Malicious code in editor-languages (npm)

--- -= Per source details. Do not edit below this line.=-...

June 25, 2024—KB5039299 (OS Build 19045.4598) Preview

None None...

The vulnerability of the Org-Link-Expand-ABBREV function in the LISP/OL.EL text editor EMACS allows a hacker to execute arbitrary code.

The vulnerability of the Org-Link-Expand-ABBREV function in the LISP/OL.EL text editor EMACS exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by...

SUSE CVE-2024-34341

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker ...

CVE-2024-4874

The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2023-38506

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

CVE-2023-38506 Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

Joplin Security Vulnerabilities

Joplin is an open source notes and to-do list application. A security vulnerability exists in Joplin versions prior to 2.12.10 that stems from the presence of a cross-site scripting XSS vulnerability that allows untrusted data to be pasted into a text editor to execute arbitrary code...

The vulnerability of the Adobe Creative Cloud Desktop Application’s graphic editor app relates to an uncontrolled search path element, allowing attackers to bypass existing security restrictions and execute arbitrary code.

The vulnerability of the Adobe Creative Cloud Desktop Application’s graphic editor app relates to an uncontrolled search path element. Exploiting this vulnerability allows a hacker to bypass existing security restrictions and execute arbitrary code in the context of the current user, using a...

PT-2024-12733 · Tinymce +2 · Tinymce +2

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 2.12.10 Description: A Cross-site Scripting XSS issue in Joplin allows the execution of arbitrary code when pasting untrusted data into the rich text editor. This occurs because HTML pasted into the editor is not...

CVE-2024-38357

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

CVE-2024-38357

Removed by vendor...

CVE-2024-38356

Removed by vendor...

@arkxio/ark-ui (>=0.1.0, <=0.1.23), @arkxio/ark-ui-src (0.1.0) +39 more potentially affected by CVE-2024-38356 via tinymce (>=6.0.0, <=6.8.3)

tinymce NPM version =6.0.0, =0.1.0, =0.1.19, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.0) +1 more potentially affected by CVE-2024-38356 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.0) +1 more potentially affected by CVE-2024-38357 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

Tiny Technologies TinyMCE Security Vulnerability

Tiny Technologies TinyMCE is a rich text editor from Tiny Technologies, USA. A security vulnerability exists in Tiny Technologies TinyMCE that stems from the presence of a cross-site scripting XSS vulnerability that allows execution of malicious code when loading content into the editor...

CVE-2024-4094

The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-5541

The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtanavisualeditorregisterajaxjsonendpont' function in all versions up to, and including, 1.2.3.3. This makes it possible for unauthenticated...

PT-2024-36514 · WordPress · Ibtana

Name of the Vulnerable Software and Affected Versions: Ibtana – WordPress Website Builder plugin versions up to, and including, 1.2.3.3 Description: The issue allows unauthorized modification of data due to a missing capability check on the ibtana visual editor register ajax json endpont function...