PT-2021-4425 · Microsoft · Windows Rich Text Edit Control +2

Name of the Vulnerable Software and Affected Versions: Windows Rich Text Edit Control affected versions not specified Description: The issue is related to an information disclosure vulnerability in the Rich Text Edit Control of the Windows operating system. This vulnerability can be exploited by ...

The vulnerability of CKEditor’s WYSIWYG editor, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise data integrity.

The vulnerability of the CKEditor WYSIWYG editor is related to the incorrect processing of the “--!” comment. Exploiting this vulnerability may allow an attacker to compromise the integrity of the data...

Concrete CMS Cross-Site Scripting Vulnerability

Concrete CMS is an open source content management system for teams.A stored cross-site scripting vulnerability exists in Conversations in Concrete CMS 8.5.5 and earlier versions when the "Active Conversation Editor" is set to rich text. An attacker could exploit this vulnerability to insert...

CVE-2021-40100

An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...

CVE-2021-40100

An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...

Cross site scripting

An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...

CVE-2021-40100

An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...

CVE-2021-40100

An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text...

CVE-2021-40100

Concrete CMS (8.5.5 and earlier) is affected by a stored XSS in the Conversations module when the Active Conversation Editor is set to Rich Text. The issue arises in the Conversations UI where user-provided content can be stored and later executed in other users’ context. Affected component/file:...

PortlandLabs Concrete Cms 跨站脚本漏洞

Concrete CMS is an open source content management system for teams.A stored cross-site scripting vulnerability exists in Conversations in Concrete CMS 8.5.5 and earlier versions when the "Active Conversation Editor" is set to rich text. An attacker could exploit this vulnerability to insert...

The vulnerability of the WYSIWYG Editor module of the Dolibarr resource planning and customer relationship management system allows a hacker to gain access to the administrator account.

The vulnerability of the WYSIWYG Editor module in the Dolibarr system for resource planning and managing customer relationships exists due to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to remotely gain control of the administrat...

DRUPAL-CONTRIB-2021-041

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view. The vulnerability is mitigated by the fact that it can on...

DRUPAL-CONTRIB-2021-040

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not use CSRF tokens to protect routes for saving menu configurations. This vulnerability can be exploited by an anonymous user...

DRUPAL-CONTRIB-2021-039

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting XSS vulnerabilities...

The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-en...

The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view. The vulnerability is mitigated by the fact that it can on...

The Better Mega Menu - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-039

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting XSS vulnerabilities...

GPAC null pointer dereference vulnerability (CNVD-2021-79756)

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. a null pointer dereference vulnerability exists in the trakboxsize function in GPAC version 1.0.1. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted file in the...

GPAC Memory Leak Vulnerability (CNVD-2021-79761)

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. a memory leak vulnerability exists in the afraboxread function in MP4Box in GPAC version 1.0.1. An attacker could exploit the vulnerability to read memory via specially crafted files...

ferris-rich-input (0.0.1) potentially affected by CVE-2021-37695 via ckeditor4 (4.14.0)

ckeditor4 NPM version 4.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on ckeditor4 and may be impacted: - ferris-rich-input 0.0.1 Source cves: CVE-2021-37695 Source advisory: OSV:GHSA-M94C-37G6-CJHC...