Group Office CRM 跨站脚本漏洞

Group Office CRM is a software application. Share projects, calendars, files and emails with colleagues and clients online. Easy to use and fully customizable. A cross-site scripting vulnerability exists in the Contacts page in Group Office CRM version 6.4.196. An attacker can exploit this...

Fedora: Security Advisory for qt5-qtsvg (FEDORA-2021-a95a40b78b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 34 Update: batik-1.14-1.fc34

Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...

[SECURITY] Fedora 33 Update: qt5-qtsvg-5.15.2-3.fc33

Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices...

CVE-2020-14988

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...

CVE-2021-27589

When a user opens manipulated Scalable Vector Graphics .SVG format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application...

CVE-2021-27589

When a user opens manipulated Scalable Vector Graphics .SVG format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application...

Design/Logic Flaw

When a user opens manipulated Scalable Vector Graphics .SVG format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application...

CVE-2021-27589

When a user opens manipulated Scalable Vector Graphics .SVG format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application...

PYSEC-2021-127

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...

The vulnerability of the library for working with SVG images in Apache Batik, related to incorrect processing of data in the “xlink:href” attribute, allows attackers to perform CSRF attacks.

The vulnerability of the Apache Batik library for working with SVG images is related to improper processing of data in the “xlink:href” attribute. Exploiting this vulnerability can allow a remote attacker to perform CSRF attacks using specially crafted GET requests...

CVE-2020-35852

Chatbox is affected by cross-site scripting XSS. An attacker has to upload any XSS payload with SVG, XML file in Chatbox. There is no restriction on file upload in Chatbox which leads to stored XSS...

PT-2021-12850 · Squaredup · Squaredup

Name of the Vulnerable Software and Affected Versions: SquaredUp versions prior to 4.6.0 Description: The issue allows for Stored XSS attacks. A user can create a dashboard that executes malicious content in an iframe or by uploading an SVG that contains a script. Recommendations: For versions...

The vulnerability of the SVG markup language implementation in Mozilla Firefox browsers allows attackers to compromise data integrity.

The vulnerability of the SVG markup language implementation in Mozilla Firefox’s browser is related to the lack of a mechanism for checking the tags. These tags can, in turn, utilize tags. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

CVE-2021-21236

CairoSVG is a Python pypi package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service REDoS vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regula...

CVE-2020-36171

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

CVE-2020-36171

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

Kozea CairoSVG Resource Management Error Vulnerability

Kozea CairoSVG is a Python based program from the Kozea community that converts SVG files to PDF, EPS, PS and PNG files. A resource management error vulnerability exists in versions of CairoSVG prior to 2.5.1, which can be exploited by an attacker to deliver a malicious SVG and cause the program ...

Nextcloud 跨站脚本漏洞

Nextcloud Contacts is the user interface for Nextcloud's CardDAV server. A cross-site scripting vulnerability exists in Nextcloud Contacts 3.3.0. The vulnerability stems from a missing file type check. An attacker can exploit this vulnerability by uploading a malicious SVG file to conduct a...

Umbraco Cross-Site Scripting Vulnerability

Umbraco is an open source content management system CMS based on ASP.NET technology. Umbraco 8.9.1 and earlier versions are vulnerable to a stored cross-site scripting vulnerability. An attacker can exploit this vulnerability by uploading a malicious .svg file to conduct a cross-site scripting...