WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51417 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b7c089e25bbe Credits Rafie Muhammad Patchstack Required...

CVE-2023-48219 Special characters in unescaped text nodes can trigger mXSS in TinyMCE

TinyMCE is an open source rich text editor. A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text...

CVE-2023-48219

Summary of CVE-2023-48219 (TinyMCE): A mutation XSS (mXSS) flaw in TinyMCE’s core undo/redo and related APIs/plugins arises from text nodes in certain parents not being escaped during serialization per HTML standards. If a text node contains a special internal marker, it can combine with other HT...

CVE-2023-46858

Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...

The vulnerability of the FileUploadProcessor.stripFileName(String name) method in the Eclipse Rich Client Platform (RCP) plugin allows a attacker to execute arbitrary code.

The vulnerability of the FileUploadProcessor.stripFileNameString name method in the Eclipse Rich Client Platform plugin suite is related to deficiencies in pathname restrictions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

CVE-2023-45818

TinyMCE is an open source rich text editor. A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before...

WordPress Events Rich Snippets for Google Plugin <= 1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Events Rich Snippets for Google Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44478 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID cd6a8e204b56 Credits Mika...

Cross Site Scripting

xdsoft.net is vulnerable to Cross Site Scripting vulnerability. The vulnerability is due to improper sanitization of user input in the rich text editor component. This can be exploited by the attacker by injecting malicious input to execute Javascript on client side...

Jodit Editor vulnerable to cross-site scripting

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component...

GHSA-95XR-CQ6H-VWR3 Jodit Editor vulnerable to cross-site scripting

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component...

CVE-2023-42399

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component...

CVE-2023-42399

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component...

CVE-2023-42399

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component...

CVE-2023-42371

Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script to the insert link function in the editor component...

CVE-2023-42371

CVE-2023-42371 maps to a Cross-Site Scripting vulnerability in Summernote Rich Text Editor up to v0.8.18. Reported weakness allows a remote attacker to execute arbitrary code via a crafted script inserted through the editor’s insert link function. The issue is described consistently across multip...

CVE-2023-42371

Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script to the insert link function in the editor component...

CVE-2023-42371

Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script to the insert link function in the editor component...

[SECURITY] Fedora 39 Update: rubygem-actiontext-7.0.7.2-1.fc39

Edit and display rich text in Rails applications...

CVE-2023-41167

@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the...

CVE-2023-41167

@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the...