Cross-Site Scripting in CKEditor

It has been discovered, that the third party library CKEditor is vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...

typo3 -- multiple vulnerabilities

Typo3 core team reports: CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @deja-js/component (>=3.0.0-beta.25, <=4.0.5) +18 more potentially affected by CVE-2018-17960 via ckeditor (>=4.5.11, <=4.10.1)

ckeditor NPM version =4.5.11, =1.0.0, =3.0.0-beta.25, =0.5.0, =0.5.0, =0.0.0-beta.1, =1.0.0, =1.15.5, =0.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2018-17960 Source advisory: OSV:GHSA-G68X-VVQQ-PVW3...

GHSA-G68X-VVQQ-PVW3 Ckeditor XSS Vulnerability

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a specially crafted HTML code, prepared by the attacker, into the opene...

Ckeditor XSS Vulnerability

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a specially crafted HTML code, prepared by the attacker, into the opene...

Cross-site Scripting (XSS)

ckeditor is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the value entered in the CKEditor source area, allowing XSS attacks to occur when switched to WYSIWYG mode...

CVE-2018-17960

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

DEBIAN-CVE-2018-17960

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

CVE-2018-17960

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

CVE-2018-17960

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

UBUNTU-CVE-2018-17960

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

Cross site scripting

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

CVE-2018-17960

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

CVE-2018-17960

CVE-2018-17960 affects CKEditor 4.x before 4.11.0, where a user-assisted XSS can be triggered by pasting in source mode. The issue arises from improper handling of HTML during source-mode paste, enabling injection of malicious script into a page viewed by other users. The documented remediation i...

CVE-2018-17960

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste...

Adobe ColdFusion CKEditor file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Recent assessments: jrobles-r...

Adobe ColdFusion CKEditor unrestricted file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Tested on Adobe ColdFusion...

Subrion CMS 4.2.1 - Cross-Site Scripting

Subrion CMS 4.2.1 - Cross-Site Scripting Exploit Title: Subrion CMS- 4.2.1 XSS Using component with known Vulnerability Date: 02-08-2018 Exploit Author: Zeel Chavda Vendor Homepage: https://subrion.org/ Software Link: https://subrion.org/download/ Version: 4.2.1 REQUIRED Tested on: Windows,FireFo...

Subrion CMS 4.2.1 - Cross-Site Scripting

Exploit Title: Subrion CMS- 4.2.1 XSS Using component with known Vulnerability Date: 02-08-2018 Exploit Author: Zeel Chavda Vendor Homepage: https://subrion.org/ Software Link: https://subrion.org/download/ Version: 4.2.1 REQUIRED Tested on: Windows,FireFox CVE : CVE-2018-14840 Steps: - 1. Create...

Subrion CMS 4.2.1 Cross Site Scripting

Exploit Title: Subrion CMS- 4.2.1 XSS Using component with known Vulnerability Date: 02-08-2018 Exploit Author: Zeel Chavda Vendor Homepage: https://subrion.org/ Software Link: https://subrion.org/download/ Version: 4.2.1 REQUIRED Tested on: Windows,FireFox CVE : CVE-2018-14840 Steps: - 1. Create...