6127 matches found
Cross-Site Scripting in simple-markdown
Versions of simple-markdown prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encoded...
@anzeblabla/react-native-markdown-editor (>=1.0.3, <=2.1.1), @gorangajic/react-native-markdown (0.1.1) +22 more potentially affected by CVE-2019-9844 via simple-markdown (>=0.0.9, <=0.4.2)
simple-markdown NPM version =0.0.9, =1.0.3, =1.3.0, =1.0.1, =1.0.4, =2.3.0, =0.1.0, =1.2.0, =2.4.0, =1.2.0, =1.1.0, =1.0.0, =1.10.0 and more Source cves: CVE-2019-9844 Source advisory: OSV:GHSA-QJ3F-9GMQ-FWV5...
GHSA-QJ3F-9GMQ-FWV5 Cross-Site Scripting in simple-markdown
Versions of simple-markdown prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encoded...
Cross-Site Scripting (XSS)
simple-markdown is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via Data or Vbscript URIs, e.g data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGknKTwvc2NyaXB0Pg==...
CVE-2019-9844
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
CVE-2019-9844
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
[SECURITY] Fedora 30 Update: nodejs-simple-markdown-0.4.4-1.fc30
simple-markdown is a markdown-like parser designed for simplicity and extensibility...
GitLab: Stored XSS in Wiki pages
Summary I found Stored XSS using Wiki-specific Hierarchical link Markdown in Wiki pages. Steps to reproduce 1. Sign in to GitLab. 2. Open a Project page that you have permission to edit Wiki pages. 3. Open Wiki page. 4. Click "New page" button. 5. Fill out "Page slug" form with javascript:. 6...
Mail.ru: LRF on shared.mail.ru due to "markdown" plugin
Markdown plugin in Atlassian Jira instance for external contractors was vulnerable to LFR vulnerability...
simple-markdown cross-site scripting vulnerability
simple-markdown is a simple, extensible Markdown-like parser . A cross-site scripting vulnerability exists in simple-markdown.js in Khan Academy simple-markdown versions prior to 0.4.4. The vulnerability can be exploited to conduct cross-site scripting attacks via the data: or vbscript: URI...
CVE-2019-9844
CVE-2019-9844 affects the Node package simple-markdown (Khan Academy’s simple-markdown) up to version 0.4.3. The vulnerability is a Cross‑Site Scripting (XSS) flaw caused by insufficient input sanitization in links, enabling execution of malicious JavaScript via data: or VBScript: URIs. The issue...
CVE-2019-9844
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
PT-2019-19892
Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.4.4 Description The issue is related to insufficient input sanitization, which allows Cross-Site Scripting XSS attacks. This can be exploited through input of links containing data or vbscript URIs and a...
Design/Logic Flaw
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...
CVE-2019-9785
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...
CVE-2019-9785
CVE-2019-9785 affects gitnote 3.1.0. A crafted Markdown file can cause remote code execution via a malicious onerror attribute in an IMG element that invokes javascript:window.parent.top.require('child_process').execFile. This exposes arbitrary code execution if a renderer processes the Markdown ...
CVE-2019-9785
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...
PT-2019-19871
Name of the Vulnerable Software and Affected Versions gitnote version 3.1.0 Description The issue allows remote attackers to execute arbitrary code via a crafted Markdown file. This can be achieved by including a specific substring in the onerror attribute of an IMG element, such as...
CVE-2019-9785: Improper Neutralization of Special Elements used in an OS Command
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...