GHSA-RHF5-2378-3W3W markdown-it-decorate vulnerable to cross-site scripting (XSS)

markdown-it-decorate adds attributes, IDs and classes to Markdown, and the most recent version 1.2.2 was published in 2017. All versions are currently vulnerable to cross-site scripting XSS and there is no fixed version at this time...

@jamen/mdc (>=0.0.0 <=0.0.1), @namgoe/gcmsgen (>=0.0.3 <=0.0.11) +25 more potentially affected by CVE-2020-28459 via markdown-it-decorate (>=1.0.0 <=1.2.2)

markdown-it-decorate NPM version =1.0.0, =0.0.0, =0.0.3, =0.0.1, =0.0.0, =2.3.0, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =1.1.0, =0.1.0, =0.2.0, =1.0.1, =1.0.1, =1.0.17 and more Source cves: CVE-2020-28459 Source advisory: OSV:GHSA-RHF5-2378-3W3W...

PT-2022-8902 · Npm · Markdown-It-Decorate

Name of the Vulnerable Software and Affected Versions: markdown-it-decorate versions prior to a fixed version no fixed version available Description: The issue affects the markdown-it-decorate package, allowing an attacker to add an event handler or use javascript:xxx for the link, potentially...

CVE-2022-24724

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:rowfromstring may lead to heap memory corruption when parsing tables who's marker rows contain mor...

[SECURITY] Fedora 35 Update: golang-github-mmarkdown-mmark-2.2.10-5.fc35

Mmark is a powerful markdown processor written in Go, geared towards writing IETF documents. It is, however, also suited for writing complete books and ot her technical documentation, like the Learning Go book mmark source, and I-D text output...

[SECURITY] Fedora 35 Update: golang-github-cpuguy83-md2man-2.0.2-2.fc35

Converts markdown into roff man pages...

Fedora: Security Advisory for golang-github-msprev-fzf-bibtex (FEDORA-2022-ba365d3703)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-msprev-fzf-bibtex-1.1-5.20220205gitd5df2c6.fc36

A BibTeX source for fzf. fzf-bibtex uses BibTool parse BibTeX files, caches the results, and supports vim integration for users of the fzf.vim plugin. It includes support for Markdown and LaTeX citation formats...

U.S. Dept Of Defense: STORED XSS in █████████/nlc/login.aspx via "edit" GET parameter through markdown editor [HtUS]

While looking through the source code of https://████████/nlc/login.aspx,I noticed this line 204: Cancel ,which exposes the edit GET parameter. Upon accessing https://█████████/nlc/login.aspx?edit=true ,a hidden markdown editor will be revealed if you click around where the bottom text is,which...

Stored Cross-site Scripting (XSS) leads to Account Takeover

🔒️ Requirements - Be able to edit or create documents. - Click of a user on the link. 📝 Description The markdown's link creation feature does not properly sanitize url input, which allows to use error event to execute javascript. Furthermore, due to a lack of HttpOnly flag on sessions cookie, it i...

[SECURITY] Fedora 36 Update: golang-github-mmarkdown-mmark-2.2.10-5.fc36

Mmark is a powerful markdown processor written in Go, geared towards writing IETF documents. It is, however, also suited for writing complete books and ot her technical documentation, like the Learning Go book mmark source, and I-D text output...

[SECURITY] Fedora 36 Update: golang-github-cpuguy83-md2man-2.0.2-2.fc36

Converts markdown into roff man pages...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

Stack overflow

DISPUTED md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

CVE-2022-34913 concerns the Markdown processor md2roff, specifically version 1.7. The Red Hat and related sources describe a stack-based buffer overflow when parsing a Markdown file containing a large sequence of consecutive characters, with the vulnerability tied to the code path in md2roff.c (n...

md2roff 缓冲区错误漏洞

md2roff is a personal developer by Nicholas Christopoulos that converts markdown to groff / troff man, mdoc, mm, mom documents. A buffer error vulnerability exists in md2roff version 1.7, which is caused by a stack-based buffer overflow in Markdown files containing a large number of consecutive...

PT-2022-22432 · Md2Roff · Md2Roff

Name of the Vulnerable Software and Affected Versions: md2roff version 1.7 Description: The issue is a stack-based buffer overflow that occurs when processing a Markdown file containing a large number of consecutive characters. It's noted that the vendor's position is that the product is not...