1204 matches found
CVE-2018-9861
Cross-site scripting XSS vulnerability in the Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG...
UBUNTU-CVE-2018-9861
Cross-site scripting XSS vulnerability in the Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG...
CVE-2018-9861
Cross-site scripting XSS vulnerability in the Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG...
CVE-2018-9861
Cross-site scripting XSS vulnerability in the Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG...
CVE-2018-9861
Cross-site scripting XSS vulnerability in the Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG...
CVE-2018-9861
CVE-2018-9861 is a cross-site scripting (XSS) vulnerability in the Enhanced Image (image2) plugin for CKEditor. Affected versions are CKEditor image2 plugin 4.5.10 through 4.9.1, with a fix in 4.9.2. The vulnerability enables remote attackers to inject arbitrary web script through a crafted IMG e...
CVE-2018-9861
Cross-site scripting XSS vulnerability in the Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG...
Another Critical Flaw Found In Drupal Core—Patch Your Sites Immediately
It's time to update your Drupal websites, once again. For the second time within a month, Drupal has been found vulnerable to another critical vulnerability that could allow remote attackers to pull off advanced attacks including cookie theft, keylogging, phishing and identity theft. Discovered b...
Another Critical Flaw Found In Drupal Core—Patch Your Sites Immediately
It's time to update your Drupal websites, once again. For the second time within a month, Drupal has been found vulnerable to another critical vulnerability that could allow remote attackers to pull off advanced attacks including cookie theft, keylogging, phishing and identity theft. Discovered b...
CVE-2018-9861: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG...
Drupal Cross Site Scripting Vulnerability (SA-CORE-2018-003) - Windows
Drupal is prone to a cross-site scripting XSS vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
Drupal Cross Site Scripting Vulnerability (SA-CORE-2018-003) - Linux
Drupal is prone to a cross-site scripting XSS vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
DRUPAL-CORE-2018-003
CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site scripting XSS vulnerability. The vulnerability stemmed from the fact that it was possible to execute XSS inside CKEditor when using the image2 plugin which Drupal 8 core also uses. We would like to thank th...
PT-2018-19082
Name of the Vulnerable Software and Affected Versions CKEditor versions 4.5.10 through 4.9.1 Drupal 8 versions prior to 8.4.7 Drupal 8.5.x versions prior to 8.5.2 Description The issue allows remote attackers to inject arbitrary web script through a crafted IMG element, resulting in a cross-site...
drupal -- Drupal core - Moderately critical
The Drupal security team reports: CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site scripting XSS vulnerability. The vulnerability stemmed from the fact that it was possible to execute XSS inside CKEditor when using the image2 plugin which Drupal 8 core al...
DRUPAL-CONTRIB-2018-014
This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users permissions, which leads to anonymous users being able to upload files to the server...
CKEditor Upload Image - Critical - Access bypass - SA-CONTRIB-2018-014
This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users permissions, which leads to anonymous users being able to upload files to the server...
PT-2018-19477
This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users permissions, which leads to anonymous users being able to upload files to the server...
www2.highlands.edu XSS vulnerability
Open Bug Bounty ID: OBB-549067 Description| Value ---|--- Affected Website:| www2.highlands.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| CKEditor Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
