417 matches found
CVE-2015-7214
CVE-2015-7214 What is CVE-2015-7214? Please see the following link. Cross-site reading attack through data and view-source URIs Contents www/index.html SOP bypass PoC for Web local/index.html SOP bypass PoC for local Requirements Firefox version 42.0 or earlier The following is the download link ...
CVE-2026-126206
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.alloweduri? treats a data URI mediatype containing the HTML5 named solidus reference as malformed and falls back to the allowed text/plain, whi...
Loofah allowed_uri? treats data:text/html as safe text/plain
Summary Loofah::HTML5::Scrub.alloweduri? returns true for a data: URI whose mediatype is written with the HTML5 named character reference in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed text/plain, while a browser decodes the reference and reads the...
CVE-2026-126206
The Loofah library (version 2.25.2 ) contains a vulnerability in the Loofah::HTML5::Scrub.allowed_uri? helper. The issue arises because the helper fails to decode the HTML5 named character reference / , causing it to treat a data URI with a mediatype like data:text/html as malformed and f...
LFiFreak
LFI Freak Features Works with Windows, Linux and OS X Includes bind and reverse shell for both Windows and Linux Written in Python 2.7 What is this all about? A unique tool for exploiting local file inclusions using PHP Input, PHP Filter and Data URI methods. Dependencies BeautifulSoup Disclaimer...
PT-2026-146053
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed uri? treats a data URI mediatype containing the HTML5 named solidus reference as malformed and falls back to the allowed text/plain,...
libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the si...
Important: Red Hat Security Advisory: libsoup3 security update
An update for libsoup3 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...
libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the si...
RHEL 10 : libsoup3 (RHSA-2026:93583)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93583 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup,...
CLEANSTART-2024-AO02193 By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content
CVE-2019-11761 affects multiple packages. By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. See references for individual vulnerability details...
CVE-2026-119549 Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering vi...
CVE-2026-88988 - XSS via SVG data URI
More info at https://www.silverstripe.org/download/security-releases/cve-2026-88988...
CVE-2026-88987 - XSS via XHTML data URI
More info at https://www.silverstripe.org/download/security-releases/cve-2026-88987...
UBUNTU-CVE-2026-114716
Fix mail header injection via media type in an inline image data URI...
CVE-2026-114716
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...
AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792600325)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792600325 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...
AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792599160)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792599160 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...
Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792600325)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792600325 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...
AlmaLinux 10 : libsoup3 (ALSA-2026:83618)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83618 advisory. libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding CVE-2026-102555 libsoup: libsoup: Heap buffer overflow from...