.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

ckeditor4 4.15.1 vulnerabilities

15 advisories known · ckeditor4@4.15.1 · 12 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 4.15.1

SEVERITYADVISORYPUBLISHED

HighHTML comments vulnerability allowing to execute JavaScript codeGHSA-7h26-63m7-qhf2BIT-drupal-2021-41165CVE-2021-41165Affected <4.17.0Fixed in 4.17.0OSV source ↗5 years ago

HighAdvanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTMLGHSA-pvmx-g8h5-cprjBIT-drupal-2021-41164CVE-2021-41164Affected <4.17.0Fixed in 4.17.0OSV source ↗5 years ago

HighWidget feature vulnerability allowing to execute JavaScript code using undo functionalityGHSA-6226-h7ff-ch6cCVE-2021-32808Affected >=4.13.0 <4.16.2Fixed in 4.16.2OSV source ↗5 years ago

HighFake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.GHSA-m94c-37g6-cjhcCVE-2021-37695Affected <4.16.2Fixed in 4.16.2OSV source ↗5 years ago

MediumInclusion of Functionality from Untrusted Control Sphere in CKEditor 4GHSA-wpvm-wqr4-p7cwCVE-2021-26272Affected <4.16.0Fixed in 4.16.0OSV source ↗5 years ago

MediumCode Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerabilityGHSA-7r32-vfj5-c2jvCVE-2024-43407Affected <4.25.0Fixed in 4.25.0OSV source ↗2 years ago

MediumCKEditor cross-site scripting vulnerability in AJAX sampleGHSA-wh5w-82f3-wrxhCVE-2023-4771Affected <4.24.0-ltsFixed in 4.24.0-ltsOSV source ↗3 years ago

MediumCKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview featureGHSA-mw2c-vx6j-mg76CVE-2024-24816Affected <4.24.0-ltsFixed in 4.24.0-ltsOSV source ↗3 years ago

MediumCKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detectionGHSA-fq6h-4g8v-qqvmCVE-2024-24815Affected <4.24.0-ltsFixed in 4.24.0-ltsOSV source ↗3 years ago

Mediumckeditor4 vulnerable to cross-site scriptingGHSA-rgx6-rjj4-c388BIT-drupal-2021-33829CVE-2021-33829DRUPAL-CORE-2021-003Affected >=4.14.0 <4.16.1Fixed in 4.16.1OSV source ↗5 years ago

MediumCross-site Scripting in CKEditor4GHSA-4fc4-4p5g-6w89BIT-drupal-2022-24728BIT-drupal-2022-24729CVE-2022-24728CVE-2022-24729DRUPAL-CORE-2022-005GHSA-f6rf-9m92-x2hhAffected <4.18.0Fixed in 4.18.0OSV source ↗5 years ago

MediumClipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionalityGHSA-7889-rm5j-hpggCVE-2021-32809Affected >=4.5.2 <4.16.2Fixed in 4.16.2OSV source ↗5 years ago

Does not affect 4.15.1

SEVERITYADVISORYPUBLISHED

MediumImproper Neutralization of Input During Web Page Generation in CKEditor4GHSA-4m44-5j2g-xf64CVE-2020-27193Affected <4.15.1Fixed in 4.15.1OSV source ↗4 years ago

MediumCKEditor 4.0 vulnerability in the HTML Data ProcessorGHSA-vcjf-mgcg-jxjqBIT-drupal-2020-9281CVE-2020-9281Affected <4.14.0Fixed in 4.14.0OSV source ↗6 years ago

LowCKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeoverGHSA-6v96-m24v-f58jCVE-2024-43411Affected >=4.22.0 <4.25.0Fixed in 4.25.0OSV source ↗2 years ago