MAL-2024-2281 Malicious code in editor-languages (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in editor-languages (npm)

--- -= Per source details. Do not edit below this line.=-...

LISP/OL.EL Emacs Code Execution

The vulnerability of the Org-Link-Expand-ABBREV function in the LISP/OL.EL text editor EMACS exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by...

June 25, 2024—KB5039299 (OS Build 19045.4598) Preview

None None...

SUSE CVE-2024-34341

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker ...

CVE-2024-4874

The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2023-38506

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

CVE-2023-38506 Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

CVE-2023-38506

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the "onload"...

Adobe Creative Cloud Desktop Application Graphic Editor Uncontrolled Search Path

The vulnerability of the Adobe Creative Cloud Desktop Application’s graphic editor app relates to an uncontrolled search path element. Exploiting this vulnerability allows a hacker to bypass existing security restrictions and execute arbitrary code in the context of the current user, using a...

Joplin Security Vulnerabilities

Joplin is an open source notes and to-do list application. A security vulnerability exists in Joplin versions prior to 2.12.10 that stems from the presence of a cross-site scripting XSS vulnerability that allows untrusted data to be pasted into a text editor to execute arbitrary code...

PT-2024-12733 · Tinymce +2 · Tinymce +2

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 2.12.10 Description: A Cross-site Scripting XSS issue in Joplin allows the execution of arbitrary code when pasting untrusted data into the rich text editor. This occurs because HTML pasted into the editor is not...

CVE-2023-38506: Improper Neutralization of Input During Web Page Generation

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

CVE-2024-38357

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

CVE-2024-38357

Removed by vendor...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +1 more potentially affected by CVE-2024-38356 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38356 Source advisory: MEND:CVE-2024-38356...

CVE-2024-38356

Removed by vendor...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +1 more potentially affected by CVE-2024-38356 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38356 Source advisory: GHSA-9HCV-J9PV-QMPH...

@arkxio/ark-ui (>=0.1.0, <=0.1.23), @arkxio/ark-ui-src (0.1.0) +39 more potentially affected by CVE-2024-38356 via tinymce (>=6.0.0, <=6.8.3)

tinymce NPM version =6.0.0, =0.1.0, =0.1.19, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +1 more potentially affected by CVE-2024-38356 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...