PT-2024-27955

Name of the Vulnerable Software and Affected Versions CodiMD versions prior to 2.5.4 Description The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This enables attackers to perform cross-site scripting XSS attacks via DOM...

CodiMD Security Vulnerabilities

CodiMD is a real-time collaborative note-taking application open-sourced by HackMD. A security vulnerability exists in CodiMD version 2.5.3 that stems from a lack of authentication and access control vulnerability that allows an unauthenticated attacker to gain unauthorized access to uploaded ima...

CVE-2024-38353: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to...

CVE-2024-38354: Improper Neutralization of Input During Web Page Generation

CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This vulnerability enables attackers to perform cross-site scripting XSS attacks via DOM clobbering. This...

CVE-2024-22778

HackMD CodiMD 2.5.2 is vulnerable to Denial of Service...

Denial of service

HackMD CodiMD 2.5.2 is vulnerable to Denial of Service...

CVE-2024-22778

HackMD CodiMD 2.5.2 is vulnerable to Denial of Service...

HackMD CodiMD Security Vulnerabilities

CodiMD is a real-time collaborative note-taking application open-sourced by HackMD. A security vulnerability exists in HackMD CodiMD versions prior to 2.5.2 that stems from vulnerability to denial of service attacks...

CVE-2024-22778

HackMD CodiMD 2.5.2 is vulnerable to Denial of Service...

CVE-2024-22778

HackMD CodiMD 2.5.2 is vulnerable to Denial of Service...

CVE-2024-22778

The real-time collaborative note-taking application HackMD CodiMD is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.5.2 . This vulnerability allows an attacker to disrupt the availability of the service. Remediation is available by updating to version 2.5.2 or later . Explo...

CVE-2024-22778

HackMD CodiMD 2.5.2 is vulnerable to Denial of Service...

CVE-2024-22778: Undefined Security Weakness

HackMD CodiMD 2.5.2 is vulnerable to Denial of Service...

CVE-2021-29474

CVE-2021-29474 affects HedgeDoc (CodiMD). The vulnerability allows a relative path traversal via an improper input validation in the note creation flow: an URL-encoded alias is passed through the router into noteController.showNote, then into findNote/parseNoteId, ultimately using a possibly unva...

CVE-2019-15499

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

CVE-2019-15499

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

Cross site scripting

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

CVE-2019-15499

CVE-2019-15499 affects CodiMD 1.3.1. In Safari, an XSS can be triggered via an IFRAME element with allow-top-navigation in the sandbox attribute when used with a data: URL. Multiple sources (NVD, Red Hat advisory, OSV, CVE lists) corroborate this description. No explicit patch/version remediation...

CVE-2019-15499

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL...

PT-2019-14227

Name of the Vulnerable Software and Affected Versions CodiMD version 1.3.1 Description The issue allows for XSS via an IFRAME element with the allow-top-navigation attribute in the sandbox, in conjunction with a data: URL, specifically when using the Safari browser. Recommendations For CodiMD...