@weedx/components (0.0.1-beta), acmcoder-ui (>=1.0.2, <=1.0.11) +8 more potentially affected by CVE-2022-23494 via tinymce (>=6.0.0, <=6.2.0)

tinymce NPM version =6.0.0, =1.0.2, =1.0.96, =0.0.19, =1.0.0, =0.70.4, =1.0.6, =0.0.2, =0.0.5 Source cves: CVE-2022-23494 Source advisory: OSV:GHSA-GG8R-XJWQ-4W92...

@agentlab/ldkg-ui-basetable (0.1.1), @agentlab/ldkg-ui-charts (>=0.1.2, <=0.1.7) +132 more potentially affected by CVE-2022-23494 via tinymce (>=5.0.6, <=5.10.5)

tinymce NPM version =5.0.6, =0.1.2, =0.3.7, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.5.2, =10.3.1-snapshot-1616513687673, =1.68.82, =0.65.0, =0.18.0, =0.0.1, =0.0.7 and more Source cves: CVE-2022-23494 Source advisory: GHSA-GG8R-XJWQ-4W92...

@weedx/components (0.0.1-beta), acmcoder-ui (>=1.0.2, <=1.0.11) +8 more potentially affected by CVE-2022-23494 via tinymce (>=6.0.0, <=6.2.0)

tinymce NPM version =6.0.0, =1.0.2, =1.0.96, =0.0.19, =1.0.0, =0.70.4, =1.0.6, =0.0.2, =0.0.5 Source cves: CVE-2022-23494 Source advisory: GHSA-GG8R-XJWQ-4W92...

Cross-site Scripting (XSS)

Overview TinyMCE is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occu...

CVE-2022-23494

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

Cross site scripting

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

CVE-2022-23494

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

UBUNTU-CVE-2022-23494

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

CVE-2022-23494

Summary (CVE-2022-23494): TinyMCE (open source rich text editor) suffers a cross-site scripting (XSS) vulnerability in alert/confirm dialogs when provided with malicious HTML, potentially allowing arbitrary JavaScript execution in the current user’s browser. Affected versions clock to TinyMCE 5.x...

@weedx/components (0.0.1-beta), acmcoder-ui (>=1.0.2, <=1.0.11) +8 more potentially affected by CVE-2022-23494 via tinymce (>=6.0.0, <=6.2.0)

tinymce NPM version =6.0.0, =1.0.2, =1.0.96, =0.0.19, =1.0.0, =0.70.4, =1.0.6, =0.0.2, =0.0.5 Source cves: CVE-2022-23494 Source advisory: MEND:CVE-2022-23494...

CVE-2022-23494

Removed by vendor...

@agentlab/ldkg-ui-basetable (0.1.1), @agentlab/ldkg-ui-charts (>=0.1.2, <=0.1.7) +424 more potentially affected by CVE-2022-23494 via tinymce (>=4.5.1, <=5.10.5)

tinymce NPM version =4.5.1, =0.1.2, =0.3.7, =0.1.7, =1.0.0, =1.0.0, =0.1.6, =0.0.1, =1.0.0-alpha.39-baliz, =4.3.0, =9.0.0-alpha.5, =0.5.0, =0.1.0, =0.0.4, =0.0.7 and more Source cves: CVE-2022-23494 Source advisory: MEND:CVE-2022-23494...

CVE-2022-23494 Cross-site scripting vulnerability in TinyMCE alerts

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

CVE-2022-23494 Cross-site scripting vulnerability in TinyMCE alerts

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

CVE-2022-23494

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the "image" plugin, which...

CVE-2022-23494: Improper Neutralization of Input During Web Page Generation

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

PT-2022-16027

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.10.7 TinyMCE versions prior to 6.3.1 Description A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur ...

CVE-2022-30529: Unrestricted Upload of File with Dangerous Type

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php...

PT-2022-20160 · Tinymce +1 · Tinymce +1

Name of the Vulnerable Software and Affected Versions: asith-eranga ISIC tour booking versions through the version published on Feb 13th 2018 Description: The issue allows attackers to upload arbitrary files via "/system/application/libs/js/tinymce/plugins/filemanager/dialog.php" and...

Laravel-FileManager path traversal vulnerability

laravel-filemanager is a file upload/editor for Laravel 5 through 6 and CKEditor / TinyMCE. A path traversal vulnerability exists in versions of laravel-filemanager prior to 2.5.1, which stems from the fact that it allows reading arbitrary files by traversing directories via special URLs...