TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8223-1 advisory.

    It was discovered that Roundcube Webmail mishandled Punycode xn-- domain names. An attacker could possibly     use this issue to cause a homograph attack. (CVE-2019-15237)

    It was discovered that Roundcube Webmail did not properly sanitize certain attributes when handling CSS     within HTML messages and certain SVG attributes. An attacker could possibly use this issue to cause a     cross-site scripting attack. (CVE-2024-38356, CVE-2024-38357)

    It was discovered that Roundcube Webmail did not properly sanitize certain HTML attributes when rendering     e-mail messages. An attacker could possibly use this issue to cause a cross-site scripting attack.
    (CVE-2024-42008)

    It was discovered that Roundcube Webmail did not properly filter certain CSS token sequences within     rendered e-mail messages. An attacker could possibly use this issue to obtain sensitive information.
    (CVE-2024-42010)

    It was discovered that Roundcube Webmail did not properly treat an SVG tag as an image source within its     HTML sanitizer. An attacker could possibly use this issue to bypass remote image blocking to track email     open actions or potentially bypass access control. (CVE-2026-25916)

    It was discovered that Roundcube Webmail did not properly handle comments within Cascading Style Sheets     (CSS). An attacker could possibly use this issue to perform a CSS injection attack. (CVE-2026-26079)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in     TinyMCE's content parsing code. This allowed specially crafted noscript elements containing malicious code     to be executed when that content was loaded into the editor. This vulnerability has been patched in     TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are     properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2024-38357)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311109	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Roundcube Webmail vulnerabilities (USN-8223-1)	Nessus	Ubuntu Local Security Checks	medium
261935	Linux Distros Unpatched Vulnerability : CVE-2024-38357	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-38357

medium

Tenable Plugins

medium

medium