HTML Cleaner allows crafted and SVG embedded scripts to pass through

...

SICK SOPAS ET security vulnerabilities

Sick Sopas Et is an engineering tool from the German company Sick.A security vulnerability exists in versions prior to SICK SOPAS ET 4.8.0, which could be exploited by an attacker to package any executable file into an SDD and make it available to SOPAS ET users...

No checks if given product is created by the factory

Handle 0x0x0x Vulnerability details An attacker can create a fake product. Collateral contract does not check whether the given product is created by the factory. A malicious product can return arbitrary maintenance amounts, therefore they can make any deposit to fake product stuck simply return...

uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities

Document Title: =============== uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2288 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

AbanteCart cross-site scripting vulnerabilities

AbanteCart is a PHP-based e-commerce platform. AbanteCart is vulnerable to a cross-site scripting vulnerability prior to 1.3.2, which stems from a lack of data validation filtering of user-supplied data and output. An attacker with file upload privileges could exploit this vulnerability to upload...

PT-2021-23490 · Unknown · Abantecart

Name of the Vulnerable Software and Affected Versions: AbanteCart versions prior to 1.3.2 Description: An issue was discovered that allows any low-privileged user with file-upload permissions to upload a malicious SVG document containing an XSS payload. Recommendations: For versions prior to 1.3....

ALPINE-CVE-2021-43818

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

CVE-2021-43818 HTML Cleaner allows crafted and SVG embedded scripts to pass through

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

PT-2021-27932

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which occurs in the flatbuffers::EscapeString function, and is also associated with...

PT-2021-6092

Name of the Vulnerable Software and Affected Versions lxml versions prior to 4.6.5 Description The HTML Cleaner in lxml.html allows certain crafted script content to pass through, as well as script content in SVG files embedded using data URIs. This can be exploited by a remote attacker to perfor...

Basket can be fully drained if the auction is settled within a specific block

Handle Ruhum Vulnerability details Impact The settleAuction function allows someone to settle the auction by transferring funds in a way that the new pending index is fulfilled. As a reward, they are able to take out as many tokens as they want as long as the pending index is fulfilled after that...

Reprise Software Reprise License Manager: Security Feature Vulnerability

Reprise Software Reprise License Manager is a software licensing toolkit from Reprise Software, Inc. that provides local and cloud-based license management, license enforcement and product activation solutions for publishers of commercial software applications.Reprise Software Reprise License...

Reprise Software Reprise License Manager: Access Control Vulnerability

Reprise License Manager is a software licensing toolkit from Reprise Software, Inc. that provides local and cloud-based license management, license enforcement and product activation solutions for publishers of commercial software applications.Reprise Software Reprise License Manager A licensing...

Bentley Systems Bentley View resource management error vulnerability

Bentley View is a free viewer from Bentley Systems, Inc. A memory mis-reference vulnerability exists in Bentley View J2K File Parsing, which results from not verifying the existence of an object prior to J2K File Parsing. An attacker could exploit this vulnerability to execute code in the context...

CVE-2021-40092

A cross-site scripting XSS vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file...

Adobe Audition Heap Buffer Overflow DoS

The vulnerability of Adobe Audition’s audio editing software for Windows and macOS is related to the execution of operations beyond the buffer limits in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

Google Android Buffer Overflow Vulnerability

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to information leakage, which could be exploited by attackers to obtain sensitive information and use it to launch further attacks on the affected system...

[SECURITY] Fedora 34 Update: synfigstudio-1.4.0-3.fc34

Synfig Animation Studio is a powerful, industrial-strength vector-based 2D animation software, designed from the ground-up for producing feature-film quality animation with fewer people and resources. It is designed to be capable of producing feature-film quality animation. It eliminates the need...

[SECURITY] Fedora 34 Update: autotrace-0.31.1-62.fc34

AutoTrace is a program for converting bitmaps to vector graphics. Supported input formats include BMP, TGA, PNM, PPM, and any format supported by ImageMagick, whereas output can be produced in Postscript, SVG, xfig, SWF, and others...

Fedora: Security Advisory for autotrace (FEDORA-2021-b58af96f33)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...