Skip to content
OpenAdvisories
Medium WID-SEC-2024-0405 2 CVEs

IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Feb 15, 2024 · Updated Feb 15, 2024 · de-DE

Vendor: IBM Product: Maximo Asset Management Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 2

  • Medium 6.1
    CVE-2023-45818

    Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

    TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a stri…

    tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  • Medium 6.1
    CVE-2023-45819

    Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

    TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions f…

    tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet

Revision history

  1. #1

    Initiale Fassung

References