120 matches found
GHSA-HVCF-6324-CJH7 Persistent Cross-site Scripting in Ibexa RichText Field Type
Impact The validator for the RichText fieldtype blocklists javascript: and vbscript: in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which...
PT-2024-30532
Name of the Vulnerable Software and Affected Versions Ibexa RichText Field Type versions prior to 4.6.10 Description The validator for the RichText fieldtype blocklists javascript: and vbscript: in links to prevent XSS, but this can be circumvented using upper case, leaving other options open...
PT-2024-30536
Name of the Vulnerable Software and Affected Versions ezplatform-richtext versions prior to the patched version fieldtype-richtext versions prior to the patched version Description The validator for the RichText fieldtype blocklists javascript: and vbscript: in links to prevent XSS, but this chec...
Malware in kami-richtext
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in kami-richtext (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9634fe3bee06c80f43ca27ad558c4834386dc1bb31779583c7911b679f550bff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1662 Malicious code in kami-richtext (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9634fe3bee06c80f43ca27ad558c4834386dc1bb31779583c7911b679f550bff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Reddit: RichText parser vulnerability in scheduled posts allows XSS
Hyperlinks were not being filtered on the server-side in Reddit's scheduled post feature, allowing an attacker to modify a request with a normal hyperlink that embeds a malicious link using a javascript scheme. This could result in an XSS attack if an admin clicked on the malicious link while...
SUSE CVE-2007-1282
Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line...
SUSE CVE-2010-4071
Cross-site scripting XSS vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail...
Malicious code in @bf-ui-library/richtext (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6f8eca6486a986ffa6a1485a09fcd040b4b868cf477e36a31ffaf282abbe266 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-118 Malicious code in @bf-ui-library/richtext (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6f8eca6486a986ffa6a1485a09fcd040b4b868cf477e36a31ffaf282abbe266 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
DEBIAN-CVE-2022-21690
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all componen...
CVE-2022-21690
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all componen...
Cross-Site Scripting (XSS)
ezsystems/ezplatform-richtext is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in custom tags allowing an attacker to inject and execute malicious javascript...
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...
GHSA-9JP8-CWWX-P64Q XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...
GHSA-FXWM-RX68-P5VX XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...
