Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting Exploit Title: Persistent XSS via Markdown on Telescope = 0.9.2 Date: Aug 22 2014 Exploit Author: shubs Vendor Homepage: http://www.telescopeapp.org/ Software Link: https://github.com/TelescopeJS/Telescope Version: = 0.9.2 CVE :...

Vulnerability analysis: a Markdown parser's persistent XSS Vulnerability, CVE-2 0 1 4-5 1 4 4-a vulnerability warning-the black bar safety net

What is the Markdown? a Markdown is a lightweight markup language, the popularity has got GitHub and Stack Overflow broad support, as ordinary people we can also easily get started. Use markdown to write articles very much like those trivial HTML tag can be behind without the tube. The last 5...

HackerOne: Markdown code block sequence makes report unreadable

Proof of Concept Submitting a report/comment with an input like the following "Three backticks followed by a newline followed by -ddd/d" will cause the report to be unreadable I think it's because the parser is crashing? The attached file includes the input that I'm trying with difficulty to...

HackerOne: In markdown, parsing things like @danlec and #46072 after links is unsafe

Let me preface this by saying that I haven't worked out an actual exploit for this, and there may not be one, but when 46072 is disclosed, folks will probably be taking a closer look at HackerOne's markdown parsing and may find a way to turn this bug into something It looks like the links for...

CVE-2014-8683 XSS in Gogs Markdown Renderer

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 XSS in Gogs Markdown Renderer ============================= Researcher: Timo Schmid [email protected] Description =========== GogsGo Git Service is a painless self-hosted Git Service written in Go. taken from 1 It is very similiar to the github...

PT-2014-8683 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.3.1-9 through 0.5.x before 0.5.8 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the text parameter to the...

Gogs Markdown Renderer Cross Site Scripting Vulnerability

Gogs markdown renderer suffers from a cross site scripting vulnerability. Versions 0.3.1-9-g49dc57e are affected. XSS in Gogs Markdown Renderer ============================= Researcher: Timo Schmid Description =========== GogsGo Git Service is a painless self-hosted Git Service written in Go. tak...

Gogs Markdown Renderer Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 XSS in Gogs Markdown Renderer ============================= Researcher: Timo Schmid Description =========== GogsGo Git Service is a painless self-hosted Git Service written in Go. taken from 1 It is very similiar to the github hosting plattform...

Arachni Web Application Scanner Web UI - Persistent Cross-Site Scripting

Arachni Web Application Scanner Web UI - Persistent Cross-Site Scripting Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability CVE: 2014-5469 Vendor Homepage: http://www.arachni-scanner.com/ Author: Prakhar Prasad Author Homepage: https://prakharprasad.com Reference:...

Arachni Web Application Scanner Web UI - Stored XSS Vulnerability

Exploit for multiple platform in category web applications Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability CVE: 2014-5469 Vendor Homepage: http://www.arachni-scanner.com/ Author: Prakhar Prasad Author Homepage: https://prakharprasad.com Reference:...

Arachni Web Application Scanner 0.4.7 Cross Site Scripting

Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability CVE: 2014-5469 Vendor Homepage: http://www.arachni-scanner.com/ Author: Prakhar Prasad Author Homepage: https://prakharprasad.com Reference: https://github.com/Arachni/arachni-ui-web/issues/71 Affected Version: Arachni...

HackerOne: Improper filtering of classes used in codeblocks in Markdown

Redcarpet just uses the name of the language as the classname of the element. So if the classnames are of significance to the site, one can break the site using this. For instance, this report disables the topbar, and can trigger the user into opening a popup. Proof of concept: js-topbar i eat th...

RubyGems 'md2pdf'远程命令注入漏洞(CVE-2013-1948)

BUGTRAQ ID: 59061 CVECAN ID: CVE-2013-1948 md2pdf是将Markdown文档转换为PDF文档的软件。 md2pdf converter.rb中的用户输入，没有经过过滤即传递给命令行，攻击者可利用此漏洞在受影响应用中执行任意命令。 0 rubygems md2pdf 厂商补丁： rubygems -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://rubygems.org/gems/md2pdf...

Design/Logic Flaw

Unspecified vulnerability in the Retail - Oracle Retail Markdown Optimization component in Oracle Industry Product Suite 13.1 allows remote attackers to affect integrity via unknown vectors related to Online Help...

CVE-2010-0862

Unspecified vulnerability in the Retail - Oracle Retail Markdown Optimization component in Oracle Industry Product Suite 13.1 allows remote attackers to affect integrity via unknown vectors related to Online Help...

CVE-2010-0862

The CVE-2010-0862 entry concerns Oracle Industry Product Suite 13.1, specifically the Retail - Oracle Retail Markdown Optimization component. It describes an unspecified vulnerability that could allow remote attackers to affect integrity via unknown vectors related to Online Help. The threat cont...

CVE-2010-0862

Unspecified vulnerability in the Retail - Oracle Retail Markdown Optimization component in Oracle Industry Product Suite 13.1 allows remote attackers to affect integrity via unknown vectors related to Online Help...

[SECURITY] Fedora 11 Update: python-markdown2-1.0.1.15-1.fc11

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

[SECURITY] Fedora 10 Update: python-markdown2-1.0.1.15-1.fc10

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

CVE-2009-3437

Cross-site scripting XSS vulnerability in the live preview feature in the Markdown Preview module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via "Markdown input."...