CVE-2019-6784

Removed by vendor...

CVE-2019-6784

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 1 of 2. Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS...

PT-2019-18344

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.5.8 GitLab Community and Enterprise Edition versions 11.6.x prior to 11.6.6 GitLab Community and Enterprise Edition versions 11.7.x prior to 11.7.1 Description The issue allows for...

PT-2019-18343

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1 Description The issue allows for a persistent XSS due to a lack of input validation and output encoding when processing KaTeX in...

CVE-2019-6784: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 1 of 2. Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS...

CVE-2019-6785: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service. Inputting an overly long string into a Markdown field could cause a denial of service...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b68cc195-cae7-11e9-86e9-001b217b3468)

Gitlab reports : Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure Use...

GitLab: Uncontrolled Resource Consumption in any Markdown field using Mermaid

Summary I found a bypass for the mitigation of DoS via Mermaid CVE-2019-9220. As the mitigation for CVE-2019-9220, the input limit of 5000 characters is currently applied to a Mermaid code block, but it can be bypassed by simply splitting the longer payload to many code blocks. Steps to reproduce...

Stored XSS vulnerability in pegdown-formatter

pegdown-formatter uses the PegDown library to implement support for rendering Markdown formatted descriptions in Jenkins. It advertises disabling of HTML to prevent cross-site scripting XSS as a feature. pegdown-formatter does not prevent the use of javascript: scheme in URLs for links. This...

Editor.md Cross-Site Scripting Vulnerability (CNVD-2020-16530)

Editor.md is an open source embedded online Markdown a markup language editor. A cross-site scripting vulnerability exists in Editor.md version 1.5.0, which stems from the lack of proper validation of client-side data in a web application and can be exploited by an attacker to execute client-side...

Cross-site Scripting (XSS)

invenio-previewer is vulnerable to cross-site scripting XSS. It does not escape the user-uploaded file and directly render the file in the JSON, Markdown and iPython Notebook previewers, allowing an attacker to inject arbitrary Javascript into a victim's browser using a malicious file...

RANGER Studio Directus Cross-Site Scripting Vulnerability

RANGER Studio Directus is the United States RANGER Studio company's set of open source for managing custom databases open source headless CMS and API. A cross-site scripting vulnerability exists in the interfaces/markdown/input.vue file in RANGER Studio Directus version 7 prior to Application...

CVE-2019-13982

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

CVE-2019-13982

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

Code injection

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

CVE-2019-13982

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

PT-2019-13511

Name of the Vulnerable Software and Affected Versions Directus versions prior to 7.7.0 Description The issue concerns the rendering of Markdown text previews in the Directus 7 Application. Specifically, it does not properly sanitize Markdown text before rendering a preview, which could lead to...

CVE-2019-13982: Undefined Security Weakness

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

Cross-site Scripting in invenio-previewer

Cross-Site Scripting XSS vulnerability in JSON, Markdown and iPython Notebook previewers Impact Several Cross-Site Scripting XSS vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or...

GHSA-J9M2-6HQ2-4R3C Cross-site Scripting in invenio-previewer

Cross-Site Scripting XSS vulnerability in JSON, Markdown and iPython Notebook previewers Impact Several Cross-Site Scripting XSS vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or...