Most recent entries from all

certfr-2020-avi-465 — De multiples vulnérabilités ont été découvertes dans Zimbra. Elles permettent à un attaquant de provoquer un problème d…

certfr-2020-avi-465

cnvd-2019-23289

EUVD-2026-60555

fkie_cve-2019-1010091

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.

GHSA-c78w-2gw7-gjv3 — XSS in TinyMCE

Affected: npm: tinymce

### Impact A cross-site scripting (XSS) vulnerability was discovered in: the core parser and `media` plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.9 or lower and TinyMCE 5.2.1 or lower.

### Patches This vulnerability has been patched in TinyMCE 4.9.10 and 5.2.2 by improved HTML parsing and sanitization logic.

### Workarounds The workarounds available are: - disable the media plugin and manually sanitize CDATA content (see below) or - upgrade to either TinyMCE 4.9.10 or TinyMCE 5.2.2

#### Example: Manually strip CDATA elements ```js setup: function(editor) { editor.on('PreInit', function() { editor.parser.addNodeFilter('#cdata', function(nodes) { for (var i = 0; i < nodes.length; i++) { nodes[i].remove(); } }); }); } ```

### Acknowledgements Tiny Technologies would like to thank Michał Bentkowski and [intivesec](https://github.com/intivesec) for discovering these vulnerabilities.

### References https://www.tiny.cloud/docs/release-notes/release-notes522/#securityfixes

### For more information If you have any questions or comments about this advisory: * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues) * Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)

gsd-2019-1010091

UBUNTU-CVE-2019-1010091

Affected: Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce

WID-SEC-W-2023-0790 — IBM Maximo Asset Management: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen.