Cross-site Scripting (XSS)

jingo is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of proper defaults, allowing all HTML to be rendered in markdown by default, causing XSS attacks...

Denial of Service

Overview All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

GitLab CE/EE Information Disclosure Vulnerability (CNVD-2018-26954)

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing a project's file contents, commit history, bug lists, and more. An information disclosure...

CVE-2018-17975

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

CVE-2018-17975

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

Design/Logic Flaw

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

CVE-2018-17975

CVE-2018-17975 affects GitLab Community Edition 11.x prior to 11.1.8, 11.2.x prior to 11.2.5, and 11.3.x prior to 11.3.2. The root issue is Information Exposure via the GitLab Flavored Markdown (GFM) API, which can disclose confidential data (e.g., issue titles and private snippet titles) due to ...

Node.js third-party modules: [harp] Unsafe rendering of Markdown files

I would like to report Cross Site Scripting vulnerablity in harp module It allows to execute arbitrary JavaScript due to unsafe rendering of markdown files. Similar to 404126 Module module name: harp version: 0.29.0 npm page: https://www.npmjs.com/package/harp Module Description zero-configuratio...

fairing (>=0.0.2 <=0.0.3), hugo-jupyter (>=0.2.1 <=0.3.0) +6 more potentially affected by CVE-2018-19351 via notebook (>=4.2.3 <=5.7.0)

notebook PYPI version =4.2.3, =0.0.2, =0.2.1, =0.1.2, =0.5.0, =1.0.0, =0.1.0, =0.2.0.dev1 Source cves: CVE-2018-19351 Source advisory: OSV:GHSA-49QR-XH3W-H436...

The Incident Response Tracking Application: DFIRTrack

DFIRTrack Digital Forensics and Incident Response Tracking application is an open source web application mainly based on Django using a PostgreSQL database backend. In contrast to other great incident response tools, which are mainly case-based and support the work of CERTs, SOCs etc. in their...

fairing (>=0.0.2 <=0.0.3), hugo-jupyter (>=0.2.1 <=0.3.0) +6 more potentially affected by CVE-2018-19351 via notebook (>=4.2.3 <=5.7.0)

notebook PYPI version =4.2.3, =0.0.2, =0.2.1, =0.1.2, =0.5.0, =1.0.0, =0.1.0, =0.2.0.dev1 Source cves: CVE-2018-19351 Source advisory: OSV:PYSEC-2018-17...

[SECURITY] Fedora 28 Update: python-markdown2-2.3.6-1.fc28

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

[SECURITY] Fedora 29 Update: python-markdown2-2.3.6-1.fc29

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

FreeBSD : Gitlab -- multiple vulnerabilities (23413442-c8ea-11e8-b35c-001b217b3468)

Gitlab reports : Merge request information disclosure Private project namespace information disclosure Gitlab Flavored Markdown API information disclosure C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

[SECURITY] [DSA 4293-1] discount security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4293-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini September 14, 2018 https://www.debian.org/security/faq -...

Debian DLA-1499-1 : discount security update

Several heap-based buffer over-reads were found in discount, an implementation of the Markdown markup language in C, that allowed remote attackers to cause a denial of service via specially crafted files. For Debian 8 'Jessie', these problems have been fixed in version 2.1.7-1+deb8u1. We recommen...

@bndynet/bbootstrap (>=1.0.2 <=2.2.1), @bndynet/jslib (>=1.0.52 <=2.0.0) +8 more potentially affected by CVE-2018-16330 via editor.md (=1.5.0)

editor.md NPM version =1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on editor.md and may be impacted: - @bndynet/bbootstrap =1.0.2, =1.0.52, =2.3.6, =1.0.0, =0.2.0, =0.1.1, =0.1.0, =1.0.0, =1.0.3 Source cves: CVE-2018-16330 Source advisory:...

[SECURITY] Fedora 28 Update: discount-2.2.4-1.fc28

DISCOUNT is an implementation of John Gruber's Markdown language in C. It includes all of the original Markdown features, along with a few extensions, and passes the Markdown test suite...

[SECURITY] Fedora 28 Update: ghc-hakyll-4.10.0.0-3.fc28

Hakyll is a static website compiler library. It provides you with the tools to create a simple or advanced static website using a Haskell DSL and formats such as markdown or RST. You can find more information, including a tutorial, on the website:...

Cross site scripting

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature...