Medium · published January 27, 2021
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
| Product | Versions | Fixed in |
|---|---|---|
| ckeditor/ckeditor | ≥ 4.0, < 4.16 | 4.16 |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/application_express | < 21.1.0 | 21.1.0 |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.6, ≤ 8.0.9 | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | < 9.2.6.0 | 9.2.6.0 |
| oracle/siebel_ui_framework | < 21.9 | 21.9 |
| oracle/webcenter_sites | all versions | — |
| oracle/webcenter_sites | all versions | — |