4773 matches found
CVE-2021-22225
Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
UBUNTU-CVE-2021-22225
Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
CVE-2021-22225
GitLab CVE-2021-22225 involves insufficient input sanitization in the markdown renderer, affecting GitLab 13.11 and newer. The vulnerability allows stored cross-site scripting via specially crafted markdown. Root cause is poor sanitization in markdown processing; impact is partial confidentiality...
CVE-2021-22225
Removed by vendor...
PT-2021-6534 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 13.11 and up Description: The issue is related to insufficient input sanitization in markdown, allowing an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown. This can be exploited...
GHSA-9HX4-QM7H-X84J Cross-site Scripting in Gogs
Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...
Cross-site Scripting in Gogs
Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...
Mermaid Cross-Site Scripting Vulnerability
Mermaid is a Javascript-based drawing tool that uses a Markdown-like syntax to allow users to easily and quickly create diagrams from code.A cross-site scripting vulnerability exists in versions of Mermaid prior to 8.11.0 when using antiscript features. No details of the vulnerability are current...
JVN#29949691: Inkdrop vulnerable to OS command injection
Inkdrop provided by Takuya Matsuyama is a Markdown editor. Inkdrop contains an OS command injection vulnerability CWE-78. Impact If a file or code snippet containing an invalid iframe is loaded into Inkdrop, an arbitrary OS command may be executed on the system where it runs. Solution Update the...
Cross-site Scripting (XSS)
Overview qiita-markdown is a Qiita-specified markdown processor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a crafted gist link, a different vulnerability than CVE-2021-28796. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...
CVE-2021-28833
Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...
CVE-2021-28833
Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...
CVE-2021-28833
Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...
Design/Logic Flaw
Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...
CVE-2021-28833
Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...
CVE-2021-28833
Qiita-Markdown (Ruby gem) up to versions before 0.34.0 is vulnerable to cross-site scripting via crafted gist links (CVE-2021-28833). Red Hat advisories and RubySec confirm this as a separate issue from CVE-2021-28796 and describe the same general class of XSS in the transformer/gist handling pat...
Getty104 Qiita::Markdown 跨站脚本漏洞
Getty104 qiita-markdown is Getty104 an open source application . Provides an editor function. A cross-site scripting vulnerability exists in versions prior to Qiita::Markdown 0.34.0, which stems from the program allowing XSS via a crafted gist link...
OPENSUSE-SU-2021:0895-1 Security update for htmldoc
This update for htmldoc fixes the following issues: Update to version 1.9.12 Fixed buffer-overflow CVE-2021-20308 boo1184424 Fixed a crash bug with 'data:' URIs and EPUB output Fixed several other crash bugs Fixed JPEG error handling Fixed some minor issues Removed the bundled libjpeg, libpng, an...
CVE-2021-26834
A cross-site scripting XSS vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode...
Cross site scripting
A cross-site scripting XSS vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode...