CVE-2021-26271 vulnerabilities and exploits

It was possible to execute a ReDoS-type attack inside CKEditor 4 prior to 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

Ckeditor Ckeditor Oracle Agile Plm 9.3.5 Oracle Agile Plm 9.3.6 Oracle Application Express Oracle Financial Services Analytical Applications Infrastructure Oracle Financial Services Analytical Applications Infrastructure 8.1.0 Oracle Financial Services Analytical Applications Infrastructure 8.1.1 Oracle Jd Edwards Enterpriseone Tools Oracle Siebel Ui Framework Oracle Webcenter Sites 12.2.1.3.0 Oracle Webcenter Sites 12.2.1.4.0

6.5

CVSSv3

It was possible to execute a ReDoS-type attack inside CKEditor 4 prior to 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Ckeditor Ckeditor Oracle Agile Plm 9.3.5 Oracle Agile Plm 9.3.6 Oracle Application Express Oracle Banking Party Management 2.7.0 Oracle Commerce Merchandising Oracle Commerce Merchandising 11.1.0 Oracle Commerce Merchandising 11.2.0 Oracle Financial Services Analytical Applications Infrastructure Oracle Financial Services Analytical Applications Infrastructure 8.1.0 Oracle Financial Services Analytical Applications Infrastructure 8.1.1 Oracle Financial Services Model Management And Governance

5.4

CVSSv3

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing ...

7.5

CVSSv3

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop r...

6.1

CVSSv3

CKEditor 4.x prior to 4.11.0 allows user-assisted XSS involving a source-mode paste.

Ckeditor Ckeditor

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in the Preview plugin prior to 4.4.3 in CKEditor allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.

Ckeditor Ckeditor Ckeditor Ckeditor 4.4.0 Ckeditor Ckeditor 4.4.1

6.1

CVSSv3

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 up to and including 4.16.x prior to 4.16.1 allows remote malicious users to inject executable JavaScript code through a crafted comment because --!> is mishandled.

Ckeditor Ckeditor Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 35 Drupal Drupal Debian Debian Linux 9.0

5.4

CVSSv3

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, w...

Ckeditor Ckeditor Drupal Drupal Oracle Agile Product Lifecycle Management 9.3.6 Oracle Application Express Oracle Banking Apis Oracle Banking Apis 19.1 Oracle Banking Apis 19.2 Oracle Banking Apis 20.1 Oracle Banking Apis 21.1 Oracle Banking Digital Experience Oracle Banking Digital Experience 19.1 Oracle Banking Digital Experience 19.2

5.4

CVSSv3

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could ...

Ckeditor Ckeditor Debian Debian Linux 9.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 35 Oracle Application Express Oracle Banking Party Management 2.7.0 Oracle Commerce Guided Search 11.3.2 Oracle Commerce Merchandising 11.3.2 Oracle Documaker 12.6.3 Oracle Documaker 12.6.4 Oracle Financial Services Analytical Applications Infrastructure

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-26271 vulnerabilities and exploits

CVE-2021-26271

CVE-2021-26272

CVE-2022-24728

CVE-2022-24729

CVE-2018-17960

CVE-2014-5191

CVE-2021-33829

CVE-2021-41165

CVE-2021-37695

Vulmon Search

About

Products

Connect