CVE-2025-46558 org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting XSS through HTML. In particular, using Markdown syntax, it's possible for...

CVE-2025-46558 org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting XSS through HTML. In particular, using Markdown syntax, it's possible for...

PT-2025-18319 · Xwiki · Xwiki Contrib'S Syntax Markdown

Name of the Vulnerable Software and Affected Versions: XWiki Contrib's Syntax Markdown versions 8.2 through 8.8 Description: The issue allows any user to embed Javascript code using Markdown syntax, which can be executed on the browser of other users visiting the document or comment containing it...

CVE-2025-3739

CVE-2025-3739 : A vulnerability in Drupal 8 Google Optimize Hide Page affects the Drupal 8 Google Optimize Hide Page module. The CVSSv3.1 metrics indicate a network attack vector, high attack complexity, and that an attacker requires high privileges with no user interaction to achieve a Confident...

The vulnerability of the contrib/japanese/gdevnpdl.c file, which is part of the NPDL Device software suite for processing, transforming, and generating Ghostscript documents, allows a perpetrator to execute arbitrary code.

The vulnerability of the contrib/japanese/gdevnpdl.c file, which is part of the NPDL Device software suite for processing, transforming, and generating Ghostscript documents, stems from the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an...

CVE-2025-3061 Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006

Vulnerability in Drupal Material Admin.This issue affects Material Admin:...

CVE-2025-3060 Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005

Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile:...

UBUNTU-CVE-2025-27832

An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c...

DRUPAL-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

DEBIAN-CVE-2025-2123

A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function getvar of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument...

Malicious code in @idps/contrib-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b812aaf7e12bd61301969890faac8bcd578104dec35d8c53abfd520ab05c4c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-57081

A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57081

A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

Prototype Pollution

Overview org.webjars.bower:underscore-contrib is an underscore-contrib ================== Affected versions of this package are vulnerable to Prototype Pollution through the lib.fromQuery function. An attacker can disrupt service by supplying a crafted payload with Object.prototype setter to...

Prototype Pollution

Overview org.webjars.npm:underscore-contrib is an underscore-contrib ================== Affected versions of this package are vulnerable to Prototype Pollution through the lib.fromQuery function. An attacker can disrupt service by supplying a crafted payload with Object.prototype setter to...

org.webjars.npm:catharsis (=0.8.9) potentially affected by CVE-2024-57081 via org.webjars.npm:underscore-contrib (=0.3.0)

org.webjars.npm:underscore-contrib MAVEN version =0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:underscore-contrib and may be impacted: - org.webjars.npm:catharsis =0.8.9 Source cves: CVE-2024-57081 Source advisory:...

CVE-2024-57081

A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57081

A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57081

underscore-contrib v0.3.0 contains a prototype pollution flaw in the lib.fromQuery function. An attacker can trigger a Denial of Service by supplying a crafted payload that manipulates Object.prototype via the vulnerable path, as demonstrated in multiple sources (including Snyk reports). The core...

underscore-contrib 安全漏洞

underscore-contrib is an open source application from DocumentCloud. A security vulnerability exists in underscore-contrib version v0.3.0, which stems from the lib.fromQuery function containing a prototype contamination vulnerability...