CKEditor 4.0 < 4.16.1 XSS Vulnerability - Windows

CKEditor is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

DEBIAN-CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

Cross site scripting

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

UBUNTU-CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

CVE-2021-33829

CKEditor 4.x contains a cross-site scripting vulnerability in the HTML Data Processor (affected versions: 4.14.0–4.16.x prior to 4.16.1) where a crafted comment can cause execution of injected JavaScript due to mishandling of --!&gt;. The issue enables remote XSS and is fixed in CKEditor 4.16.1 (...

CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

CKEditor 跨站脚本漏洞

CKEditor is an open source, web-based text editor. CKEditor suffers from a cross-site scripting vulnerability that stems from improper handling of input data in the HTML data processor. A remote attacker can inject executable JavaScript code via a crafted comment. The following products and model...

PT-2021-4279

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions 4.14.0 through 4.16.x Description A cross-site scripting XSS vulnerability in the HTML Data Processor allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled. This...

CKEditor Resource Management Error Vulnerability (CNVD-2021-39674)

CKEditor is an open source, web-based text editor. CKEditor 5 suffers from a resource management error vulnerability that stems from a regular expression denial of service ReDoS vulnerability. The vulnerability allows misuse of a specific regular expression, which could result in a significant...

Drupal 9.0.x < 9.0.14 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.16, 9.0.x prior to 9.0.14 or 9.1.x prior to 9.1.9. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. Drupal uses the third-party library CKEditor which is...

Drupal 8.9.x < 8.9.16 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.16, 9.0.x prior to 9.0.14 or 9.1.x prior to 9.1.9. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. Drupal uses the third-party library CKEditor which is...

Drupal 9.1.x < 9.1.9 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.16, 9.0.x prior to 9.0.14 or 9.1.x prior to 9.1.9. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. Drupal uses the third-party library CKEditor which is...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal. The vulnerability is located in CKEditor and can be exploited by a malicious person abused to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application visited...

Drupal 8.9.x < 8.9.16 / 9.x < 9.0.14 / 9.1.x < 9.1.9 Drupal Vulnerability (SA-CORE-2021-003)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.16, 9.x prior to 9.0.14, or 9.1.x prior to 9.1.9. It is, therefore, affected by a vulnerability. - Drupal core uses the third-party CKEditor library. This library has an error in...

DRUPAL-CORE-2021-003

Update: 2021-06-11: Added CVE-2021-33829 identifier Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to an XSS attack. CKEditor 4.16.1 and later include the fix. Update: 2021-06-11: More details are available on CKEditor's blog. Users of...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2021-003

Update: 2021-06-11: Added CVE-2021-33829 identifier Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to an XSS attack. CKEditor 4.16.1 and later include the fix. Update: 2021-06-11: More details are available on CKEditor's blog. Users of...

Cross-site Scripting (XSS) - Stored in changeweb/unifiedtransform

✍️ Description Stored Cross Site Scripting in the message/all.blade.php. 🕵️‍♂️ Proof of Concept As a teacher, click on "My Courses" and then "message students". CKEditor hides the underlying where we can add tag or capture the request in a proxy like burpsuite and edit the HTTP POST request. Select...