CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

CVE-2021-23639 Remote Code Execution (RCE)

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

CVE-2021-23639

md-to-pdf before 5.0.0 is vulnerable to Remote Code Execution via gray-matter parsing of front matter without disabling the JS engine. Affected tool is the CLI md-to-pdf (Simonhaenisch) with PoC demonstrations and Snyk/Snyk-like advisories confirming RCE risk. The root cause is executing embedded...

CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

Directory traversal

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension...

CVE-2021-43813

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension...

PT-2021-15541

Name of the Vulnerable Software and Affected Versions md-to-pdf versions prior to 5.0.0 Description The issue allows for Remote Code Execution RCE due to the utilization of the gray-matter library to parse front matter content without disabling the JS engine. Recommendations For versions prior to...

CVE-2021-43813: Improper Limitation of a Pathname to a Restricted Directory

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension...

CVE-2021-23639: Undefined Security Weakness

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

Grafana -- Directory Traversal

GitHub Security Labs reports: A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrar...

Grafana -- Directory Traversal

GitHub Security Labs reports: A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrar...

PYSEC-2021-385

EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of t...

PT-2021-30006

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.249 Description A lock order reversal issue was fixed in the md alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-26136

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.70 Description A lock order reversal issue was fixed in the md alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.10.70...

PT-2021-26219

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.0 through 5.14.8 Description: A lock order reversal issue was discovered in the md alloc function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version 3.0 and fixed ...

PT-2021-26039

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.0 through 4.19.208 Description A lock order reversal issue was found in the md alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions 3.0 through...

PT-2021-30034

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.209 Description A lock order reversal issue was fixed in the md alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-30074

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.150 Description A lock order reversal issue was fixed in the md alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.4.150...

PT-2021-30214

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.0 through 5.14.8 Description A lock order reversal issue was discovered in the md alloc function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version 3.0 and fixed in...

PT-2021-26079

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.150 Description A lock order reversal issue was discovered in the md alloc function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v3.0 and fixed in...