1301 matches found
CVE-2021-40100
An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...
Cross site scripting
An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...
CVE-2021-40100
An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...
CVE-2021-40100
An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...
CVE-2021-40100
Concrete CMS (8.5.5 and earlier) is affected by a stored XSS in the Conversations module when the Active Conversation Editor is set to Rich Text. The issue arises in the Conversations UI where user-provided content can be stored and later executed in other users’ context. Affected component/file:...
PortlandLabs Concrete Cms 跨站脚本漏洞
Concrete CMS is an open source content management system for teams.A stored cross-site scripting vulnerability exists in Conversations in Concrete CMS 8.5.5 and earlier versions when the "Active Conversation Editor" is set to rich text. An attacker could exploit this vulnerability to insert...
The vulnerability of the WYSIWYG Editor module of the Dolibarr resource planning and customer relationship management system allows a hacker to gain access to the administrator account.
The vulnerability of the WYSIWYG Editor module in the Dolibarr system for resource planning and managing customer relationships exists due to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to remotely gain control of the administrat...
DRUPAL-CONTRIB-2021-041
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view. The vulnerability is mitigated by the fact that it can on...
DRUPAL-CONTRIB-2021-040
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not use CSRF tokens to protect routes for saving menu configurations. This vulnerability can be exploited by an anonymous user...
DRUPAL-CONTRIB-2021-039
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting XSS vulnerabilities...
The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view. The vulnerability is mitigated by the fact that it can on...
The Better Mega Menu - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-039
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting XSS vulnerabilities...
The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-en...
GPAC Memory Leak Vulnerability (CNVD-2021-79761)
GPAC is a multimedia framework for rich media and is distributed under the LGPL license. a memory leak vulnerability exists in the afraboxread function in MP4Box in GPAC version 1.0.1. An attacker could exploit the vulnerability to read memory via specially crafted files...
GPAC null pointer dereference vulnerability (CNVD-2021-79756)
GPAC is a multimedia framework for rich media and is distributed under the LGPL license. a null pointer dereference vulnerability exists in the trakboxsize function in GPAC version 1.0.1. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted file in the...
ferris-rich-input (=0.0.1) potentially affected by CVE-2021-37695 via ckeditor4 (=4.14.0)
ckeditor4 NPM version =4.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on ckeditor4 and may be impacted: - ferris-rich-input =0.0.1 Source cves: CVE-2021-37695 Source advisory: OSV:GHSA-M94C-37G6-CJHC...
ferris-rich-input (=0.0.1) potentially affected by CVE-2021-32808 via ckeditor4 (=4.14.0)
ckeditor4 NPM version =4.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on ckeditor4 and may be impacted: - ferris-rich-input =0.0.1 Source cves: CVE-2021-32808 Source advisory: OSV:GHSA-6226-H7FF-CH6C...
GHSA-C5C9-8C6M-727V Cross-Site Scripting via Rich-Text Content
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC 5.7 Problem Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via...
Cross-Site Scripting via Rich-Text Content
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC 5.7 Problem Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via...
