CKEditor Upload Image - Critical - Access bypass - SA-CONTRIB-2018-014

This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users permissions, which leads to anonymous users being able to upload files to the server...

www2.highlands.edu XSS vulnerability

Open Bug Bounty ID: OBB-549067 Description| Value ---|--- Affected Website:| www2.highlands.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| CKEditor Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross-Site Scripting (XSS)

openslides is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of strings from CKEditor...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The library does not properly encode the label field in the CKEditor, allowing the malicious user to inject and execute arbitrary javascript through it...

Cross-site Scripting (XSS)

ckeditor-dev is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript via the src attribute in the iframe element. This can only occur when the Iframe plugin is used and advanced content filter is turned off in a browser...

Cross-site Scripting (XSS)

ckeditor-dev is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript via the srcdoc attribute in the iframe element. This attack can only happen with the Iframe plugin and Advanced Content Filter turned off...

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059

This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attack...

CKEditor Detection (HTTP)

HTTP based detection of CKEditor. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.111094";...

CKEditor < 4.4.3 Preview Plugin Unspecified XSS Vulnerability

The preview plugin for CKEditor is prone to an unspecified cross-site scripting XSS vulnerability. Copyright C 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

WordPress CKEditor Plugin <= 4.0 - Arbitrary File Upload

This plugin is prone to an arbitrary file upload exploit vunerability. Solution There is no fix...

WordPress CKEditor Plugin <= 4.0 - Arbitrary File Upload

This plugin is prone to an arbitrary file upload exploit vunerability. Solution There is no fix...

WordPress CKEditor Plugin <= 4.5.3 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress CKEditor Plugin <= 4.5.3 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

CKEditor for WordPress <= 4.5.3 - Authenticated Reflected Cross-Site Scripting (XSS)

The CKEditor for WordPress WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF15 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is 8.0.0.x prior to 8.0.0.1 CF15. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in 'Apache Commons HttpClient' that allows a man-in-the-middle attacker to spoof SSL servers via a certificate with a subject...

Ckeditor 4.4.7 Shell Upload / Cross Site Scripting

----------------------------------------- 0-DAY Aint DIE | No Priv8 | KedAns-Dz ----------------------------------------- ---------------------------- K |................| . h |.......................| A a |.......................| N l |.....................| S E |.......................| e D...

SuperWebMailer 5.50.0.01160 Cross Site Scripting

SuperWebMailer 5.50.0.01160 XSS Cross-site Scripting Security Vulnerabilities Exploit Title: SuperWebMailer /defaultnewsletter.php" HTMLForm Parameter XSS Security Vulnerabilities Product: SuperWebMailer Vendor: SuperWebMailer Vulnerable Versions: 5..0. 4..0. Tested Version: 5..0. 4..0. Advisory...

Cross-Site Scripting (XSS)

CKEditor is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

Fedora 20 : drupal7-ckeditor-1.16-2.fc20 (2014-14674)

7.x-1.16 - SA-CONTRIB-2014-098 - CKEditor - Cross Site Scripting XSS Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora Update for drupal7-ckeditor FEDORA-2014-14699

Check the version of drupal7-ckeditor SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868496";...