2407 matches found
Enhancesoft osTicket cross-site scripting vulnerability
Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the United States. A security vulnerability exists in Enhancesoft osTicket, which stems from its component audit/class.audit.php that allows attackers to execute arbitrary web script or HTML via a crafted SVG file...
CVE-2022-32115
An issue in the isSVG function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file...
CVE-2022-32115
An issue in the isSVG function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file...
Fedora: Security Advisory for golang-github-ajstarks-deck (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Cloud Complexity Requires a Unified Approach to Assessing Risk
There has been an unprecedented acceleration in the shift to the cloud as a result of the COVID-19 pandemic. McKinsey experts estimate companies have moved to the cloud “24 times faster ... than they thought” over the past two years. As organizations move quickly to scale, drive innovation, and...
[SECURITY] Fedora 36 Update: moby-engine-20.10.17-3.fc36
Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between - and they don'...
[SECURITY] Fedora 36 Update: golang-github-ajstarks-deck-0-0.12.20210114git30c9fc6.fc36
Deck is a library for clients to make scalable presentations, using a standard markup language. Clients read deck files into the Deck structure, and traverse the structure for display, publication, etc. Clients may be interactive or produce standard formats such as SVG or PDF...
CVE-2022-1964
The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
WordPress plugin Easy SVG Support: Cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress Easy SVG Support plugin 3.3....
CVE-2022-33910
An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...
Malicious code in scalable-form-sd (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ec7add9ea45ea235641e09c8ab591ef5773b0012223d71a2d5968ff4d8cb7eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in scalable-form-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 583890e0e796c048e0c31b3c29dd6f85c2f01e8c11f3f6fc28dc6534aa03fa57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in scalable-form-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 830465c028625eadb1da591638a8a6c06b5cc02560ee7ec2ebca321103b31553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5956 Malicious code in scalable-form-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 830465c028625eadb1da591638a8a6c06b5cc02560ee7ec2ebca321103b31553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5955 Malicious code in scalable-form-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 583890e0e796c048e0c31b3c29dd6f85c2f01e8c11f3f6fc28dc6534aa03fa57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress plugin "Allow SVG files" – code-related vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin. WordPress Allow svg files plugin...
CVE-2022-32243
When a user opens manipulated Scalable Vector Graphics .svg, svg.x3d files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application...
CVE-2022-32243
When a user opens manipulated Scalable Vector Graphics .svg, svg.x3d files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application...
Samast Technologies Magicpin code issue vulnerability
Samast Technologies Magicpin is a Samast Technologies India application that combines parts of Zomato restaurant discovery and reviews and Roposo theme-based social media network on the consumer side and Freshdesk customer management application on the restaurant side. applications. A security...
FacturaScripts Cross-Site Scripting Vulnerabilities
FacturaScripts is an ERP software. A cross-site scripting vulnerability exists in versions prior to facturascripts 2022.06, which stems from a lack of filename validation, and can be exploited by an attacker to upload a svg file resulting in a cross-site scripting attack...