Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 23

Export CSV
CVE-2021-32808

Cross-site scripting in ckeditor via abuse of undo functionality

ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.

CVSS 3.1 · 7.6 High EPSS 1.2% KEV · Not listed
Vendors
Ckeditor Fedoraproject Oracle
Products
Ckeditor Fedora Application Express and 10 more
CVE-2021-22118

spring-web: (re)creating the temporary storage directory could result in a privilege escalation within WebFlux application

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Hci Management Services For Element Software Commerce Guided Search and 31 more