CVE-2022-31175 Cross-site scripting caused by the editor instance destroying process in ckeditor5

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

CVE-2022-31175

CKEditor 5 prior to 35.0.1 contains an XSS flaw in three optional packages: @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, and @ckeditor/ckeditor5-html-embed. The vulnerability arises from a mechanism that updates the source element with markup from the data pipeline after de...

WordPress Rich Reviews by Starfish plugin <= 1.9.14 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to review deletion discovered by Ngo Van Thien Patchstack Alliance in WordPress Rich Reviews by Starfish plugin versions = 1.9.14. Solution No patched version available...

Rich Reviews <= 1.9.15 - Arbitrary Reviews Deletion via CSRF

The plugin does not have CSRF in place when deleting reviews, w which could allow attackers to make a logged in admin delete them via a CSRF attack...

[SECURITY] Fedora 36 Update: golang-github-hashicorp-memdb-1.3.0-6.fc36

The Memdb package implements a simple in-memory database built on immutable radix trees. The database provides Atomicity, Consistency and Isolation from ACID. Being that it is in-memory, it does not provide durability. The database is instantiated with a schema that specifies the tables and indic...

Fedora: Security Advisory for golang-github-hashicorp-memdb (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-github-hashicorp-memdb-1.3.0-5.fc35

The Memdb package implements a simple in-memory database built on immutable radix trees. The database provides Atomicity, Consistency and Isolation from ACID. Being that it is in-memory, it does not provide durability. The database is instantiated with a schema that specifies the tables and indic...

[SECURITY] Fedora 36 Update: golang-github-hashicorp-memdb-1.3.0-5.fc36

The Memdb package implements a simple in-memory database built on immutable radix trees. The database provides Atomicity, Consistency and Isolation from ACID. Being that it is in-memory, it does not provide durability. The database is instantiated with a schema that specifies the tables and indic...

GHSA-2V6R-JF2G-J5Q5 Cross-site Scripting in Jenkins Rich Text Publisher Plugin

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

Cross-site Scripting in Jenkins Rich Text Publisher Plugin

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2022-34786

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2022-34786

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2022-34786

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

Cross site scripting

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2022-34786

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2022-34786

CVE-2022-34786 affects Jenkins Rich Text Publisher Plugin (versions 1.4 and earlier). The issue is that the plugin does not escape the HTML in the message set by its post-build step, causing stored cross-site scripting (XSS) when an attacker can configure jobs. The Red Hat and other connected doc...

PT-2022-22337 · Jenkins · Jenkins Rich Text Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Rich Text Publisher Plugin versions 1.4 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the HTML message set by the post-build step is not escaped, allowing attackers...

Jenkins Plugin Rich Text Publisher 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The vulnerability stems from not escaping HTML messages set by its post-build...

Malicious code in dtv-rich-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 811bde282f3e7423ea7566e09f3e9f90748e2c254489e834e3c618ebbe9d8942 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2601 Malicious code in dtv-rich-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 811bde282f3e7423ea7566e09f3e9f90748e2c254489e834e3c618ebbe9d8942 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...