CVE-2017-5412

A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox 52 and Thunderbird 52...

UBUNTU-CVE-2017-7844

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history. Note: This issue only affects Firefox 57. Earlier...

Mozilla: Use-after-free with SVG animations and text paths

A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.8, Thunderbird ESR 52.8, Firefox 60, and Firefox ESR 52.8...

Mozilla: Use-after-free with SVG animations and clip paths

A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.8, Thunderbird ESR 52.8, Firefox 60, and Firefox ESR 52.8...

Mozilla: Use-after-free with SVG animations and text paths

A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.8, Thunderbird ESR 52.8, Firefox 60, and Firefox ESR 52.8...

Mediawiki security bypass vulnerability (CNVD-2018-10133)

MediaWiki is a free and free web-based Wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in Mediawiki versions prior to 1.28.1, prior ...

UBUNTU-CVE-2017-0366

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07)

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

CVE-2018-7188

An XSS vulnerability via an SVG image in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php...

miniBB Cross-Site Scripting Vulnerability

miniBB full name Minimalistic Bulletin Board is a free, open source Internet forum software. The software supports a variety of forum styles , multiple interface languages , multiple time zones , plug-ins and extensions , etc. Administrative Panel is one of the administrative panel . A cross-site...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through SVG files if enableSvg is set. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script...

AndroidSVG SVG Parsing Component Denial of Service Vulnerability

AndroidSVG is a SVG Scalable Vector Graphics parser and renderer for Android.SVG parsing component is one of the SVG parsing components. A security vulnerability exists in the SVG parsing component in AndroidSVG version 1.2.2. A remote attacker can exploit this vulnerability to cause a denial of...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2017-38465)

Mozilla Firefox is a popular WEB browser. An information disclosure vulnerability exists in Mozilla Firefox's handling of external SVG graphics, which can be exploited by a remote attacker to submit a special web page and trick the user into parsing it, which can crash the application and obtain...

Google Chrome Information Disclosure Vulnerability (CNVD-2017-33593)

Google Chrome for Linux, Windows, Mac is an American Google Google company developed a Web browser based on Linux, Windows, Mac and Android platforms. An information disclosure vulnerability exists in Google Chrome for Mac, Windows, and Linux platforms. A remote attacker can extract pixel values...

Redmine cross-site scripting vulnerability (CNVD-2017-31955)

Redmine is a set of open source Web-based project management and defect tracking tools . The tool provides project management , issue tracking and role-based access control and other features . A cross-site scripting vulnerability exists in Redmine versions prior to 3.2.6 and 3.3.x prior to 3.3.3...

DEBIAN-CVE-2017-15574

In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment...

OctoberCMS Cross-Site Scripting Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. A cross-site scripting vulnerability exists in OctoberCMS, which allows an attacker to upload an SVG file containing malicious code as an "avatar" of a configuration file. When opened by an administrator, this file can cause...

ImageMagick MagickCore/token.c File Denial of Service Vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. ImageMagick 7.0.6 version of the MagickCore/token.c file of the GetNextToken security vulnerability. A remote attacker...

DEBIAN-CVE-2017-14682

GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted SVG document, a different vulnerability than CVE-2017-10928...