307 matches found
CVE-2020-7773: Improper Neutralization of Input During Web Page Generation
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...
Valeriangalliat Markdown It Highlightjs 跨站脚本漏洞
Valeriangalliat Markdown It Highlightjs is Valeriangalliat individual developers of a Js code base for Web page Markdown highlighting . A cross-site scripting vulnerability exists in markdown-it-highlightjs versions prior to 3.3.1, which stems from the ability to insert malicious JavaScript as th...
Cross-site Scripting (XSS)
markdown-it-prism is vulnerable to cross-site scripting XSS. The library does not properly escape the langToUse variable, allowing a malicious user to inject and execute arbitrary Javascript code...
Cross-Site Scripting in markdown-it-katex
All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Consider using a...
GHSA-5FF8-JCF9-FW62 Cross-Site Scripting in markdown-it-katex
All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Consider using a...
42-markdown (>=1.0.0, <=1.0.1), @58fe/p5 (>=1.3.1, <=2.4.8) +415 more potentially affected by unknown CVE via markdown-it-katex (>=1.1.0, <=2.0.3)
markdown-it-katex NPM version =1.1.0, =1.0.0, =1.3.1, =2.3.0, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =0.14.0, =1.1.7, =1.0.0, =1.5.0 and more Source cves: unknown CVE Source advisory: GHSA-5FF8-JCF9-FW62...
42-markdown (>=1.0.0, <=1.0.1), @58fe/p5 (>=1.3.1, <=2.4.8) +415 more potentially affected by unknown CVE via markdown-it-katex (>=1.1.0, <=2.0.3)
markdown-it-katex NPM version =1.1.0, =1.0.0, =1.3.1, =2.3.0, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =0.14.0, =1.1.7, =1.0.0, =1.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5FF8-JCF9-FW62...
PT-2020-21059
Name of the Vulnerable Software and Affected Versions markdown-it-katex versions affected versions not specified Description The issue concerns a failure to properly escape error messages, potentially allowing attackers to execute arbitrary JavaScript in a victim's browser by triggering an error...
@aconex/styleguide (>=2.0.1, <=2.2.0) potentially affected by unknown CVE via markdown-it-toc-and-anchor (4.1.2)
markdown-it-toc-and-anchor NPM version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it-toc-and-anchor and may be impacted: - @aconex/styleguide =2.0.1, =2.2.0 Source cves: unknown CVE Source advisory: GHSA-X6M6-5HRF-FH6R...
Denial of Service in markdown-it-toc-and-anchor
All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...
GHSA-X6M6-5HRF-FH6R Denial of Service in markdown-it-toc-and-anchor
All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...
@aconex/styleguide (>=2.0.1, <=2.2.0) potentially affected by unknown CVE via markdown-it-toc-and-anchor (4.1.2)
markdown-it-toc-and-anchor NPM version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it-toc-and-anchor and may be impacted: - @aconex/styleguide =2.0.1, =2.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X6M6-5HRF-FH6R...
PT-2020-21582
Name of the Vulnerable Software and Affected Versions markdown-it-toc-and-anchor versions affected versions not specified Description The issue allows for a Denial of Service. It occurs when parsing markdown that contains text+ @toc, causing the application to enter an infinite loop...
Cross-site Scripting (XSS)
markdown-it-katex is vulnerable to cross-site scripting. The vulnerability exists in index.js once the parser return an error it returns katex without sanitizing as HTML tags, allowing a malicious user to inject and execute arbitrary web scripts...
Cross-Site Scripting
Overview All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Conside...
Denial Of Service (DoS)
markdown-it is vulnerable to denial of service. The parsing of a malicious string such as multiple results in quadratic processing time, which could potentially be abused to cause a denial of service condition in the application...
Denial of Service
Overview All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...
CVE-2015-3295
markdown-it before 4.1.0 does not block data: URLs...
