CVE-2020-17480

Removed by vendor...

TinyMCE XSS vulnerability on version 4.7.11

h4. Description It seems that Confluence bundles a version of TinyMCE within the editor that has an XSS vulnerability. Confluence version 7.4.1 uses version 0.4.34 of the confluence-editor plugin that includes 4.7.11 of TinyMCE as a dependency Confluence version 7.6.2 uses version 0.4.41 of the...

Exploit for Path Traversal in Atlassian Confluence_Server

PoC exploit for CVE-2019-3396, a Confluence Server-Side Template Injection SSTI Remote Code Execution RCE vulnerability. The exploit targets Confluence versions vulnerable to this CVE. The vulnerability is exploited by sending a specially crafted request to the Confluence REST API, which allows a...

@angular-materials/ngx-admin (>=1.0.0 <=1.0.1), @ec.components/tinymce (>=0.5.7 <=0.6.0) +34 more potentially affected by CVE-2019-1010091 via tinymce (>=4.5.1 <=4.8.5)

tinymce NPM version =4.5.1, =1.0.0, =0.5.7, =0.1.1, =0.0.13, =1.3.0, =8.0.0, =0.8.8, =0.6.3, =1.2.0, =1.0.0-alpha.0, =1.1.0, =2.4.1, =4.0.0 and more Source cves: CVE-2019-1010091 Source advisory: OSV:GHSA-C78W-2GW7-GJV3...

3h1-ui (>=2.14.41 <=3.0.0-next.258), @abt-desk/apm (>=0.0.1 <=0.33.12) +944 more potentially affected by CVE-2019-1010091 via tinymce (>=5.0.11 <=5.2.1)

tinymce NPM version =5.0.11, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.17, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =1.0.0, =8.7.0 and more Source cves: CVE-2019-1010091 Source advisory: OSV:GHSA-C78W-2GW7-GJV3...

GHSA-C78W-2GW7-GJV3 XSS in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in: the core parser and media plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE...

XSS in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in: the core parser and media plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE...

CVE-2013-4791

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

Cross site scripting

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

CVE-2013-4791

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

CVE-2013-4791

CVE-2013-4791 affects PrestaShop versions before 1.4.11. Multiple connected sources (GHSA/OSV/CNVD/NVD/CVE lists) describe a stored XSS in TinyMCE exploitable by Logistician/low-privilege accounts. The vulnerability allows authenticated low-privilege users to inject persistent script via the Tiny...

CVE-2011-4906

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

Unrestricted file upload

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

CVE-2011-4906

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

CVE-2011-4906

CVE-2011-4906 concerns a vulnerability in the TinyMCE 3.0 editor integrated into Joomla! prior to 1.5.13. The connected documents confirm that an improper file upload mechanism could allow arbitrary PHP code execution via the TinyMCE-based upload path, enabling an attacker to execute code remotel...

Cross-site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. The attack exists because it does not prevent the attacker from injecting a malicious script into the editor via the clipboard or APIs, allowing to execute the script when a user loads the editor...

@angular-materials/ngx-admin (>=1.0.0 <=1.0.1), @aurocraft/builder (>=1.0.0 <=3.3.3) +292 more potentially affected by CVE-2020-17480 via tinymce (>=4.5.1 <=4.9.5)

tinymce NPM version =4.5.1, =1.0.0, =1.0.0, =1.0.0-alpha.39-baliz, =4.3.0, =0.5.0, =0.1.0, =0.0.4, =0.1.1, =0.0.13, =1.3.0, =1.0.0, =2.0.0-beta.1, =1.1.1, =1.1.3 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...

3h1-ui (>=2.14.41 <=3.0.0-next.258), @abt-desk/apm (>=0.0.1 <=0.33.12) +937 more potentially affected by CVE-2020-17480 via tinymce (>=5.0.11 <=5.1.0)

tinymce NPM version =5.0.11, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.17, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =1.0.0, =8.7.0 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...

GHSA-27GM-GHR9-4V95 Cross-site scripting vulnerability in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the HTML comments and CDATA information...