Shopify: Stored XSS in /admin/product and /admin/collections

Hello Security Team, I was going through previous reports of XSS and I have found this, https://hackerone.com/reports/978125 As stated by team on this page even on https://hackerone.com/shopify?type=team under Known issues that we can now report XSS under Rich Text Editor on Product description a...

The vulnerability of CodeMirror’s text editor, related to a bug in the resource consumption monitoring mechanism, allows attackers to trigger a service failure.

The vulnerability of CodeMirror’s text editor is related to a bug in the resource management mechanism. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2020-14988

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...

CVE-2020-14988

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...

The vulnerability in the regex.c component of the text editor ed, which allows a hacker to trigger a service failure.

The vulnerability of the regex.c component in the text editor ed is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2021-21254

CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin @ckeditor/ckeditor5-markdown-gfm before version 25.0.0 has a regex denial of service ReDoS vulnerability. The vulnerability allowed to abuse link recognition regular expression, whi...

Binary vulnerability exists in VIM (CNVD-2021-12709)

VIM is a text editor developed from vi. VIM has a binary vulnerability that can be exploited by attackers to cause a denial of service...

Binary vulnerability exists in VIM (CNVD-2021-12708)

VIM is a text editor developed from vi. VIM has a binary vulnerability that can be exploited by attackers to cause a denial of service...

Binary vulnerability exists in VIM (CNVD-2021-12705)

VIM is a text editor developed from vi. VIM has a binary vulnerability that can be exploited by attackers to cause a denial of service...

Vim has a binary vulnerability (CNVD-2021-12723)

Vim is a text editor developed from vi. A binary vulnerability exists in Vim. An attacker could exploit this vulnerability to cause the program to crash...

Vim has a binary vulnerability (CNVD-2021-12722)

Vim is a text editor developed from vi. A binary vulnerability exists in Vim. An attacker could exploit this vulnerability to cause the program to crash...

Vim has a binary vulnerability (CNVD-2021-12721)

Vim is a text editor developed from vi. A binary vulnerability exists in Vim. An attacker could exploit this vulnerability to cause the program to crash...

Debian: Security Advisory (DSA-4789-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the WYSIWYG editor Ckeditor arises from insufficient validation of input data, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the WYSIWYG editor Ckeditor exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to carry out cross-site scripting attacks by sending specially crafted comments...

Cross-site Scripting (XSS)

firefox is vulnerable to cross-site scripting XSS. The vulnerability exists when pasting a tag from the clipboard into a rich text editor, and the CSS sanitizer does not escape characters, and when a webpage subsequently copies the node's innerHTML, and assigns it to another innerHTML...

Injection Attacks

thunderbird is vulnerable to injection attacks. The vulnerability exists as the CSS sanitizer incorrectly rewrites a @namespace rule when pasting a tag from the clipboard into a rich text editor...

@ambers/helios (>=0.10.0 <=0.13.5), @cloudmosaic/quickstarts (>=1.0.0-rc.0 <=1.0.0-rc.1) +180 more potentially affected by unknown CVE via showdown (>=0.0.1 <=1.9.0)

showdown NPM version =0.0.1, =0.10.0, =1.0.0-rc.0, =1.0.0, =1.0.0-alpha.1, =2.0.0, =0.4.0, =1.6.3, =5.2.1, =0.0.11, =0.0.9, =0.0.2, =1.0.0, =1.0.1, =2.4.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H6MQ-3CJ6-H738...

Fedora 32 : roundcubemail (2020-d0f8f20cfc)

RELEASE 1.4.8 - Security: Fix potential XSS issue in HTML editor of the identity signature input 7507 - Managesieve: Fix too-small input field in Elastic when using custom headers 7498 - Fix support for an error as a string in messagebeforesend hook 7475 - Elastic: Fix redundant scrollbar in plai...

High-Severity TinyMCE Cross-Site Scripting Flaw Fixed

A high-severity flaw has been disclosed in TinyMCE, an open-source text editor used in the content management systems CMS of websites. The recently patched flaw could have been potentially exploited remotely by attackers to gain administrative privileges to websites. TinyMCE, developed by Tiny...

The vulnerability of the Rich Text Editor component in the Oracle PeopleSoft Enterprise PeopleTools business application package allows a perpetrator to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the Rich Text Editor component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected information or to modify...