netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-5h9g-x5rv-25wg
GHSA-r8hm-w5f7-wj39
This commit is contained in:
advisory-database[bot]
2024-01-03 22:35:08 +00:00
parent 8e1aef8238
commit 27ad90111d
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2021/10/GHSA-5h9g-x5rv-25wg/GHSA-5h9g-x5rv-25wg.json
+2 -2
View File
@@ -1,10 +1,10 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5h9g-x5rv-25wg",
"modified": "2021-10-22T13:49:23Z",
"modified": "2024-01-03T22:34:18Z",
"published": "2021-10-22T16:24:02Z",
"aliases": [
"CVE-2024-21908"
],
"summary": "Cross-site scripting vulnerability in TinyMCE",
"details": "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the schema validation logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or editor APIs. This malicious content could then end up in content published outside the editor, if no server-side sanitization was performed. This impacts all users who are using TinyMCE 5.8.2 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.9.0 by ensuring schema validation was still performed after unwrapping invalid elements.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.9.0 or higher\n- Manually sanitize the content using the `BeforeSetContent` event (see below)\n\n#### Example: Manually sanitize content\n```js\neditor.on('BeforeSetContent', function(e) {\n var sanitizedContent = ...; // Manually sanitize content here\n e.content = sanitizedContent;\n});\n```\n\n### Acknowledgements\nTiny Technologies would like to thank William Bowling for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)",
advisories/github-reviewed/2021/11/GHSA-r8hm-w5f7-wj39/GHSA-r8hm-w5f7-wj39.json
+2 -2
View File
@@ -1,10 +1,10 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r8hm-w5f7-wj39",
"modified": "2021-11-01T20:02:43Z",
"modified": "2024-01-03T22:33:13Z",
"published": "2021-11-02T15:42:52Z",
"aliases": [
"CVE-2024-21910"
],
"summary": "Cross-site scripting vulnerability in TinyMCE plugins",
"details": "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the `image` and `link` plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.10.0 or higher\n- Disable the `image` and `link` plugins\n\n### Acknowledgements\nTiny Technologies would like to thank Yakir6 for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)",