Detection of Error Condition Without Action

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Detection of Error Condition Without Action due to a bug in the CKEditor 5 module that incorrectly handles image uploads. An...

GHSA-52JR-X6H6-XJ6G Drupal core vulnerable to improper error handling

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...

Security Bulletin: IBM Sterling B2B Integrator is affected by multiple vulnerabilities in CKEditor

Summary IBM Sterling B2B Integrator is affected by multiple vulnerabilities in CKEditor Vulnerability Details CVEID:CVE-2021-32808 DESCRIPTION: CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the clipboard Widget plugin if used alongside the...

Fedora 37 : ckeditor (2022-4c634ee466)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-4c634ee466 advisory. CKEditor 4.20 New Features: 5084: Added the config.tabletoolsscopedHeaders configuration option controlling the behaviour of table headers with and...

Drupal Improper Error Handling Vulnerability (SA-CORE-2024-002) - Windows

Drupal is prone to an improper error handling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal Improper Error Handling Vulnerability (SA-CORE-2024-002) - Linux

Drupal is prone to an improper error handling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8

Summary Third party reported 'Stored XSS' and 'CSRF' issues, Apache Tomcat, Apache ActiveMQ, CKEditor, libcURL, xmlbeans, scala-library, json-smart, jna-platform, jackson-databind, commons-io, shiro-core, commons-net, snappy-java, xercesImpl are identified as vulnerable components with multiple...

Drupal 10.2.x < 10.2.10 Drupal Vulnerability (SA-CORE-2024-002)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.2.x prior to 10.2.10. It is, therefore, affected by a vulnerability. - A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

DRUPAL-CORE-2024-002

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...

Malicious code in ckeditor5-table (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ckeditor5-block-quote (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ckeditor5-alignment (npm)

--- -= Per source details. Do not edit below this line.=-...

Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...

PT-2024-9995 · Drupal +1 · Drupal Core +1

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 10.0.0 through 10.2.9 Description: A vulnerability in Drupal Core allows file manipulation. This issue is related to weaknesses in handling error situations, which could allow a remote attacker to impact the integrity of...

Malicious code in uploadcare-ckeditor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3f45b40158aaeddcc33b1c938c4b734b5ada13389ee6750c54b01b5aab4d5ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9201 Malicious code in uploadcare-ckeditor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3f45b40158aaeddcc33b1c938c4b734b5ada13389ee6750c54b01b5aab4d5ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross Site Scripting(XSS)

CKEditor 5 is vulnerable to a Cross-Site Scripting XSS. The vulnerability is due to Insecure Editor Configuration and lack of Input Sanitization in the CKEditor 5 clipboard package, which allows an attacker to insert malicious content into the editor when the General HTML Support or HTML Embed...

CKEditor 40.x < 43.1.1 XSS Vulnerability

CKEditor 5 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-RGG8-G5X8-WR9V Cross-site scripting (XSS) in the clipboard package

Impact During a recent internal audit, we identified a Cross-Site Scripting XSS vulnerability in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious...

Cross-site scripting (XSS) in the clipboard package

Impact During a recent internal audit, we identified a Cross-Site Scripting XSS vulnerability in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious...