CKSource CKEditor5 35.4.0 Cross Site Scripting

Exploit Title: Cross Site Scripting in CKSource's CKEditor5 35.4.0 Google Dork: N/A Date: February 09, 2023 Exploit Author: Manish Pathak Vendor Homepage: https://cksource.com/ Software Link: https://ckeditor.com/ckeditor-5/download/ Version: 35.4.0 Tested on: Linux / Web CVE : CVE-2022-48110...

GHSA-42WQ-RCH8-6F6J CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

Cross-site Scripting (XSS)

@ckeditor/ckeditor5-markdown-gfm is vulnerable to cross-site scripting. An attacker can inject and execute a malicious javascript if the library uses an unsafe markup configuration inside the editor, initializes the editor on an element that uses an element other than as a base, or destroys the...

Regular Expression Denial Of Service (ReDoS)

ckeditor5 is vulnerable to regular expression denial of service. An attacker is able to exploit the vulnerability and crash the system by submitting a malicious html code via the parse.js function...

@ckeditor/ckeditor5-build-balloon (>=0.0.1, <=0.2.0), @ckeditor/ckeditor5-build-balloon-toolbar (>=0.0.1, <=0.1.0) +7 more potentially affected by CVE-2018-11093 via @ckeditor/ckeditor5-link (>=0.5.1, <=1.0.0-beta.4)

@ckeditor/ckeditor5-link NPM version =0.5.1, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.1, =1.0.0-rc.2, =0.3.0, =0.5.2 Source cves: CVE-2018-11093 Source advisory: OSV:GHSA-GVPX-9459-W3MJ...

GHSA-GVPX-9459-W3MJ Cross-Site Scripting in @ckeditor/ckeditor5-link

Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The createPreviewButton function fails to sanitize the href attribute of a created tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 10.0.1 or late...