5425 matches found
CVE-2018-14601
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2. A Denial of Service can occur because Markdown rendering times are slow...
CVE-2018-14601
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2. A Denial of Service can occur because Markdown rendering times are slow...
CVE-2018-14601
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2. A Denial of Service can occur because Markdown rendering times are slow...
CVE-2018-14601
GitLab CE/EE 11.1.x prior to 11.1.2 is affected by a Denial of Service caused by slow Markdown rendering. Affected component is Markdown rendering in GitLab 11.1.x (Community and Enterprise Editions). The issue enables an attack with network access to trigger DoS, with the documented impact of pa...
CVE-2018-14601
Removed by vendor...
GitLab CE and EE Denial of Service Vulnerabilities
GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. A denial-of-service...
FreeBSD : Gitlab -- multiple vulnerabilities (2da838f9-9168-11e8-8c75-d8cb8abf62dd)
Gitlab reports : Markdown DoS Information Disclosure Prometheus Metrics CSRF in System Hooks Persistent XSS Pipeline Tooltip Persistent XSS in Branch Name via Web IDE Persistent XSS in Branch Name via Web IDE C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
Gitlab -- multiple vulnerabilities
Gitlab reports: Markdown DoS Information Disclosure Prometheus Metrics CSRF in System Hooks Persistent XSS Pipeline Tooltip Persistent XSS in Branch Name via Web IDE Persistent XSS in Branch Name via Web IDE...
@absinthe/graphiql-workspace (>=1.1.4, <=1.1.5), @agilys/custom-graphiql (>=2.0.0-beta1, <=2.0.3) +1307 more potentially affected by CVE-2017-16114 via marked (>=0.0.1, <=0.3.7)
marked NPM version =0.0.1, =1.1.4, =2.0.0-beta1, =1.0.1, =0.25.0, =0.0.0-development, =3.3.1, =0.0.1, =0.0.0, =0.0.3 and more Source cves: CVE-2017-16114 Source advisory: OSV:GHSA-X5PG-88WF-QQ4P...
Cross-site Scripting (XSS)
markdown-pdf is vulnerable to cross-site scripting XSS attacks. The application does not properly sanitize user input, allowing a malicious user can pass a markdown file to the application to inject and execute arbitrary HTML code...
CVE-2018-3770
A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...
Path traversal
A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...
CVE-2018-3770
A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...
CVE-2018-3770
markdown-pdf versions prior to 9.0.0 are vulnerable to path traversal and potential remote code execution due to insufficient sanitization of HTML in Markdown files. Concrete details across multiple connected documents show that injecting malicious HTML can lead to reading local files and, in som...
CVE-2018-3770
A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...
PT-2018-16188 · Npm · Markdown-Pdf
Name of the Vulnerable Software and Affected Versions: markdown-pdf versions prior to 9.0.0 Description: A path traversal issue in markdown-pdf allows users to insert malicious HTML code, potentially resulting in the reading of local files. The package fails to sanitize HTML code in markdown file...
GHSA-P6H9-GW49-RQM4 markdown2 is vulnerable to cross-site scripting
An issue was discovered in markdown2 aka python-markdown2 through 2.3.5. The safemode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final character from...
Design/Logic Flaw
Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element...