Stored XSS Via Markdown payload at HackerOne Settings

Description Rengine supports automatic vulnerability reporting to hackerone the module included a feature to customize the report using a markdown editor. Although it was blocking some malicious payloads, the Cross-Site Scripting was found exploitable via a special payload. Proof of Concept 1. Go...

CVE-2022-28101

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

CVE-2022-28101

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

CVE-2022-28101

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

Lyon Bros Turtlapp Turtle Note 跨站脚本漏洞

Lyon Bros Turtlapp Turtle Note is a secure, collaborative notebook from Lyon Bros. Use it to save notes, bookmarks, passwords, ideas, dream journals, photos, documents and anything else you want to keep safe. A security vulnerability exists in Turtlapp Turtle Note version v0.7.2.6, which stems fr...

CVE-2022-28101: Improper Neutralization of Input During Web Page Generation

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

Wire cross-site scripting vulnerability (CNVD-2022-31755)

Wire is a chat program from the German company Wire. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original way of saying hello, PING. A cross-site scripting vulnerability exists in the Wire webapp, which stems fr...

CVE-2022-24799 Cross Site Scripting in Wire Webapp

wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious...

CVE-2022-24799: Improper Neutralization of Input During Web Page Generation

wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious...

Wire 跨站脚本漏洞

Wire is a chat program from the German company Wire. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original way of saying hello, PING. A cross-site scripting vulnerability exists in the Wire webapp, which stems fr...

CVE-2022-24837 Enumerable upload file names in hedgedoc

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes an...

CVE-2022-24837

The CVE-2022-24837 entry corresponds to HedgeDoc: images uploaded since v1.9.1 generate enumerable filenames, enabling potential information leakage from private notes across all upload backends (except Lutim/imgur). The underlying issue is a predictable filename generation mechanism, which has b...

cmark-gfm Integer overflow Exploit

cmark-gfm, Github's markdown parsing library, is vulnerable to an out-of-bounds write when parsing markdown tables with a high number of columns due to an overflow of the 16bit columns count. cmark-gfm: Integer overflow in table extension cmark-gfm Github's markdown parsing library is vulnerable ...

JetBrains YouTrack Cross-Site Scripting Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. The software features bug tracking, creating workflows and monitoring project progress.JetBrains YouTrack 2022.1.43700 previously contained a security vulnerability that could be...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28650

JetBrains YouTrack before 2022.1.43700 is affected by a cross-site scripting issue that enables an attacker to inject JavaScript into Markdown in the YouTrack Classic UI. This CVE is corroborated by multiple records (e.g., Red Hat, CNVD, CVE listings) describing the same vulnerability. The availa...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28650: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...