PT-2017-10764 · Rocket.Chat · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 0.8.0 and newer Description: The issue concerns an XSS vulnerability in the markdown link parsing code for messages. Recommendations: For Rocket.Chat versions 0.8.0 and newer, at the moment, there is no information about ...

Flexport year in Hackerone is report 6 an interesting vulnerability-vulnerability warning-the black bar safety net

! A year ago the Internet freight forwarders company Flexport in order to improve its customer data security, with our HackerOne platform to establish a cooperative relationship. HackerOne as a global well-known bug Bounty gold one, allowing all the security enthusiasts and professional penetrati...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

DEBIAN-CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs, enabling potential HTML injection when rendering user-provided content. Affected: markdown-it versions prior to 4.1.0. Root cause: failure to block data: URLs in the rendering process. Impact: authoring or rendering content could lead to uninten...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2017-9337

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...

Cross site scripting

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...

WordPress Markdown on Save Improved Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.Markdown on Save Improved is one of the editor plugin. A cross-site scripting vulnerability exists in the posting...

Cross-site Scripting (XSS)

github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The library does not sanitize markdown before rendering it, allowing an attacker to execute arbitrary code via markdown comments...

Cross-site Scripting (XSS)

github.com/koding/koding is susceptible to cross-site scripting XSS attacks. It happens because markdown display is not properly encoded to prevent XSS attack...

Dropbox: Dropbox Paper - Markdown XSS

Hello, Today I took a look at Dropbox Paper and noticed there is an option to export/download the project as a Markdown or word docx document. I noticed it doesn't filter any kind of Markdown escaping, meaning when parsed after download will let us execute client side code. equivallent to arbrita...

WordPress WP Markdown Editor Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in version 2.0.3 of WordPress's WP Markdown editor aka wp-markdown-editor, which...

Epiceditor – Cross-Site Scripting（CVE-2017-6589）

EpicEditor Introduction EpicEditor is an embeddable JavaScript Markdown editor with split fullscreen editing, live previewing, automatic draft saving, offline support, and more. For developers, it offers a robust API, can be easily themed, and allows you to swap out the bundled Markdown parser wi...

WP Markdown Editor 2.3.0 - Authenticated "Self" Cross-Site Scripting (XSS)

An Author user could be exploited by use of "self" XSS. This usually requires social engineering and user interaction...

Cross-site Scripting (XSS)

Overview marked is a markdown parser and compiler used for rendering markdown content to html. Affected versions of the package allowed the use of data: URIs for all mime types by default potentially opening a door for Cross-site Scripting XSS attacks. Data URIs enable embedding small files in li...

Discourse: XSS Vulnerability on Image link parser

I found a XSS Cross-Site Scripting vulnerability, and it is present in the markdown parser when it tries to parse an image URL. To reproduce the vulnerability you need to add a fake image url like: http://host/path/to/image'onerror=alert1;//.png As you can see, we have an invalid image URL which...

CVE-2016-4812

Cross-site scripting XSS vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-4812

Cross-site scripting XSS vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...