CVE-2020-27193

CVE	CVE-2020-27193
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-11-12 21:15:00 UTC
Updated	2021-12-02 22:20:00 UTC
Description	A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

Problem Types: CWE-79

Type	Vendor	Product	Version	Update	Edition	Language
Application	Ckeditor	Ckeditor	4.15.0	All	All	All
Application	Ckeditor	Ckeditor	4.15.0	All	All	All
Application	Oracle	Agile Plm	9.3.5	All	All	All
Application	Oracle	Agile Plm	9.3.6	All	All	All
Application	Oracle	Application Express	All	All	All	All
Application	Oracle	Banking Party Management	2.7.0	All	All	All
Application	Oracle	Banking Platform	2.4.0	All	All	All
Application	Oracle	Banking Platform	2.7.0	All	All	All
Application	Oracle	Banking Platform	2.7.1	All	All	All
Application	Oracle	Banking Platform	2.8.0	All	All	All
Application	Oracle	Banking Platform	2.9.0	All	All	All
Application	Oracle	Commerce Merchandising	11.0.0	All	All	All
Application	Oracle	Commerce Merchandising	11.1.0	All	All	All
Application	Oracle	Commerce Merchandising	11.2.0	All	All	All
Application	Oracle	Commerce Merchandising	11.3.0	All	All	All
Application	Oracle	Commerce Merchandising	11.3.1	All	All	All
Application	Oracle	Commerce Merchandising	11.3.2	All	All	All
Application	Oracle	Financial Services Analytical Applications Infrastructure	8.1.0	All	All	All
Application	Oracle	Financial Services Analytical Applications Infrastructure	8.1.1	All	All	All
Application	Oracle	Financial Services Analytical Applications Infrastructure	All	All	All	All
Application	Oracle	Jd Edwards Enterpriseone Tools	All	All	All	All
Application	Oracle	Peoplesoft Enterprise Peopletools	8.56	All	All	All
Application	Oracle	Peoplesoft Enterprise Peopletools	8.57	All	All	All
Application	Oracle	Peoplesoft Enterprise Peopletools	8.58	All	All	All

Reference	Source	Link	Tags
CKEditor 4.15.1 \| CKEditor.com	CONFIRM	ckeditor.com	Release Notes, Vendor Advisory
Oracle Critical Patch Update Advisory - July 2021	N/A	www.oracle.com
Oracle Critical Patch Update Advisory - October 2021	MISC	www.oracle.com
CKEditor 4 \| CKEditor.com	MISC	ckeditor.com	Release Notes, Vendor Advisory
Oracle Critical Patch Update Advisory - April 2021	MISC	www.oracle.com
CKEditor 4.15.1 with a security patch released	CONFIRM	ckeditor.com	Release Notes, Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

20226 Oracle Database 19c Critical Patch Update - July 2021
20227 Oracle Database 12.2.0.1 Critical Patch Update - July 2021
20228 Oracle Database 12.2.0.1 Critical Patch Update - July 2021 (Unauthenticated)
20229 Oracle Database 12.1.0.2 Critical Patch Update - July 2021
20230 Oracle Database 12.1.0.2 Critical Patch Update - July 2021 (Unauthenticated)
20279 Oracle Database 19c Critical OJVM Patch Update - July 2021
375482 Oracle PeopleSoft Enterprise PeopleTools Product Multiple Vulnerabilities (CPUAPR2021)