5425 matches found
@arakoodev/edgechains.js (>=0.25.0, <=0.30.1), @barnas2/polymer (1.0.0) +815 more potentially affected by CVE-2015-8854 via marked (>=0.0.1, <=0.3.3)
marked NPM version =0.0.1, =0.25.0, =0.0.1, =0.0.0, =0.1.0, =2.0.5, =2.0.1, =26.0.1, =34.4.5 and more Source cves: CVE-2015-8854 Source advisory: OSV:GHSA-HJCP-J389-59FF...
@arakoodev/edgechains.js (>=0.25.0, <=0.30.1), @barnas2/polymer (1.0.0) +745 more potentially affected by CVE-2015-1370 via marked (>=0.0.1, <=0.3.2)
marked NPM version =0.0.1, =0.25.0, =0.0.1, =0.1.0, =2.0.1, =26.0.1, =0.5.0, =0.7.1 - @qsb-cli-test/command 1.0.10 and more Source cves: CVE-2015-1370 Source advisory: OSV:GHSA-CFJH-P3G4-3Q2F...
CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
UBUNTU-CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
Cross site scripting
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
DEBIAN-CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
CVE-2016-10515
CVE-2016-10515 affects Redmine prior to 3.2.3, with stored XSS in Textile and Markdown text formatting and project homepages. The root cause is stored cross-site scripting in user-supplied formatting that can be persisted in pages rendered by Redmine. Affected software is Redmine (versions before...
CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
GitLab -- multiple vulnerabilities
GitLab reports: Cross-Site Scripting XSS vulnerability in the Markdown sanitization filter Yasin Soliman via HackerOne reported a Cross-Site Scripting XSS vulnerability in the GitLab markdown sanitization filter. The sanitization filter was not properly stripping invalid characters from URL schem...
Rocket.Chat: Remote Code Execution in Rocket.Chat Desktop
Summary: The Markdown parser can be tricked into allowing arbitrary Javascript leading to "remote code execution". Description: By combining the "link" and inline code block we can trick the parser into breaking out of the current HTML attribute. This allows us to control other attributes of the...
Marp vulnerable to improper access control in JavaScript execution
Overview Marp is a tool to create a presentation PDF with Markdown. Marp executes JavaScript inside the Markdown contents. Marp allows JavaScript to access local resources and files CWE-284. Keitaro Yamazaki of Kyoto University reported this vulnerability to IPA. JPCERT/CC coordinated with the...
Cross-site Scripting (XSS)
erusev/parsedown is vulnerable to cross-site scripting XSS attacks. The library does not do any filtering or sanitization before parsing markdown, allowing a malicious user to inject and execute arbitrary web script...
Automattic: [app.simplenote.com] Stored XSS via Markdown SVG filter bypass
Hi, A carefully crafted injection used against the Markdown input parser can be leveraged to store and execute arbitrary JavaScript in the app.simplenote.com context. Proof of concept Before proceeding to reproduce this vulnerability, please log in to app.simplenote.com and create a new note with...
GitLab: [Markdown] Stored XSS via character encoding parser bypass
Hi @briann and team, A carefully crafted injection used against the Markdown input parser can be leveraged to store and execute arbitrary JavaScript on GitLab 10.0 hosts. Given the nature of this injection, which makes use of a rather esoteric filter bypass, the scope for exploitation may vary...
Regular Expression Denial Of Service (ReDoS)
marked is vulnerable to regular expression denial of service ReDoS attacks. An attacker can pass a markdown file to the library that when parsed can cause the system to slowdown and cause a ReDoS...