9 results · Clear filters · Feed
-
High 8.1
CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribu…
-
High 8.8
LAM has Authenticated Local File Inclusion (LFI) in PDF export
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this…
-
High 7.9CVE-2024-23333 EPSS 18%
LAM vulnerable to Authenticated Remote Code Execution
LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to…
-
High 7.5
phpseclib Infinite Loop vulnerability
Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.
-
High 7.8
Incorrect Default Permissions in ldap-account-manager
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.php…
-
High 8.1
Stored XSS and path traversal in LDAPAccountManager/lam
LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks…
-
High 8.2
HTML comments vulnerability allowing to execute JavaScript code
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing co…
-
High 8.2
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing c…
-
High 7.3
Execution of JavaScript code using malformed HTML in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objec…