@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.1.9) +56 more potentially affected by unknown CVE via tinymce (>=5.0.6, <=5.5.1)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.18.0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =0.17.0, =0.1.0, =0.0.1, =0.0.4 - @yanghp/amis 1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H96F-FC7C-9R55...

PT-2021-24429

Name of the Vulnerable Software and Affected Versions: TinyMCE versions 5.5.1 and lower Description: A regex denial of service ReDoS vulnerability was discovered in a dependency of the codesample plugin, allowing poorly formed ruby code samples to lock up the browser while performing syntax...

PT-2021-24352 · Tinymce · Tinymce

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.6.0 Description: A stored cross-site scripting vulnerability was discovered in the URL sanitization logic of the core parser, allowing arbitrary JavaScript execution when inserting specially crafted content into th...

Umbraco Cross-Site Scripting Vulnerability (CNVD-2020-75634)

Umbraco is an open source content management system CMS based on ASP.NET technology. Umbraco 8.9.1 and earlier versions are vulnerable to a stored cross-site scripting vulnerability. An attacker can exploit this vulnerability to inject arbitrary JavaScript code into an iframe when editing content...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

Cross site scripting

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

PT-2020-18726

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 8.9.2 Description A stored XSS issue exists, allowing an authenticated user to inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor. This is possible because TinyMC...

Umbraco cross-site scripting vulnerabilities

Umbraco is an open source content management system CMS based on ASP.NET technology. Umbraco 8.9.1 and earlier versions are vulnerable to a stored cross-site scripting vulnerability. An attacker can exploit this vulnerability to inject arbitrary JavaScript code into an iframe when editing content...

TinyMCE < 4.9.7 Cross-Site Scripting

According to its self-reported version number, TinyMCE is prior to 4.9.7 or 5.x prior to 5.1.4. Therefore, it may be affected by a cross-site scripting vulnerability in the core parser, paste and visualchars plugins. Note that the scanner has not tested for these issues but has instead relied onl...

TinyMCE 5.x < 5.1.4 Cross-Site Scripting

According to its self-reported version number, TinyMCE is prior to 4.9.7 or 5.x prior to 5.1.4. Therefore, it may be affected by a cross-site scripting vulnerability in the core parser, paste and visualchars plugins. Note that the scanner has not tested for these issues but has instead relied onl...

TinyMCE < 4.9.11 Cross-Site Scripting

According to its self-reported version number, TinyMCE is prior to 4.9.11 or 5.x prior to 5.4.1. Therefore, it may be affected by a cross-site scripting vulnerability in the editor via the clipboard or APIs. Note that the scanner has not tested for these issues but has instead relied only on the...

TinyMCE < 4.9.10 Cross-Site Scripting

According to its self-reported version number, TinyMCE is prior to 4.9.10 or 5.x prior to 5.2.2. Therefore, it may be affected by a cross-site scripting vulnerability in the core parser and media plugin. Note that the scanner has not tested for these issues but has instead relied only on the...

TinyMCE 5.x < 5.2.2 Cross-Site Scripting

According to its self-reported version number, TinyMCE is prior to 4.9.10 or 5.x prior to 5.2.2. Therefore, it may be affected by a cross-site scripting vulnerability in the core parser and media plugin. Note that the scanner has not tested for these issues but has instead relied only on the...

TinyMCE 5.x < 5.4.1 Cross-Site Scripting

According to its self-reported version number, TinyMCE is prior to 4.9.11 or 5.x prior to 5.4.1. Therefore, it may be affected by a cross-site scripting vulnerability in the editor via the clipboard or APIs. Note that the scanner has not tested for these issues but has instead relied only on the...

PDW File Browser 1.3 Shell Upload

Exploit Title: PDW File Browser 1.3 - Remote Code Execution Date: 24-10-2020 Exploit Author: David Bimmel Researchers: David Bimmel, Joost Vondeling, Ramòn Janssen Vendor Homepage: n/a Software Link: https://github.com/GuidoNeele/PDW-File-Browser Version: … ? Once you have uploaded your webshell...