@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @ec.components/tinymce (>=0.5.7, <=0.6.0) +37 more potentially affected by CVE-2019-1010091 via tinymce (>=4.5.1, <=4.9.8)

tinymce NPM version =4.5.1, =1.0.0, =0.5.7, =0.1.1, =0.0.13, =1.3.0, =8.0.0, =0.8.8, =0.6.3, =1.2.0, =1.0.0-alpha.0, =1.1.0, =2.2.0 - common-library 0.0.0 - connectwise-manager 10.0.0 and more Source cves: CVE-2019-1010091 Source advisory: OSV:GHSA-C78W-2GW7-GJV3...

@enhavo/form (>=0.1.2, <=0.8.5), @enhavo/translation (>=0.8.4, <=0.8.5) +22 more potentially affected by CVE-2019-1010091 via tinymce (>=5.0.6, <=5.2.1)

tinymce NPM version =5.0.6, =0.1.2, =0.8.4, =0.18.0, =15.0.1, =0.0.46, =0.0.14, =1.0.11-beta.17, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2019-1010091 Source advisory: OSV:GHSA-C78W-2GW7-GJV3...

CVE-2013-4791

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

Cross site scripting

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

CVE-2013-4791

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

CVE-2013-4791

CVE-2013-4791 affects PrestaShop versions before 1.4.11. Multiple connected sources (GHSA/OSV/CNVD/NVD/CVE lists) describe a stored XSS in TinyMCE exploitable by Logistician/low-privilege accounts. The vulnerability allows authenticated low-privilege users to inject persistent script via the Tiny...

CVE-2013-4791: Improper Neutralization of Input During Web Page Generation

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

PT-2020-7509

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.4.11 Description: The issue allows low-level profiles, such as Logistician and translators, to inject a persistent XSS vector on TinyMCE. Recommendations: For versions prior to 1.4.11, update to version 1.4.11 o...

CVE-2011-4906

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

Unrestricted file upload

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

CVE-2011-4906

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

CVE-2011-4906

CVE-2011-4906 concerns a vulnerability in the TinyMCE 3.0 editor integrated into Joomla! prior to 1.5.13. The connected documents confirm that an improper file upload mechanism could allow arbitrary PHP code execution via the TinyMCE-based upload path, enabling an attacker to execute code remotel...

CVE-2011-4906: Unrestricted Upload of File with Dangerous Type

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

PT-2020-7142

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 1.5.13 Description The issue allows file upload and arbitrary PHP code execution through the Tiny browser in the TinyMCE 3.0 editor. Recommendations For versions prior to 1.5.13, update to version 1.5.13 or later to...

Cross-site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. The attack exists because it does not prevent the attacker from injecting a malicious script into the editor via the clipboard or APIs, allowing to execute the script when a user loads the editor...

@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @ec.components/tinymce (>=0.5.7, <=0.6.0) +37 more potentially affected by CVE-2020-17480 via tinymce (>=4.5.1, <=4.9.5)

tinymce NPM version =4.5.1, =1.0.0, =0.5.7, =0.1.1, =0.0.13, =1.3.0, =8.0.0, =0.8.8, =0.6.3, =1.2.0, =1.0.0-alpha.0, =1.1.0, =2.2.0 - common-library 0.0.0 - connectwise-manager 10.0.0 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...

@enhavo/form (>=0.1.2, <=0.8.5), @enhavo/translation (>=0.8.4, <=0.8.5) +14 more potentially affected by CVE-2020-17480 via tinymce (>=5.0.6, <=5.1.0)

tinymce NPM version =5.0.6, =0.1.2, =0.8.4, =0.18.0, =15.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =2.4.3, =1.0.0, =2.14.3, =1.2.3, =2.2.81 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...

GHSA-27GM-GHR9-4V95 Cross-site scripting vulnerability in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are...

PT-2020-15020

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.6 and earlier TinyMCE versions 5.1.3 and earlier Description A cross-site scripting XSS issue was discovered in the core parser, paste and visualchars plugins, allowing arbitrary JavaScript execution when inserting special...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the HTML comments and CDATA information...