MAL-2022-4523 Malicious code in md-mock-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c87e6f67d545e1451e9144d8c5eec185756e0d4f04456e1160e2ab19c5f4f6b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in md-mock-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c87e6f67d545e1451e9144d8c5eec185756e0d4f04456e1160e2ab19c5f4f6b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-6553

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the verity ctr function in the drivers/md/dm-verity-target.c module of the Linux kernel's device-mapper subsystem. It allows an attacker with administrator...

Oracle Linux 8 : grafana (ELSA-2022-1781)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-1781 advisory. - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache - resolve CVE-2021-43813 grafana: directory traversal vulnerability for...

PT-2025-8459

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the md/bitmap vulnerability Description A vulnerability in the Linux kernel has been identified, which can cause a kernel crash when the bitmap area contains invalid data. Th...

Stored XSS via File Upload

Description \ Stored XSS via uploading file in .md format. Proof of Concept filename="poc.md" alert1 Steps to Reproduce 1.Login into showdoc.com.cn.\ 2.Navigate to file library https://www.showdoc.com.cn/attachment/index\ 3.In the File Library page, click the Upload button and choose the poc.md...

@asciidoctor/reveal.js (>=5.0.0-rc.1, <=5.0.1), hapi-reveal (4.0.0) +1 more potentially affected by CVE-2022-0776 via reveal.js (>=4.0.2, <=4.2.1)

reveal.js NPM version =4.0.2, =5.0.0-rc.1, =4.0.0-beta.0, =5.3.2 Source cves: CVE-2022-0776 Source advisory: OSV:GHSA-HHQJ-CFJX-VJ25...

CVE-2022-21800

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...

PT-2022-36811

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the following functions: md analyze inlines, md process normal block contents,...

PT-2022-36996

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions md decode utf8 , md link label hash, and md is link reference. No...

PT-2022-36983

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state includes functions such as md build attribute, md enter leave span a, and md process...

PT-2022-36916

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the md parse and md html functions, specifically in the fuzz-mdhtml.c file. No...

Code Injection in md-to-pdf.

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

GHSA-X949-7CM6-FM6P Code Injection in md-to-pdf.

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

Grafana 5.0.0 - 8.3.1 Directory Traversal Vulnerability

Grafana is prone to a directory traversal vulnerability for Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Path Traversal

github.com/grafana/grafana is vulnerable to path traversal. The vulnerability exists in the pluginMarkdown function in plugins.go, allowing an authenticated attacker to access fully lowercase or fully uppercase '.md' files outside the expected directory...

CVE-2021-43813

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension...

CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

Remote code execution

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...