3h1-ui (>=2.14.41, <=3.0.0-next.266), @abt-desk/apm (>=0.0.1, <=0.33.12) +1882 more potentially affected by CVE-2024-38356 via tinymce (>=5.0.6, <=5.10.9)

tinymce NPM version =5.0.6, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.7, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =0.1.11 and more Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

hazard-feed (>=0.2.0, <=0.2.5) potentially affected by CVE-2024-38356 via django-tinymce (3.2.0)

django-tinymce PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.2.0, =0.2.5 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

geonode (3.3.3) potentially affected by CVE-2024-38356 via django-tinymce (3.3.0)

django-tinymce PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode 3.3.3 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

bpp-iplweb (>=202304.1100.0, <=202504.1174.0), django-user-notification (>=0.8.0, <=0.10.2) +2 more potentially affected by CVE-2024-38356 via django-tinymce (3.7.1)

django-tinymce PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - bpp-iplweb =202304.1100.0, =0.8.0, =4.3.0, =0.64.0, =0.93.1 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

geonode (>=4.0.0rc0, <=4.0.0.post1) potentially affected by CVE-2024-38356 via django-tinymce (3.4.0)

django-tinymce PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode =4.0.0rc0, =4.0.0.post1 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

django-starter-toolkit (0.1.0), geonode (>=4.0.1, <=4.0.3) potentially affected by CVE-2024-38356 via django-tinymce (3.5.0)

django-tinymce PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - django-starter-toolkit 0.1.0 - geonode =4.0.1, =4.0.3 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

hazard-feed (>=0.1.3.2, <=0.1.6.1) potentially affected by CVE-2024-38356 via django-tinymce (2.8.0)

django-tinymce PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.1.3.2, =0.1.6.1 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

django-saas-email (>=0.1.21, <=0.1.29) potentially affected by CVE-2024-38356 via django-tinymce (2.7.0)

django-tinymce PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - django-saas-email =0.1.21, =0.1.29 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

geonode (>=4.1.0, <=4.2.5), grooveshop-django-api (>=0.6.0, <=0.63.0) +1 more potentially affected by CVE-2024-38356 via django-tinymce (3.6.1)

django-tinymce PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode =4.1.0, =0.6.0, =0.63.0 - repomaker 1.0.0b1 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

grooveshop-django-api (>=0.94.0, <=0.127.0) potentially affected by CVE-2024-38356 via django-tinymce (4.0.0)

django-tinymce PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - grooveshop-django-api =0.94.0, =0.127.0 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

Cross-site Scripting (XSS)

Overview TinyMCE is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS when using the noneditableregexp option on an element whose content does not match the regex. An attacker can inject malicious scripts into HTML...

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. Patches This vulnerability...

tinyblog (0.3.0) potentially affected by CVE-2024-38356 via django-tinymce (1.5.1b4)

django-tinymce PYPI version 1.5.1b4 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - tinyblog 0.3.0 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

geonode (>=4.1.0, <=4.2.5), grooveshop-django-api (>=0.6.0, <=0.63.0) +1 more potentially affected by CVE-2024-38357 via django-tinymce (3.6.1)

django-tinymce PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode =4.1.0, =0.6.0, =0.63.0 - repomaker 1.0.0b1 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

zinnia-wysiwyg-tinymce (1.4.0) potentially affected by CVE-2024-38357 via django-tinymce (2.2.0)

django-tinymce PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - zinnia-wysiwyg-tinymce 1.4.0 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

grooveshop-django-api (>=0.94.0, <=0.127.0) potentially affected by CVE-2024-38357 via django-tinymce (4.0.0)

django-tinymce PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - grooveshop-django-api =0.94.0, =0.127.0 Source cves: CVE-2024-38357 Source advisory: GHSA-W9JX-4G6G-RP7X...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +1 more potentially affected by CVE-2024-38357 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

grooveshop-django-api (>=0.94.0, <=0.127.0) potentially affected by CVE-2024-38357 via django-tinymce (4.0.0)

django-tinymce PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - grooveshop-django-api =0.94.0, =0.127.0 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

repomaker (1.0.0b3) potentially affected by CVE-2024-38357 via django-tinymce (2.9.0)

django-tinymce PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - repomaker 1.0.0b3 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

GHSA-W9JX-4G6G-RP7X TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. Patches This vulnerability has been patched in TinyMCE 7.2.0,...