2276 matches found
GHSA-M6XF-FQ7Q-8743 Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
Impact A mutation XSS affects users calling bleach.clean with all of: the svg or math in the allowed/whitelisted tags an RCDATA tag see below in the allowed/whitelisted tags the keyword argument strip=False Patches Users are encouraged to upgrade to bleach v3.1.2 or greater. Workarounds modify...
DEBIAN-CVE-2019-12921
In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG...
PT-2020-20269 · Alfresco · Alfresco Community +1
Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise versions prior to 5.2.7 Alfresco Community versions prior to 6.2.0 rb65251d6-b368 Description: The issue allows for XSS via a user profile photo. This can be achieved by including a SCRIPT element in an SVG document...
PT-2020-19957 · Nextcloud · Nextcloud Server
Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 16.0.1 Description: A reflected Cross-Site Scripting issue was found in the svg generation of the affected software. Recommendations: For Nextcloud Server version 16.0.1, update to a version that includes a fix for th...
ALPINE-CVE-2019-20446
In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially...
Fedora: Security Advisory for xfig (FEDORA-2020-6a2824178e)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for xfig (FEDORA-2020-5d0f0593ae)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 31 Update: xfig-3.2.7b-1.fc31
Xfig is an X Window System tool for creating basic vector graphics, including bezier curves, lines, rulers and more. The resulting graphics can be saved, printed on PostScript printers or converted to a variety of other formats e.g., X11 bitmaps, Encapsulated PostScript, LaTeX. You should install...
DEBIAN-CVE-2015-9541
Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564...
[SECURITY] Fedora 30 Update: xfig-3.2.7b-1.fc30
Xfig is an X Window System tool for creating basic vector graphics, including bezier curves, lines, rulers and more. The resulting graphics can be saved, printed on PostScript printers or converted to a variety of other formats e.g., X11 bitmaps, Encapsulated PostScript, LaTeX. You should install...
GNOME librsvg xml.rs file denial of service vulnerability
GNOME librsvg is an open source SVG graphics development library for the GNOME project. A security vulnerability exists in the xml.rs file in GNOME librsvg versions prior to 2.46.2. An attacker can exploit this vulnerability to cause a denial of service with a specially crafted SVG file...
UBUNTU-CVE-2020-1766
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...
WordPress safe-svg denial of service vulnerability (CNVD-2019-41508)
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. safe-svg is an SVG Scalable Vector Graphics upload plugin used in it. A denial of service vulnerability exists in WordPress safe-svg...
CVE-2019-18856
A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled...
Drupal SVG Sanitizer Denial of Service Vulnerability
Drupal is the Drupal community using PHP language development of a set of open source content management system . SVG Sanitizer is one of the SVG format file cleaning module . A denial of service vulnerability exists in Drupal SVG Sanitizer 8.x-1.0-alpha1 and earlier versions, which can be...
darylldoyle svg-sanitizer input validation error vulnerability
darylldoyle svg-sanitizer is a SVG format file cleaning tool. An input validation error vulnerability exists in versions of darylldoyle svg-sanitizer prior to 0.12.0. No detailed vulnerability details are provided at this time...
CVE-2019-13080
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via an SVG image and HTML file that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser...
DEBIAN-CVE-2018-21030
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...
CVE-2019-9757
An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read...