CVE-2012-2067

The CVE-2012-2067 entry covers Drupal CKEditor/FCKeditor modules (CKEditor 6.x-1.x before 6.x-1.9; CKEditor 7.x-1.x before 7.x-1.7; FCKeditor 6.x-2.x before 6.x-2.3) when the core PHP module is enabled. The root cause is an improper handling in the text filter parameter that allows remote authent...

SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution

CKEditor and its predecessor FCKeditor allow Drupal to replace textarea fields with the FCKEditor - a visual HTML WYSIWYG editor. The modules have an AJAX callback that filters text to prevent Cross site scripting attacks on content edits. This AJAX callback function contains a number of bugs whi...