GitHub: DoS via markdown API from unauthenticated user

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the...

Stored Cross-Site Scripting vulnerability in Recipe Instructions allows Admin session hijacking

Description A low privilege user can insert malicious JavaScript code into the Recipe Instructions which will execute in another person's browser that visits the recipe. Proof of Concept Reproduction Steps: 1. As a lower privileged user login to the Mealie web application. 2. Create a recipe and...

Malicious code in dx-devsite-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94d8e93f1fe2cd310bb5359e393df7bf057fae4e9a8bdb71bbcf18dbebb8d5d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2631 Malicious code in dx-devsite-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94d8e93f1fe2cd310bb5359e393df7bf057fae4e9a8bdb71bbcf18dbebb8d5d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XSS Vulnerability in Markdown Editor

Impact InvenTree uses EasyMDE for displaying markdown text in various places e.g. for the various "notes" fields associated with various models. By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the use...

GHSA-85Q9-7467-R53Q XSS Vulnerability in Markdown Editor

Impact InvenTree uses EasyMDE for displaying markdown text in various places e.g. for the various "notes" fields associated with various models. By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the use...

npm markdown-link-extractor denial-of-service vulnerability

npm markdown-link-extractor is used to extract links from Markdown text. npm markdown-link-extractor versions prior to 3.0.2 and 4.0.0 contain a denial of service vulnerability that stems from not properly handling incoming error messages, which could be exploited by an attacker to cause a denial...

Regular expression denial of service in markdown-link-extractor

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

@angie061099/md-links (=0.2.0), @boillodmanuel/markdown-link-check (>=4.0.1 <=4.7.0) +75 more potentially affected by CVE-2021-43308 via markdown-link-extractor (>=1.3.1 <=2.0.1)

markdown-link-extractor NPM version =1.3.1, =4.0.1, =0.0.2, =1.0.30001255, =1.0.0, =1.0.0, =0.0.33, =0.0.0, =0.1.11, =0.0.3, =0.1.0, =0.1.0, =1.1.0, =1.0.0, =1.1.0 and more Source cves: CVE-2021-43308 Source advisory: OSV:GHSA-MMH6-M7V9-5956...

GHSA-MMH6-M7V9-5956 Regular expression denial of service in markdown-link-extractor

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

npm markdown-link-extractor 安全漏洞

npm markdown-link-extractor is used to extract links from Markdown text. npm markdown-link-extractor versions prior to 3.0.2 and 4.0.0 contain a denial of service vulnerability that stems from not properly handling incoming error messages, which could be exploited by an attacker to cause a denial...

CVE-2021-43308

CVE-2021-43308 affects the npm package markdown-link-extractor . The vulnerability is an exponential ReDoS that can be triggered by attacker-supplied input to the module’s exported function, with specifics citing an insecure regex pattern used for the image parameter. Public details describe a Do...

CVE-2021-43308 Exponential ReDoS in markdown-link-extractor

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

PT-2022-11820 · Npm · Markdown-Link-Extractor

Name of the Vulnerable Software and Affected Versions: markdown-link-extractor npm package affected versions not specified Description: The issue is related to an exponential ReDoS Regular Expression Denial of Service that can be triggered when an attacker supplies arbitrary input to the module's...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

Apache Superset Stored XSS on Dashboard markdown

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...

GHSA-W358-RJ93-R5QV Apache Superset Stored XSS on Dashboard markdown

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...

XSS vulnerability in Jenkins Markdown Formatter Plugin

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the...