1487 matches found
Mozilla: Use-after-free in text reflows
The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have caused a use-after-free issue by forcing a text reflow in an SVG object, leading to a potentially exploitable crash...
Mozilla: Use-after-free in text reflows
The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have caused a use-after-free issue by forcing a text reflow in an SVG object, leading to a potentially exploitable crash...
Mozilla: Use-after-free in text reflows
The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have caused a use-after-free issue by forcing a text reflow in an SVG object, leading to a potentially exploitable crash...
Mozilla: Use-after-free in text reflows
The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have caused a use-after-free issue by forcing a text reflow in an SVG object, leading to a potentially exploitable crash...
Mozilla Firefox 资源管理错误漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox, which originates from a mix-up in instructions responsible for freeing memory when processing HTML content, and can be exploited by remote attackers ...
CVE-2021-24960
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks...
PeTeReport 跨站脚本漏洞
PeTeReport is an open source application vulnerability reporting tool. PeTeReport has a cross-site scripting vulnerability that stems from the software's lack of filtering and escaping of user data, which could be exploited by an attacker to inject persistent JavaScript code through an...
CVE-2022-24588
Flatpress v1.2.1 was discovered to contain a cross-site scripting XSS vulnerability in the Upload SVG File function...
FlatPress 跨站脚本漏洞
FlatPress is a Php-based blog builder with no database support from the FlatPress community. A cross-site scripting vulnerability exists in FlatPress v1.2.1, which stems from the discovery of a cross-site scripting XSS vulnerability in the Upload SVG File function...
CVE-2021-42940
A Cross Site Scripting XSS vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code...
Fedora: Security Advisory for qt5-qtsvg (FEDORA-2022-8e3fbc74e9)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
convert-svg 路径遍历漏洞
convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in convert-svg, which can be exploited by an attacker to read an arbitrary file from the filesystem via a carefully constructed SVG file and then display the...
UBUNTU-CVE-2021-45930
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and QPathClipper::intersect...
Wiki.js 跨站脚本漏洞
Wiki.js is a suite of open source Wiki software based on Node.js and written in JavaScript by the Requarks.io team. Requarks Wiki.js suffers from a cross-site scripting vulnerability that stems from a script that uploads SVG files through a custom request using a forged MIME type. By creating a...
HTML Cleaner allows crafted and SVG embedded scripts to pass through
...
PT-2021-23490 · Unknown · Abantecart
Name of the Vulnerable Software and Affected Versions: AbanteCart versions prior to 1.3.2 Description: An issue was discovered that allows any low-privileged user with file-upload permissions to upload a malicious SVG document containing an XSS payload. Recommendations: For versions prior to 1.3....
ALPINE-CVE-2021-43818
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...
CVE-2021-43818 HTML Cleaner allows crafted and SVG embedded scripts to pass through
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...
PT-2021-6092 · Lxml +10 · Lxml +10
Name of the Vulnerable Software and Affected Versions: lxml versions prior to 4.6.5 Description: The HTML Cleaner in lxml.html allows certain crafted script content to pass through, as well as script content in SVG files embedded using data URIs. This can be exploited by a remote attacker to...