GHSA-9FCX-CV56-W58P Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder

Impact Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important...

PT-2024-10912 · Mautic +1 · Mautic +1

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 Description: Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mauti...

Cross-site Scripting (XSS)

grapesjs is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the class name in ClassTagView.ts when it adds to the selector manager, allowing an attacker to inject and execute malicious javascript...

GHSA-589F-C66P-HXR4 grapesjs before 0.19.5 vulnerable to Cross-site Scripting

The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

@adabra/ui-libs-grapesjs-mjml (>=0.0.122, <=0.0.139), @ant-extensions/page-maker (>=0.0.1, <=0.0.5) +44 more potentially affected by CVE-2022-21802 via grapesjs (>=0.10.8, <=0.18.4)

grapesjs NPM version =0.10.8, =0.0.122, =0.0.1, =1.0.6, =0.0.12, =2.0.18, =0.8.1-esbuild, =0.0.1, =1.0.3, =0.10.4, =22.0.8, =0.10.4-custom.0, =0.0.19, =0.1.5, =0.10.17, =1.0.8 and more Source cves: CVE-2022-21802 Source advisory: OSV:GHSA-589F-C66P-HXR4...

grapesjs before 0.19.5 vulnerable to Cross-site Scripting

The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

@adabra/ui-libs-grapesjs-mjml (>=0.0.122, <=0.0.139), @ant-extensions/page-maker (>=0.0.1, <=0.0.5) +44 more potentially affected by CVE-2022-21802 via grapesjs (>=0.10.8, <=0.18.4)

grapesjs NPM version =0.10.8, =0.0.122, =0.0.1, =1.0.6, =0.0.12, =2.0.18, =0.8.1-esbuild, =0.0.1, =1.0.3, =0.10.4, =22.0.8, =0.10.4-custom.0, =0.0.19, =0.1.5, =0.10.17, =1.0.8 and more Source cves: CVE-2022-21802 Source advisory: GHSA-589F-C66P-HXR4...

CVE-2022-21802

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

Cross site scripting

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

CVE-2022-21802

GrapesJS before 0.19.5 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization of the class name in the Selector Manager. Affected component is the GrapesJS web builder/framework; the root cause is inadequate sanitization when adding class names in ClassTagView.ts (Selector Manag...

CVE-2022-21802

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

PT-2022-15140

Name of the Vulnerable Software and Affected Versions grapesjs versions prior to 0.19.5 Description The issue is related to an improper sanitization of the class name in Selector Manager, which leads to Cross-site Scripting XSS. There is no information provided about the estimated number of...

Grapesjs cross-site scripting vulnerabilities

grapesjs is a free and open source Web Builder framework by Artur Arseniev Individual Developer, Italy. Helps to build HTML templates faster and easier for delivery in websites, newsletters or mobile applications u200bu200b. A security vulnerability exists in grapesjs versions prior to 0.19.5,...

CVE-2022-21802: Improper Neutralization of Input During Web Page Generation

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

CVE-2022-21802

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

Cross-site Scripting (XSS)

oro/commerce is vulnerable to cross-site scripting. The vulnerability exists through the grapesjs dependency used in the library as it does not properly validate the class name in ClassTagView.ts when it adds to the selector manager, allowing an attacker to inject and execute malicious javascript...

@adabra/ui-libs-grapesjs-mjml (>=0.0.122, <=0.0.139), @ant-extensions/page-maker (>=0.0.1, <=0.0.5) +44 more potentially affected by CVE-2022-21802 via grapesjs (>=0.10.8, <=0.18.4)

grapesjs NPM version =0.10.8, =0.0.122, =0.0.1, =1.0.6, =0.0.12, =2.0.18, =0.8.1-esbuild, =0.0.1, =1.0.3, =0.10.4, =22.0.8, =0.10.4-custom.0, =0.0.19, =0.1.5, =0.10.17, =1.0.8 and more Source cves: CVE-2022-21802 Source advisory: SNYK:JS-GRAPESJS-2935960...

Cross-site Scripting (XSS)

Overview grapesjs is a web builder framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...