Most recent entries from all

EUVD-2026-159509

fkie_cve-2024-43411

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.

GHSA-6v96-m24v-f58j — CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover

Affected: npm: ckeditor4

### Affected Packages

The issue impacts only editor instances with enabled [version notifications](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-versionCheck).

Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please [contact us](mailto:security@cksource.com).

### Impact

A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, we have addressed it in CKEditor 4.25.0-lts to ensure compliance with security best practices.

### Patches

The issue has been recognized and patched. The fix is available in version 4.25.0-lts.

### For More Information

If you have any questions or comments about this advisory, please email us at [security@cksource.com](mailto:security@cksource.com).

UBUNTU-CVE-2024-43411

Affected: Ubuntu:16.04:LTS: ldap-account-manager, Ubuntu:16.04:LTS: request-tracker4, Ubuntu:18.04:LTS: ckeditor3, Ubuntu:18.04:LTS: ldap-account-manager, Ubuntu:Pro:18.04:LTS: request-tracker4, Ubuntu:20.04:LTS: ckeditor3, Ubuntu:20.04:LTS: ldap-account-manager, Ubuntu:20.04:LTS: request-tracker4, Ubuntu:22.04:LTS: ckeditor3, Ubuntu:22.04:LTS: ldap-account-manager and 10 more