@arkxio/ark-ui (>=0.1.0, <=0.1.23), @arkxio/ark-ui-src (0.1.0) +39 more potentially affected by CVE-2024-38357 via tinymce (>=6.0.0, <=6.8.3)

tinymce NPM version =6.0.0, =0.1.0, =0.1.19, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

3h1-ui (>=2.14.41, <=3.0.0-next.266), @abt-desk/apm (>=0.0.1, <=0.33.12) +1882 more potentially affected by CVE-2024-38357 via tinymce (>=5.0.6, <=5.10.9)

tinymce NPM version =5.0.6, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.7, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =0.1.11 and more Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +1 more potentially affected by CVE-2024-38357 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38357 Source advisory: GHSA-W9JX-4G6G-RP7X...

@arkxio/ark-ui (>=0.1.0, <=0.1.23), @arkxio/ark-ui-src (0.1.0) +39 more potentially affected by CVE-2024-38357 via tinymce (>=6.0.0, <=6.8.3)

tinymce NPM version =6.0.0, =0.1.0, =0.1.19, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2024-38357 Source advisory: GHSA-W9JX-4G6G-RP7X...

hazard-feed (>=0.2.0, <=0.2.5) potentially affected by CVE-2024-38357 via django-tinymce (3.2.0)

django-tinymce PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.2.0, =0.2.5 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

3h1-ui (>=2.14.41, <=3.0.0-next.266), @abt-desk/apm (>=0.0.1, <=0.33.12) +1882 more potentially affected by CVE-2024-38357 via tinymce (>=5.0.6, <=5.10.9)

tinymce NPM version =5.0.6, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.7, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =0.1.11 and more Source cves: CVE-2024-38357 Source advisory: GHSA-W9JX-4G6G-RP7X...

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. Patches This vulnerability has been patched in TinyMCE 7.2.0,...

geonode (>=4.0.0rc0, <=4.0.0.post1) potentially affected by CVE-2024-38357 via django-tinymce (3.4.0)

django-tinymce PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode =4.0.0rc0, =4.0.0.post1 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

tinyblog (0.3.0) potentially affected by CVE-2024-38357 via django-tinymce (1.5.1b4)

django-tinymce PYPI version 1.5.1b4 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - tinyblog 0.3.0 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

tinyblog (>=0.4.0, <=0.5.2) potentially affected by CVE-2024-38357 via django-tinymce (1.5.3)

django-tinymce PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - tinyblog =0.4.0, =0.5.2 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

Cross-site Scripting (XSS)

Overview TinyMCE is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS when parsing noscript elements in the editor. An attacker can bypass sanitization by placing malicious code in noscript elements. Details Cross-site...

django-starter-toolkit (0.1.0), geonode (>=4.0.1, <=4.0.3) potentially affected by CVE-2024-38357 via django-tinymce (3.5.0)

django-tinymce PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - django-starter-toolkit 0.1.0 - geonode =4.0.1, =4.0.3 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

bpp-iplweb (>=202304.1100.0, <=202504.1174.0), django-user-notification (>=0.8.0, <=0.10.2) +2 more potentially affected by CVE-2024-38357 via django-tinymce (3.7.1)

django-tinymce PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - bpp-iplweb =202304.1100.0, =0.8.0, =4.3.0, =0.64.0, =0.93.1 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

hazard-feed (>=0.1.3.2, <=0.1.6.1) potentially affected by CVE-2024-38357 via django-tinymce (2.8.0)

django-tinymce PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.1.3.2, =0.1.6.1 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

geonode (3.3.3) potentially affected by CVE-2024-38357 via django-tinymce (3.3.0)

django-tinymce PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode 3.3.3 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

django-saas-email (>=0.1.21, <=0.1.29) potentially affected by CVE-2024-38357 via django-tinymce (2.7.0)

django-tinymce PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - django-saas-email =0.1.21, =0.1.29 Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

CVE-2024-38357: Improper Neutralization of Input During Web Page Generation

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has bee...

CVE-2024-38356: Improper Neutralization of Input During Web Page Generation

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from t...

Tiny Technologies TinyMCE Security Vulnerability

Tiny Technologies TinyMCE is a rich text editor from Tiny Technologies, USA. A security vulnerability exists in Tiny Technologies TinyMCE that stems from the presence of a cross-site scripting XSS vulnerability that allows execution of malicious code when loading content into the editor...

PT-2024-7087

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.11.0 LTS TinyMCE versions prior to 6.8.4 TinyMCE versions prior to 7.2.0 Description A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript...