1284 matches found
CKEditor 跨站脚本漏洞
CKEditor is an open source, web-based text editor. A cross-site scripting vulnerability exists in ckeditor that allows a user to abuse the undo function using malformed HTML, which could lead to the execution of JavaScript code...
Drupal 8.9.x < 8.9.18 / 9.1.x < 9.1.12 / 9.2.x < 9.2.4 Multiple Vulnerabilities (SA-CORE-2021-005)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.18, 9.1.x prior to 9.1.12, or 9.2.x prior to 9.2.4. It is, therefore, affected by a multiple vulnerabilities due to its usage of a third party component, CKEditor, for WYSIWYG...
PT-2021-6455
Name of the Vulnerable Software and Affected Versions CKEditor 4 versions 4.13.0 through 4.16.1 Description A vulnerability has been discovered in the clipboard Widget plugin when used alongside the undo feature in CKEditor 4. This issue allows a user to abuse undo functionality using malformed...
admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2021-34552 via pillow (4.1.1)
pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2021-34552 Source advisory: OSV:PYSEC-2021-331...
CiviCRM < 5.28.1 - CSRF to Stored XSS
The plugin was vulnerable to CSRF on the CKEditor Configuration Form. The vulnerability was discovered by sonarsource. Update to versions 5.28.1 and above to patch the vulnerability...
GHSA-RGX6-RJJ4-C388 ckeditor4 vulnerable to cross-site scripting
A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...
ckeditor4 vulnerable to cross-site scripting
A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...
ckeditor4 vulnerable to cross-site scripting
A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...
CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
DEBIAN-CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
UBUNTU-CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
Cross site request forgery (csrf)
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
CVE-2020-36389: Cross-Site Request Forgery (CSRF)
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
CiviCRM 跨站请求伪造漏洞
CiviCRM is an open source, cloud-based member relationship management CRM system developed specifically to meet the needs of nonprofit and association-based organizations. A cross-site request forgery vulnerability exists in CiviCRM versions prior to 5.28.1 and CiviCRM ESR versions prior to 5.27....
CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...
CVE-2020-36389
The CVE-2020-36389 entry concerns a CSRF vulnerability in the CKEditor configuration form in CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR. The provided connected documents corroborate the affected software/versions and the underlying issue (CSRF in the CKEditor config form). No exploit...
