Malicious code in ckeditor5-cloud-services (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9540 Malicious code in ckeditor5-cloud-services (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9538 Malicious code in ckeditor5-alignment (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9539 Malicious code in ckeditor5-block-quote (npm)

--- -= Per source details. Do not edit below this line.=-...

4game-support-ckeditor5-custom-build (>=0.0.1 <=0.0.5), @_mehrad/ckeditor5-build-mmr (>=41.3.1 <=42.0.3) +583 more potentially affected by CVE-2024-45613 via ckeditor5 (>=40.0.0 <=43.1.0)

ckeditor5 NPM version =40.0.0, =0.0.1, =41.3.1, =2.1.0, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.0-Beta1, =0.0.17-Beta, =0.0.15-Beta78, =0.0.1, =1.0.0, =0.0.1, =0.0.3, =0.0.8 and more Source cves: CVE-2024-45613 Source advisory: OSV:GHSA-RGG8-G5X8-WR9V...

Cross-site scripting in CKEditor5

CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is adding...

GHSA-6P89-3P7C-QRHV Cross-site scripting in CKEditor5

CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is adding...

CVE-2022-48110

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is addin...

CKSource CKEditor5 35.4.0 Cross Site Scripting Vulnerability

Exploit Title: Cross Site Scripting in CKSource's CKEditor5 35.4.0 Google Dork: N/A Exploit Author: Manish Pathak Vendor Homepage: https://cksource.com/ Software Link: https://ckeditor.com/ckeditor-5/download/ Version: 35.4.0 Tested on: Linux / Web CVE : CVE-2022-48110 CKSource CKEditor5 35.4.0 w...

CKSource CKEditor5 35.4.0 Cross Site Scripting

Exploit Title: Cross Site Scripting in CKSource's CKEditor5 35.4.0 Google Dork: N/A Date: February 09, 2023 Exploit Author: Manish Pathak Vendor Homepage: https://cksource.com/ Software Link: https://ckeditor.com/ckeditor-5/download/ Version: 35.4.0 Tested on: Linux / Web CVE : CVE-2022-48110...

@8trhieu/ckeditor5-build-classic-custom (>=0.0.1 <=0.0.5), @abcxyz123321555/ckeditor5-build-test-version (>=0.8.3 <=0.8.8) +139 more potentially affected by CVE-2022-31175 via @ckeditor/ckeditor5-html-support (>=0.0.0-internal-20241017.0 <=34.2.0)

@ckeditor/ckeditor5-html-support NPM version =0.0.0-internal-20241017.0, =0.0.1, =0.8.3, =0.0.6, =1.1.0, =34.1.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0,...

CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

GHSA-42WQ-RCH8-6F6J CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

Cross-site Scripting (XSS)

@ckeditor/ckeditor5-markdown-gfm is vulnerable to cross-site scripting. An attacker can inject and execute a malicious javascript if the library uses an unsafe markup configuration inside the editor, initializes the editor on an element that uses an element other than as a base, or destroys the...

Regular Expression Denial Of Service (ReDoS)

ckeditor5 is vulnerable to regular expression denial of service. An attacker is able to exploit the vulnerability and crash the system by submitting a malicious html code via the parse.js function...

GHSA-GVPX-9459-W3MJ Cross-Site Scripting in @ckeditor/ckeditor5-link

Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The createPreviewButton function fails to sanitize the href attribute of a created tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 10.0.1 or late...