1124 matches found
PT-2021-24350
Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.9.0 Description: A stored cross-site scripting vulnerability affects TinyMCE, allowing an unauthenticated and remote attacker to insert crafted HTML into the editor. This results in arbitrary JavaScript execution i...
Cross-Site Scripting (XSS)
tinymce is vulnerable to cross-site scripting XSS. A vulnerability in the URL sanitization logic of the core parser for form elements allows arbitrary JavaScript execution when inserting malicious content into the editor using the clipboard or APIs, and then submitting the form...
Cross-site Scripting (XSS)
tinymce is vulnerable to cross-site scripting XSS. The vulnerability exists as the URLs were not correctly filtered in some cases, allowing an attacker to inject malicious script...
Cross-Site Scripting
Overview There is an XSS vulnerability in tinymce before version 5.7.1. Impact A cross-site scripting XSS vulnerability was discovered in the URL sanitization logic of the core parser for form elements. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted...
GHSA-5VM8-HHGR-JCJP Cross-site scripting vulnerability in TinyMCE
Impact A cross-site scripting XSS vulnerability was discovered in the URL sanitization logic of the core parser for form elements. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs, and then...
@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.3.7) +71 more potentially affected by unknown CVE via tinymce (>=5.0.6, <=5.7.0)
tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =10.3.1-snapshot-1616513687673, =0.18.0, =0.7.9-0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =1.18.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5VM8-HHGR-JCJP...
Cross-site scripting vulnerability in TinyMCE
Impact A cross-site scripting XSS vulnerability was discovered in the URL sanitization logic of the core parser for form elements. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs, and then...
PT-2021-24386
Name of the Vulnerable Software and Affected Versions: TinyMCE versions 5.7.0 and lower Description: A cross-site scripting XSS issue was found in the URL sanitization logic of the core parser for form elements. This allowed arbitrary JavaScript execution when inserting specially crafted content...
Cross-site scripting in TinyMCE
Overview tinymce before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor. Recommendation Upgrade to versions 4.9.7, 5.1.4 or later References - CVE - GitHub Advisory...
Duplicate Advisory: Cross-site scripting in TinyMCE
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gm-ghr9-4v95. This link is maintained to preserve external references. Original Description TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin...
GHSA-P7J5-4MWM-HV86 Duplicate Advisory: Cross-site scripting in TinyMCE
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gm-ghr9-4v95. This link is maintained to preserve external references. Original Description TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin...
CVE-2020-29592
An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed regardless of the file types allowed list in Media settings...
Improper access control
An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed regardless of the file types allowed list in Media settings...
CVE-2020-29592
An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed regardless of the file types allowed list in Media settings...
CVE-2020-29592: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed regardless of the file types allowed list in Media settings...
PT-2021-11695
Name of the Vulnerable Software and Affected Versions: Orchard versions prior to 1.10 Description: The issue concerns a broken access control in Orchard components using the TinyMCE HTML editor's file upload, allowing attackers to upload dangerous executables bypassing the allowed file types...
Cross-site scripting in TinyMCE
Overview A cross-site scripting XSS vulnerability was discovered in the URL sanitization logic of the core parser of tinymce. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all...
WS-2021-0001
A regex denial of service ReDoS vulnerability was discovered in a dependency of the "codesample" plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the "codesample" plugin using TinyMCE 5.5.1 or lowe...
Regular Expression Denial Of Service (ReDoS)
tinymce is vulnerable to regular expression denial of service. The vulnerability allows malicious ruby code samples to cause a denial of service condition in the browser while performing syntax highlighting...