CVE-2023-38506 Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

CVE-2023-38506

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the "onload"...

CVE-2023-38506

Summary of CVE-2023-38506 (Joplin) : A Cross-site Scripting (XSS) vulnerability arises when pasting untrusted HTML into Joplin’s rich text editor. HTML pasted into the editor is not properly sanitized, allowing the onload attribute of pasted images to execute arbitrary code. Because the TinyMCE e...

CVE-2023-38506: Improper Neutralization of Input During Web Page Generation

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

Cross-Site Scripting (XSS)

TinyMCE is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to unsafe parsing of noscript elements, which allows an attacker to execute malicious code when the content is loaded into the editor...

Cross-Site Scripting (XSS)

TinyMCE is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the content extraction feature, specifically when using the noneditableregexp option, which allows an attacker to execute malicious code through specially crafted HTML attributes during content extraction...

CVE-2024-38357

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

CVE-2024-38356

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from t...

CVE-2024-38357

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

UBUNTU-CVE-2024-38357

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

CVE-2024-38356

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from t...

UBUNTU-CVE-2024-38356

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from t...

@arkxio/ark-ui (>=0.1.0, <=0.1.23), @arkxio/ark-ui-src (0.1.0) +39 more potentially affected by CVE-2024-38357 via tinymce (>=6.0.0, <=6.8.3)

tinymce NPM version =6.0.0, =0.1.0, =0.1.19, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2024-38357 Source advisory: MEND:CVE-2024-38357...

bpp-iplweb (>=202304.1100.0, <=202504.1174.0), django-saas-email (>=0.1.21, <=0.1.29) +8 more potentially affected by CVE-2024-38357 via django-tinymce (>=1.5.1b4, <=4.0.0)

django-tinymce PYPI version =1.5.1b4, =202304.1100.0, =0.1.21, =0.8.0, =3.3.3, =0.6.0, =0.1.3.2, =1.0.0b1, =0.3.0, =0.5.2 - zinnia-wysiwyg-tinymce 1.4.0 Source cves: CVE-2024-38357 Source advisory: MEND:CVE-2024-38357...

CVE-2024-38357

Removed by vendor...

CVE-2024-38357

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

CVE-2024-38357 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

CVE-2024-38357 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +1 more potentially affected by CVE-2024-38357 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38357 Source advisory: MEND:CVE-2024-38357...

CVE-2024-38357 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...