SAILFISH System to Find State-Inconsistency Bugs in Smart Contracts

A group of academics from the University of California, Santa Barbara, has demonstrated what it calls a "scalable technique" to vet smart contracts and mitigate state-inconsistency bugs, discovering 47 zero-day vulnerabilities on the Ethereum blockchain in the process. Smart contracts are program...

UBUNTU-CVE-2021-45930

Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and QPathClipper::intersect...

Wiki.js 跨站脚本漏洞

Wiki.js is a suite of open source Wiki software based on Node.js and written in JavaScript by the Requarks.io team. Requarks Wiki.js suffers from a cross-site scripting vulnerability that stems from a script that uploads SVG files through a custom request using a forged MIME type. By creating a...

PT-2022-11994 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users. This is achieved by exploiting a Cross Site Scripting XSS vulnerability, whe...

HTML Cleaner allows crafted and SVG embedded scripts to pass through

...

PatrOwl privilege management error vulnerability

PatrOwl is a scalable, free and open source solution for orchestrating secure operations. patrOwl is vulnerable to a privilege management error, which could be exploited by an attacker to download all lookup import files...

PT-2021-23490 · Unknown · Abantecart

Name of the Vulnerable Software and Affected Versions: AbanteCart versions prior to 1.3.2 Description: An issue was discovered that allows any low-privileged user with file-upload permissions to upload a malicious SVG document containing an XSS payload. Recommendations: For versions prior to 1.3....

ALPINE-CVE-2021-43818

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

CVE-2021-43818 HTML Cleaner allows crafted and SVG embedded scripts to pass through

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

PT-2021-6092 · Lxml +10 · Lxml +10

Name of the Vulnerable Software and Affected Versions: lxml versions prior to 4.6.5 Description: The HTML Cleaner in lxml.html allows certain crafted script content to pass through, as well as script content in SVG files embedded using data URIs. This can be exploited by a remote attacker to...

CVE-2021-40092

A cross-site scripting XSS vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file...

PYSEC-2021-841

In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the maliciou...

[SECURITY] Fedora 34 Update: slurm-21.08.4-1.fc34

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

Apache Ozone has unspecified vulnerabilities

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. a security vulnerability in Apache Ozone version 1.2.0, which stems from the fact that certain administrator-related SCM commands can be executed by any authenticated user...

The vulnerability of the Adobe SVG Native Viewer lies in the overflow of buffer in the queue, allowing an attacker to execute arbitrary code.

The vulnerability of the Adobe SVG Native Viewer is related to buffer overflow in the heap. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in the context of the current user, using a specially crafted PDF file...

CVE-2021-40753

Adobe After Effects version 18.4.1 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a...

How to Choose the Right DDoS Protection Solution

Pankaj Gupta, Senior Director at Citrix Distributed denial of service DDoS attacks have become increasingly sophisticated, bigger, and economically motivated. Even after 25 years, they still pose a huge security risk for every business. This is in large part because DDoS attacks are relatively ea...

Mozilla Firefox Security Advisory (MFSA2012-63) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

CVE-2021-41178

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishi...

Nextcloud 路径遍历漏洞

Nextcloud is an open source set of self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. nextcloud has a file traversal vulnerability in versions prior to 20.0.13, 21.0.5, and 22.2.0, which stems from a lack of authentication, access contro...