CVE-2020-36171

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

Design/Logic Flaw

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

WordPress Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. elementor is a drag-and-drop website builder plugin used in it. A cross-site scripting vulnerability exists in the WordPress...

WordPress Elementor Website Builder plugin <= 3.0.13 - Unrestricted SVG Uploads vulnerability

Unrestricted SVG Uploads vulnerability found in WordPress Elementor Website Builder plugin versions = 3.0.13. Solution Update the WordPress Elementor Website Builder plugin to the latest available version at least 3.0.14...

CVE-2020-13145

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

CVE-2018-9078

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

Hippo CMS XML External Entity Information Disclosure Vulnerability

Hippo CMS is an open source information-centered content management system . It is a friendly interface , open system and can be integrated into existing systems to use . XXE XML External Entity is processed through SVG uploads in the image of the CMS and imported through XML in the CMS console...

[Backports-security-announce] Security Update for mediawiki

Gerfried Fuchs uploaded new packages for mediawiki which fixed the following security problems: CVE-2008-5249, Debian BTS 508868 Cross-site scripting XSS vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-5250

Cross-site scripting XSS vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web...

CVE-2008-5250

Cross-site scripting XSS vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web...

CVE-2008-5250

The CVE-2008-5250 issue affects MediaWiki prior to 1.6.11, 1.12.x prior to 1.12.2, and 1.13.x prior to 1.13.3. It is a cross-site scripting (XSS) vulnerability that can be exploited by remote authenticated users who edit a wiki page when using Internet Explorer with uploads enabled, or with an SV...