Important: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.16.0. Security Fixes: nodejs: HTTP2 'unknownProtocol' cause DoS by resource...

[SECURITY] Fedora 33 Update: ceph-15.2.9-1.fc33

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage...

PYSEC-2021-127

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...

The vulnerability of the library for working with SVG images in Apache Batik, related to incorrect processing of data in the “xlink:href” attribute, allows attackers to perform CSRF attacks.

The vulnerability of the Apache Batik library for working with SVG images is related to improper processing of data in the “xlink:href” attribute. Exploiting this vulnerability can allow a remote attacker to perform CSRF attacks using specially crafted GET requests...

CVE-2020-35852

Chatbox is affected by cross-site scripting XSS. An attacker has to upload any XSS payload with SVG, XML file in Chatbox. There is no restriction on file upload in Chatbox which leads to stored XSS...

PT-2021-12850 · Squaredup · Squaredup

Name of the Vulnerable Software and Affected Versions: SquaredUp versions prior to 4.6.0 Description: The issue allows for Stored XSS attacks. A user can create a dashboard that executes malicious content in an iframe or by uploading an SVG that contains a script. Recommendations: For versions...

The vulnerability of the SVG markup language implementation in Mozilla Firefox browsers allows attackers to compromise data integrity.

The vulnerability of the SVG markup language implementation in Mozilla Firefox’s browser is related to the lack of a mechanism for checking the tags. These tags can, in turn, utilize tags. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

[SECURITY] Fedora 32 Update: nodejs-12.20.1-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

[SECURITY] Fedora 33 Update: sympa-6.2.60-1.fc33

Sympa is scalable and highly customizable mailing list manager. It can cope with big lists 200,000 subscribers and comes with a complete user and admin Web interface. It is internationalized, and supports the us, fr, de, es, it, fi, and chinese locales. A scripting language allows you to extend t...

Important: Red Hat Security Advisory: Red Hat Ceph Storage 4.2 Security and Bug Fix update

An update is now available for Red Hat Ceph Storage 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links i...

CVE-2020-36171

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

Kozea CairoSVG Resource Management Error Vulnerability

Kozea CairoSVG is a Python based program from the Kozea community that converts SVG files to PDF, EPS, PS and PNG files. A resource management error vulnerability exists in versions of CairoSVG prior to 2.5.1, which can be exploited by an attacker to deliver a malicious SVG and cause the program ...

What's the Value of a Key-Value Store?

A database back end for your application is vital, and odds are that your database is a relational database or a "not only SQL" NoSQL database. Relational databases have dominated the software industry for decades, even as other technologies have radically changed around it. A relational database...

SolarWinds Web Help Desk Cross-Site Scripting Vulnerability (CNVD-2020-73160)

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via an SVG document uploaded in a...

Solarwinds WebHelpDesk 跨站脚本漏洞

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via an SVG document uploaded in a...

E9Patch - A Powerful Static Binary Rewriting Tool

E9Patch is a powerful static binary rewriting tool for x8664 Linux ELF binaries. E9Patch is: Scalable : E9Patch can reliably rewrite large/complex binaries including web browsers 100MB in size. Compatible : The rewritten binary is a drop-in replacement of the original, with no additional...

SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2020:3276-1)

This update for ucode-intel fixes the following issues : Intel CPU Microcode updated to 20201027 prerelease CVE-2020-8695: Fixed Intel RAPL sidechannel attack SGX bsc1170446 CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 bsc1173594 New Platforms: | Processor | Stepping | F-M-S/P...

Vulnerability of syntactic analysis and event loading in SVG code of Firefox web browser and Thunderbird email client, allowing attackers to perform cross-site scripting attacks (XSS).

The vulnerability of syntax analysis and event loading in SVG code of Firefox web browsers and Thunderbird email clients is related to the lack of integrity checks. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Mozilla: XSS through paste (manual and clipboard API)

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...

[SECURITY] Fedora 32 Update: nodejs-12.18.4-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...