CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

Stack overflow

DISPUTED md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

CVE-2022-34913 concerns the Markdown processor md2roff, specifically version 1.7. The Red Hat and related sources describe a stack-based buffer overflow when parsing a Markdown file containing a large sequence of consecutive characters, with the vulnerability tied to the code path in md2roff.c (n...

PT-2022-22432 · Md2Roff · Md2Roff

Name of the Vulnerable Software and Affected Versions: md2roff version 1.7 Description: The issue is a stack-based buffer overflow that occurs when processing a Markdown file containing a large number of consecutive characters. It's noted that the vendor's position is that the product is not...

CVE-2022-34913: Out-of-bounds Write

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

md2roff 缓冲区错误漏洞

md2roff is a personal developer by Nicholas Christopoulos that converts markdown to groff / troff man, mdoc, mm, mom documents. A buffer error vulnerability exists in md2roff version 1.7, which is caused by a stack-based buffer overflow in Markdown files containing a large number of consecutive...

GitHub: DoS via markdown API from unauthenticated user

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the...

Stored Cross-Site Scripting vulnerability in Recipe Instructions allows Admin session hijacking

Description A low privilege user can insert malicious JavaScript code into the Recipe Instructions which will execute in another person's browser that visits the recipe. Proof of Concept Reproduction Steps: 1. As a lower privileged user login to the Mealie web application. 2. Create a recipe and...

Malicious code in dx-devsite-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94d8e93f1fe2cd310bb5359e393df7bf057fae4e9a8bdb71bbcf18dbebb8d5d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2631 Malicious code in dx-devsite-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94d8e93f1fe2cd310bb5359e393df7bf057fae4e9a8bdb71bbcf18dbebb8d5d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-85Q9-7467-R53Q XSS Vulnerability in Markdown Editor

Impact InvenTree uses EasyMDE for displaying markdown text in various places e.g. for the various "notes" fields associated with various models. By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the use...

XSS Vulnerability in Markdown Editor

Impact InvenTree uses EasyMDE for displaying markdown text in various places e.g. for the various "notes" fields associated with various models. By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the use...

npm markdown-link-extractor denial-of-service vulnerability

npm markdown-link-extractor is used to extract links from Markdown text. npm markdown-link-extractor versions prior to 3.0.2 and 4.0.0 contain a denial of service vulnerability that stems from not properly handling incoming error messages, which could be exploited by an attacker to cause a denial...

GHSA-MMH6-M7V9-5956 Regular expression denial of service in markdown-link-extractor

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

Regular expression denial of service in markdown-link-extractor

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

npm markdown-link-extractor 安全漏洞

npm markdown-link-extractor is used to extract links from Markdown text. npm markdown-link-extractor versions prior to 3.0.2 and 4.0.0 contain a denial of service vulnerability that stems from not properly handling incoming error messages, which could be exploited by an attacker to cause a denial...

CVE-2021-43308

CVE-2021-43308 affects the npm package markdown-link-extractor . The vulnerability is an exponential ReDoS that can be triggered by attacker-supplied input to the module’s exported function, with specifics citing an insecure regex pattern used for the image parameter. Public details describe a Do...