CVE-2018-19146 affects Concrete5 8.4.3. The issue is a stored XSS caused by config/concrete.php allowing administrators to upload SVG files that may contain HTML data with a SCRIPT element. Impact is an XSS vulnerability in Concrete5’s SVG handling, with no further exploit details or affected ver...
Cross-Site Scripting in react-svg
Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting xss. This is due to the fact that scripts found in SVG files are run by default. Recommendation Update to version 2.2.18 or later...
agrisoln (1.0.0), drafty (>=0.1.14, <=0.2.37) +1 more potentially affected by unknown CVE via react-svg (>=2.1.10, <=2.1.22)
react-svg NPM version =2.1.10, =0.1.14, =0.2.37 - pcs-remote-monitoring-webui 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8XQR-4CPM-WX7G...
GHSA-8XQR-4CPM-WX7G Cross-Site Scripting in react-svg
Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting xss. This is due to the fact that scripts found in SVG files are run by default. Recommendation Update to version 2.2.18 or later...
Use After Free
Firefox is vulnerable to use-after-free attacks. This occurs when adjusting layout during SVG animations with text paths which leads to potentially exploitable crash...
Use After Free
mozilla Firefox is vulnerable to use-after-free vulnerability. This occurs while enumerating attributes during SVG animations with clip paths leading to application crashes...
Memory corruption
nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function...
CVE-2019-1010258
nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function...
CVE-2019-1010258
CVE-2019-1010258 affects the nanosvg library. A buffer overflow in nsvg__parseColorRGB (src/nanosvg.h: line 1227) can cause memory corruption and DoS; impact includes HIGH availability (per CVSS3) with NETWORK attack vector and potential network-distributed SVG input. The vulnerability is trigger...
CVE-2019-1010258
nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function...
Cross-site Scripting (XSS)
simditor is vulnerable to cross-site scripting XSS. The attack can be triggered because it does not sanitize the DOM object properly, allowing an attacker to inject arbitrary Javascript within a malicious SVG element into a victim's browser via the onload parameter...
CVE-2018-19048
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...
Cross site scripting
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...
CVE-2018-19048
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...
CVE-2018-16625
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
CVE-2018-16625
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
Cross site scripting
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
CVE-2018-19048
Simditor up to version 2.3.21 is affected by a DOM XSS (attackable via an onload attribute in a malformed SVG element). The underlying issue is improper handling/sanitization of SVG onload events, enabling injection of arbitrary JavaScript in the user’s browser. Mitigation: upgrade to version 2.3...