Product:

Ckeditor

(Ckeditor)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 24
Date Id Summary Products Score Patch Annotated
2023-06-13 CVE-2023-31541 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server. Ckeditor 9.8
2020-03-07 CVE-2020-9281 A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax). Ckeditor, Drupal, Fedora, Agile_plm, Application_express, Banking_enterprise_default_management, Banking_enterprise_default_managment, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools, Siebel_apps_\-_customer_order_management, Webcenter_portal 6.1
2020-03-10 CVE-2020-9440 A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor. Ckeditor, Fedora, Webspellchecker 6.1
2020-11-12 CVE-2020-27193 A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs. Ckeditor, Agile_plm, Application_express, Banking_party_management, Banking_platform, Commerce_merchandising, Financial_services_analytical_applications_infrastructure, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools 6.1
2021-01-26 CVE-2021-26271 It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin). Ckeditor, Agile_plm, Application_express, Financial_services_analytical_applications_infrastructure, Jd_edwards_enterpriseone_tools, Siebel_ui_framework, Webcenter_sites 6.5
2021-01-26 CVE-2021-26272 It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin). Ckeditor, Agile_plm, Application_express, Banking_party_management, Commerce_merchandising, Financial_services_analytical_applications_infrastructure, Financial_services_model_management_and_governance, Jd_edwards_enterpriseone_tools, Siebel_ui_framework, Webcenter_sites 6.5
2021-06-09 CVE-2021-33829 A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. Ckeditor, Debian_linux, Drupal, Fedora 6.1
2021-08-12 CVE-2021-32808 ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2. Ckeditor, Fedora, Application_express, Banking_party_management, Commerce_guided_search, Commerce_merchandising, Documaker, Financial_services_analytical_applications_infrastructure, Financial_services_model_management_and_governance, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools, Siebel_ui_framework, Webcenter_sites 5.4
2021-08-12 CVE-2021-32809 ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in... Ckeditor, Fedora, Application_express, Banking_party_management, Commerce_guided_search, Commerce_merchandising, Documaker, Financial_services_analytical_applications_infrastructure, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools 5.4
2021-08-13 CVE-2021-37695 ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2. Ckeditor, Debian_linux, Fedora, Application_express, Banking_party_management, Commerce_guided_search, Commerce_merchandising, Documaker, Financial_services_analytical_applications_infrastructure, Financial_services_model_management_and_governance, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools 5.4