Collaborate Disseminate
I recently added some inline SVG images to my website, and the browsers complained about the style attributes within the SVG code not being covered by my strict CSP (style-src: self). Instead of adding unsafe-inline to the CSP or moving al… Continue reading CSP, inline SVG, and XML attributes
I’m looking at an XSS lab that has the tags: script, iframe, object and embed filtered, and all on* attributes are filtered. However, svg is allowed.
Is this exploitable, with no user interaction required? I’m sure I’ve seen other ways to … Continue reading SVG XSS – When script tag and on* attributes are filtered
If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from mainprod.com despite the Same-Origin Policy (… Continue reading SOP (Same Origin Policy) and CDN SVG XSS
Although some of the first Android-powered smartphones had them and Blackberries were famous for them, physical keyboards on portable electronics like that quickly became a thing of the past. Presumably …read more Continue reading Thin Keyboard Fits in Steam Deck Case
By Deeba Ahmed
Undetected for Over 11 Months, AsyncRAT Lurked on Systems of Sensitive US Agencies with Critical Infrastructures, reports the…
This is a post from HackRead.com Read the original post: AsyncRAT Infiltrates Key US Infrastructure Thro… Continue reading AsyncRAT Infiltrates Key US Infrastructure Through GIFs and SVGs
If you plan to attend Supercon or some other hacker conference, know that you’re going to get a badge with a SAO (Simple Add-On) connector, a 4-pin or 6-pin connector …read more Continue reading Jolly Wrencher SAO, And How KiCad 6 Made It Easy
If you played many games back in the mid-80s to 90s, you might remember the iconic graphics from Sierra’s Online Adventure Games. They were brightly colored (16 colors) and dynamic …read more Continue reading Upscaling The Sierras
My understanding is that:
SVGs offer far greater functionality if they are directly embedded in a site’s HTML code via the <svg> tag than if they are linked to via the <img> tag
For example, if the <svg> tag is used, it… Continue reading Is it practically possible to use SVGs to their full potential while still enjoying all protections offered by Content Security Policy (CSP)?
I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.
I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading external fonts. And unlike using an <… Continue reading What sandbox does an <object> element run in? Can this sandbox be configured?
Since SVG files can have JavaScript, which would get executed is it a potential threat for malware, tracking scripts and similar stuff?
Continue reading Can SVG be a potential threat for tracking scripts and similar?