CVE-2021-24960

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks...

PeTeReport 跨站脚本漏洞

PeTeReport is an open source application vulnerability reporting tool. PeTeReport has a cross-site scripting vulnerability that stems from the software's lack of filtering and escaping of user data, which could be exploited by an attacker to inject persistent JavaScript code through an...

PT-2022-7626 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc3+ Description: The vulnerability is related to the iommu/vt-d component in the Linux kernel. When enabling VMD and IOMMU scalable mode, a kernel panic call trace/kernel log is shown, indicating a doubl...

[SECURITY] Fedora 34 Update: cyrus-imapd-3.2.8-2.fc34

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

[SECURITY] Fedora 35 Update: nodejs-16.14.0-2.fc35

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

CVE-2022-24588

Flatpress v1.2.1 was discovered to contain a cross-site scripting XSS vulnerability in the Upload SVG File function...

FlatPress 跨站脚本漏洞

FlatPress is a Php-based blog builder with no database support from the FlatPress community. A cross-site scripting vulnerability exists in FlatPress v1.2.1, which stems from the discovery of a cross-site scripting XSS vulnerability in the Upload SVG File function...

CVE-2021-42940

A Cross Site Scripting XSS vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code...

PT-2022-9446 · WordPress · Svg Support

Name of the Vulnerable Software and Affected Versions: SVG Support WordPress plugin versions prior to 2.3.20 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of escaping in the CSS Class to target setting before it is outputted in an...

How Wazuh Can Improve Digital Security for Businesses

2021 was a year peppered by cyberattacks, with numerous data breaches happening. Not only that, but ransomware has also become a prominent player in the hackers' world. Now, more than ever, it's important for enterprises to step up cybersecurity measures. They can do this through several pieces o...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-07912)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster 7.4.34, 7.5.24, 7.6.20, 8.0.27 and earlier versions are vulnerable to an input validation error. An attacker could use this vulnerability to corrupt or...

Fedora: Security Advisory for qt5-qtsvg (FEDORA-2022-8e3fbc74e9)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

convert-svg 路径遍历漏洞

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in convert-svg, which can be exploited by an attacker to read an arbitrary file from the filesystem via a carefully constructed SVG file and then display the...

[SECURITY] Fedora 35 Update: nodejs-16.13.2-1.fc35

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

SAILFISH System to Find State-Inconsistency Bugs in Smart Contracts

A group of academics from the University of California, Santa Barbara, has demonstrated what it calls a "scalable technique" to vet smart contracts and mitigate state-inconsistency bugs, discovering 47 zero-day vulnerabilities on the Ethereum blockchain in the process. Smart contracts are program...

UBUNTU-CVE-2021-45930

Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and QPathClipper::intersect...

Wiki.js 跨站脚本漏洞

Wiki.js is a suite of open source Wiki software based on Node.js and written in JavaScript by the Requarks.io team. Requarks Wiki.js suffers from a cross-site scripting vulnerability that stems from a script that uploads SVG files through a custom request using a forged MIME type. By creating a...

PT-2022-11994 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users. This is achieved by exploiting a Cross Site Scripting XSS vulnerability, whe...

HTML Cleaner allows crafted and SVG embedded scripts to pass through

...

PatrOwl privilege management error vulnerability

PatrOwl is a scalable, free and open source solution for orchestrating secure operations. patrOwl is vulnerable to a privilege management error, which could be exploited by an attacker to download all lookup import files...