In certain screens, the Activity "Subject" field was not properly escaped to prevent cross site scripting.

In certain screens, the Profile "Description" field was not properly escaped to prevent cross site scripting.

In certain screens, the Event "Summary" field was not properly escaped to prevent cross site scripting.

CiviCRM did not provide sufficient protection on the CKEditor configuration form, which could allow user to store and execute Javascript.

Note: This form had another vulnerability in the same version. The risk from two overlapping vulnerabilities may be greater than the risk of each individually.

CiviCRM did not provide sufficient protection on the CKEditor configuration form, which could allow a malicious third-party to trick a CiviCRM administrator into changing the configuration.

Note: This form had another vulnerability in the same version. The risk from two overlapping vulnerabilities may be greater than the risk of each individually.

When viewing an activity, the activity details were not sufficiently filtered to prevent cross-site scripting attacks.

In CiviCRM, an Access Control List (ACL) confers limited access to contact records (based on the membership list for a "Group" of contacts). In configurations with "ACL Smart Groups", a flaw allowed limited backend users to re-define their group criteria and gain elevated access. The fix ensures that only trusted users (with permission "edit groups") may re-define the group criteria.