DEBIAN-CVE-2018-7751

The svgprobe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service Infinite Loop via a crafted XML file...

UBUNTU-CVE-2017-0366

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07)

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

Shimmie cross-site scripting vulnerability (CNVD-2018-06088)

Shimmie is a set of image panels for installing and configuring Web sites. A cross-site scripting vulnerability exists in Shimmie 2 version 2.6.0, which stems from the program failing to properly handle uploaded SVG files. A remote attacker can exploit the vulnerability by uploading a specially...

Code injection

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the XPS...

CVE-2018-7188

An XSS vulnerability via an SVG image in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php...

miniBB Cross-Site Scripting Vulnerability

miniBB full name Minimalistic Bulletin Board is a free, open source Internet forum software. The software supports a variety of forum styles , multiple interface languages , multiple time zones , plug-ins and extensions , etc. Administrative Panel is one of the administrative panel . A cross-site...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through SVG files if enableSvg is set. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script...

AndroidSVG SVG Parsing Component Denial of Service Vulnerability

AndroidSVG is a SVG Scalable Vector Graphics parser and renderer for Android.SVG parsing component is one of the SVG parsing components. A security vulnerability exists in the SVG parsing component in AndroidSVG version 1.2.2. A remote attacker can exploit this vulnerability to cause a denial of...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2017-38465)

Mozilla Firefox is a popular WEB browser. An information disclosure vulnerability exists in Mozilla Firefox's handling of external SVG graphics, which can be exploited by a remote attacker to submit a special web page and trick the user into parsing it, which can crash the application and obtain...

Google Chrome Information Disclosure Vulnerability (CNVD-2017-33593)

Google Chrome for Linux, Windows, Mac is an American Google Google company developed a Web browser based on Linux, Windows, Mac and Android platforms. An information disclosure vulnerability exists in Google Chrome for Mac, Windows, and Linux platforms. A remote attacker can extract pixel values...

Redmine cross-site scripting vulnerability (CNVD-2017-31955)

Redmine is a set of open source Web-based project management and defect tracking tools . The tool provides project management , issue tracking and role-based access control and other features . A cross-site scripting vulnerability exists in Redmine versions prior to 3.2.6 and 3.3.x prior to 3.3.3...

DEBIAN-CVE-2017-15574

In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment...

OctoberCMS Cross-Site Scripting Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. A cross-site scripting vulnerability exists in OctoberCMS, which allows an attacker to upload an SVG file containing malicious code as an "avatar" of a configuration file. When opened by an administrator, this file can cause...

[SECURITY] Fedora 27 Update: libwmf-0.2.8.4-53.fc27

A library for reading and converting Windows MetaFile vector graphics WMF...

ImageMagick MagickCore/token.c File Denial of Service Vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. ImageMagick 7.0.6 version of the MagickCore/token.c file of the GetNextToken security vulnerability. A remote attacker...

DEBIAN-CVE-2017-14682

GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted SVG document, a different vulnerability than CVE-2017-10928...

[SECURITY] Fedora 25 Update: libwmf-0.2.8.4-53.fc25

A library for reading and converting Windows MetaFile vector graphics WMF...

[SECURITY] Fedora 25 Update: inkscape-0.92.1-4.20170510bzr15686.fc25.1

Inkscape is a vector graphics editor, with capabilities similar to Illustrator, CorelDraw, or Xara X, using the W3C standard Scalable Vector Graphics SVG file format. It is therefore a very useful tool for web designers and as an interchange format for desktop publishing. Inkscape supports many...