miniBB Cross-Site Scripting Vulnerability

miniBB full name Minimalistic Bulletin Board is a free, open source Internet forum software. The software supports a variety of forum styles , multiple interface languages , multiple time zones , plug-ins and extensions , etc. Administrative Panel is one of the administrative panel . A cross-site...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through SVG files if enableSvg is set. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script...

AndroidSVG SVG Parsing Component Denial of Service Vulnerability

AndroidSVG is a SVG Scalable Vector Graphics parser and renderer for Android.SVG parsing component is one of the SVG parsing components. A security vulnerability exists in the SVG parsing component in AndroidSVG version 1.2.2. A remote attacker can exploit this vulnerability to cause a denial of...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2017-38465)

Mozilla Firefox is a popular WEB browser. An information disclosure vulnerability exists in Mozilla Firefox's handling of external SVG graphics, which can be exploited by a remote attacker to submit a special web page and trick the user into parsing it, which can crash the application and obtain...

Google Chrome Information Disclosure Vulnerability (CNVD-2017-33593)

Google Chrome for Linux, Windows, Mac is an American Google Google company developed a Web browser based on Linux, Windows, Mac and Android platforms. An information disclosure vulnerability exists in Google Chrome for Mac, Windows, and Linux platforms. A remote attacker can extract pixel values...

Redmine cross-site scripting vulnerability (CNVD-2017-31955)

Redmine is a set of open source Web-based project management and defect tracking tools . The tool provides project management , issue tracking and role-based access control and other features . A cross-site scripting vulnerability exists in Redmine versions prior to 3.2.6 and 3.3.x prior to 3.3.3...

DEBIAN-CVE-2017-15574

In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment...

OctoberCMS Cross-Site Scripting Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. A cross-site scripting vulnerability exists in OctoberCMS, which allows an attacker to upload an SVG file containing malicious code as an "avatar" of a configuration file. When opened by an administrator, this file can cause...

[SECURITY] Fedora 27 Update: libwmf-0.2.8.4-53.fc27

A library for reading and converting Windows MetaFile vector graphics WMF...

ImageMagick MagickCore/token.c File Denial of Service Vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. ImageMagick 7.0.6 version of the MagickCore/token.c file of the GetNextToken security vulnerability. A remote attacker...

DEBIAN-CVE-2017-14682

GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted SVG document, a different vulnerability than CVE-2017-10928...

[SECURITY] Fedora 25 Update: libwmf-0.2.8.4-53.fc25

A library for reading and converting Windows MetaFile vector graphics WMF...

[SECURITY] Fedora 25 Update: inkscape-0.92.1-4.20170510bzr15686.fc25.1

Inkscape is a vector graphics editor, with capabilities similar to Illustrator, CorelDraw, or Xara X, using the W3C standard Scalable Vector Graphics SVG file format. It is therefore a very useful tool for web designers and as an interchange format for desktop publishing. Inkscape supports many...

[SECURITY] Fedora 25 Update: autotrace-0.31.1-49.fc25

AutoTrace is a program for converting bitmaps to vector graphics. Supported input formats include BMP, TGA, PNM, PPM, and any format supported by ImageMagick, whereas output can be produced in Postscript, SVG, xfig, SWF, and others...

[SECURITY] Fedora 26 Update: inkscape-0.92.1-4.20170510bzr15686.fc26.1

Inkscape is a vector graphics editor, with capabilities similar to Illustrator, CorelDraw, or Xara X, using the W3C standard Scalable Vector Graphics SVG file format. It is therefore a very useful tool for web designers and as an interchange format for desktop publishing. Inkscape supports many...

IrfanView buffer overflow vulnerability (CNVD-2017-30395)

IrfanView is an image viewer developed by Irfan Skiljan, a software developer from Bosnia and Herzegovina, which supports image browsing, image editing, image format conversion and more. A buffer overflow vulnerability exists in IrfanView version 4.44 32-bit. This vulnerability can be exploited b...

XnView Classic for Windows Buffer Overflow Vulnerability (CNVD-2017-34093)

XnView Classic for Windows is an image viewing software for Windows developed by French software developer Gougelet Pierre-Emmanuel. The software can be used to view, convert, organize and edit graphic and video files. A buffer overflow vulnerability exists in version 2.40 of XnView Classic for...

IrfanView Buffer Overflow Vulnerability (CNVD-2017-34094)

IrfanView is an image viewer developed by Irfan Skiljan, a software developer from Bosnia and Herzegovina, which supports image browsing, image editing, image format conversion and more. A buffer overflow vulnerability exists in IrfanView version 4.44 32-bit. This vulnerability can be exploited b...

[SECURITY] Fedora 26 Update: libwmf-0.2.8.4-53.fc26

A library for reading and converting Windows MetaFile vector graphics WMF...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...