SVG++ Buffer Overflow Vulnerability

SVG++ aka Ssvgpp is a C++ framework that includes an SVG syntax parser, adapters for handling parsed data, and various utilities. The framework includes an SVG syntax parser, adapters for handling parsed data, and a variety of utilities.Anti-Grain Geometry AGG is a 2D rendering library used in it...

UBUNTU-CVE-2019-6131

svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svgrunusesymbol, svgrunelement, and svgrunuse, as demonstrated by mutool...

Phishing Tactic Hides Tracks with Custom Fonts

An insidious phishing method evades detection using a never-before-seen technique that leverages custom fonts to cover its tracks. Researchers at Proofpoint recently discovered an active credential harvesting phishing scheme. Once a victim has clicked on the initial phishing email, the resulting...

Kirby Cross-Site Scripting Vulnerability (CNVD-2019-03334)

Kirby is a document-based content management system CMS. A cross-site scripting vulnerability exists in Kirby version 2.5.12. The vulnerability can be exploited by a remote attacker to upload SVG files using the "site files" Add option...

Digia Qt Segmentation Error Vulnerability

Digia Qt is a cross-platform C++ application development framework from Digia Finland. The framework can be used to develop GUI programs. A security vulnerability exists in the qsvghandler.cpp file in Digia Qt versions prior to 5.11.3. An attacker can exploit this vulnerability to cause a denial ...

DEBIAN-CVE-2018-19869

An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp...

Artifex MuPDF Denial of Service Vulnerability (CNVD-2019-06786)

Artifex MuPDF is a free, lightweight PDF reader from Artifex Software. A denial of service vulnerability exists in the 'svgrunimage' function of the svg/svg-run.c file in Artifex MuPDF version 1.14.0. A remote attacker can exploit this vulnerability to cause a denial of service hrefatt null point...

PT-2018-15137 · Artifex · Artifex Mupdf

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF version 1.14.0 Description: The issue allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted svg file. This is due to a NULL pointer dereference in the svg run image function...

ASUSTOR ADM cross-site scripting vulnerability (CNVD-2018-26928)

ASUSTOR ADM is a set of operating systems from ASUSTOR dedicated to ASUSTOR NAS storage devices.File Explorer is one of the file browsers. A cross-site scripting vulnerability exists in File Explorer in ASUSTOR ADM version 3.1.1, which can be exploited by remote attackers to execute JavaScript co...

CVE-2018-12305

Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript...

UBUNTU-CVE-2018-19777

In Artifex MuPDF 1.14.0, there is an infinite loop in the function svgdevendtile in fitz/svg-device.c, as demonstrated by mutool...

DEBIAN-CVE-2018-19206

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment...

UBUNTU-CVE-2018-19206

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment...

PT-2018-14862

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.3.8 ALT Linux affected versions not specified Description The issue allows for XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment. This can lead to potenti...

ImageMagick Buffer Overflow Vulnerability (CNVD-2018-20676)

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A security vulnerability exists in the 'EncodeImage' function of the coders/pict.c file in ImageMagick version 7.0.8-1...

CVE-2018-17847

The html package aka x/net/html through 2018-09-25 in Go mishandles , leading to a "panic: runtime error" index out of range in nodeStack.pop in node.go, called from parser.clearActiveFormattingElements, during an html.Parse call...

CVE-2018-17334

An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in the svgGetNextPathField function in svgstring.c allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact because a strncpy copy limit is miscalculated...

Pluck Cross-Site Scripting Vulnerability

Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7, which can be exploited by remote attackers to execute scripts via SVG files with Javascript code in the SCRIPT element...

LatexDrawXML External Entity Injection Vulnerability

LatexDraw is a vector image editor. An XML external entity injection vulnerability exists in the SVG parsing feature in LatexDraw 4.0 and earlier versions. The vulnerability can be exploited to disclose data, spoof server-side requests, scan ports, or cause a denial of service with the help of...

SquirrelMail Cross-Site Scripting Vulnerability (CNVD-2019-19610)

SquirrelMail is a cross-platform use of PHP4 development Webmail mail system . A cross-site scripting vulnerability exists in the email message display page of SquirrelMail 1.4.22 and earlier versions, which can be exploited by remote attackers to inject malicious scripts into a web page and...