CVE-2024-29203

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-292049.8A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to e CVE-2024-292057.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti P CVE-2024-292062.2An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported CVE-2024-292077.5An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affe CVE-2024-292082.2An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the CVE-2024-292096.0A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an atta CVE-2024-29219.8Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to t CVE-2024-292102.8A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its config CVE-2024-292114.7A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuratio CVE-2024-292129.9Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management ag CVE-2024-292137.8Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via uns CVE-2024-292147.5Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially ena