SUSE CVE-2023-5631

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcubewashtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code...

Elevating Enterprise API Security with Wallarm for MuleSoft Anypoint Platform

In an age characterized by digital transformation, APIs serve as the backbone of modern applications, enabling diverse systems to communicate and share data seamlessly. This widespread API adoption, however, exposes organizations to a considerable attack surface, inviting the attention of cyber...

Cloud Webinar Series Part 1: Commanding Cloud Strategies

Over the past decade, cloud computing has evolved into a cornerstone of modern business operations. Its flexibility, scalability, and efficiency have reshaped industries and brought unprecedented opportunities. However, this transformation has come with challenges—most notably those associated wi...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-85610)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from an information disclosure vulnerability that can be...

Using Velociraptor for large-scale endpoint visibility and rapid threat hunting

TL;DR Network-wide collection, acquisition and monitoring tool for use in DFIR engagements Designed for enterprise networks 150k+ Deployments aren’t unheard of Boasts many features that your commercial EDR has, and a few more Flexible querying language that can adapt to new threats and encourages...

RLSA-2023:5363 Important: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 18. BZ2223313, BZ2234404 Security Fixes: nodejs: Permissions policies can be bypasse...

batik: Server-Side Request Forgery vulnerability

A flaw was found in Apache Batik 1.0 - 1.16. This issue occurs due to a malicious SVG triggering external resources loading by default, causing resource consumption or in some cases information disclosure...

[SECURITY] Fedora 37 Update: slurm-22.05.9-5.fc37

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

PT-2023-29225 · Unknown · Sanitize-Html

Name of the Vulnerable Software and Affected Versions: HtmlSanitizer versions prior to 8.0.723 HtmlSanitizer version 8.1.722-beta and earlier Description: The issue occurs in configurations where foreign content is allowed, specifically when svg or math are in the list of allowed elements. This...

PT-2023-29009 · Unknown · Prison Management System

Name of the Vulnerable Software and Affected Versions: Personal Management System version 1.4.64 Description: The issue allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar. Recommendations: For Personal Management System version 1.4.64, conside...

[SECURITY] Fedora 39 Update: slurm-22.05.9-5.fc39

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

CVE-2023-44216

PVRIC PowerVR Image Compression on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately...

UBUNTU-CVE-2023-44216

PVRIC PowerVR Image Compression on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately...

Apache Airflow Authorization Problem Vulnerability (CNVD-2023-72233)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

PYSEC-2023-311

plone.namedfile allows users to handle File and Image fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by...

Zope Security Vulnerability

Zope is a set of object-oriented, open source web application servers written in the Python language by the Zope community. A security vulnerability exists in Zope that stems from a stored cross-site scripting vulnerability XSS vulnerability in SVG images. The vulnerability can be exploited to...

Plone Cross-Site Scripting Vulnerability

Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in versions prior to plone.namedfile 5.6.1, 6.0.3, 6.1.3, and 6.2.1, which stems from a security issue with SVG images that was not fully fixed by previous...

CVE-2023-37611

Cross Site Scripting XSS vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component...

Neos CMS Cross-Site Scripting Vulnerability

Neos CMS is an open source CMS software from Neos. A security vulnerability exists in Neos CMS version 8.3.3, which stems from the presence of a stored cross-site scripting XSS vulnerability. The vulnerability can be exploited by an attacker to execute arbitrary code by designing SVG files...

Advantages of a Cloud VPS Server

By Owais Sultan A Cloud VPS Virtual Private Server is a virtualized instance of a physical server hosted in the cloud, offering scalable computing resources and the ability to run applications and services independently, providing flexibility and cost-effectiveness. This is a post from HackRead.c...