Design/Logic Flaw

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

CVE-2017-1000491

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

CVE-2017-1000491

CVE-2017-1000491 affects the Shiba markdown live preview app, version 1.1.0, with a cross-site scripting (XSS) vulnerability that can lead to code execution. The root cause is enabled Node.js integration in the app environment. Exploit specifics, affected platforms, and remediation are not provid...

CVE-2017-1000491

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

Design/Logic Flaw

Leanote version = 2.5 is vulnerable to XSS due to not sanitized input in markdown notes...

CVE-2017-1000459

Leanote version = 2.5 is vulnerable to XSS due to not sanitized input in markdown notes...

CVE-2017-1000459

Leanote version = 2.5 is vulnerable to XSS due to not sanitized input in markdown notes...

PT-2018-5226

Name of the Vulnerable Software and Affected Versions Leanote versions prior to 2.5 Description The issue arises from unsanitized input in markdown notes, leading to a potential XSS attack. Recommendations For versions prior to 2.5, update to a version that includes the fix for this issue. At the...

CVE-2017-1000459

Leanote

CVE-2017-1000459

Leanote version = 2.5 is vulnerable to XSS due to not sanitized input in markdown notes...

CVE-2017-1000491: Improper Neutralization of Input During Web Page Generation

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

Leanote Cross-Site Scripting Vulnerability

Leanote is an open source notepad application. A cross-site scripting vulnerability exists in Leanote 2.5 and earlier versions, which stems from the program failing to filter input in markdown comments. A remote attacker can use this vulnerability to inject arbitrary web script or HTML...

Shiba Cross-Site Scripting Vulnerability

Shiba markdown live preview app is a Markdown text editor that supports live preview feature. A cross-site scripting vulnerability exists in version 1.1.0 of the Shiba markdown live preview app. A remote attacker can exploit this vulnerability to execute code...

CVE-2017-1000459: Improper Neutralization of Input During Web Page Generation

Leanote version = 2.5 is vulnerable to XSS due to not sanitized input in markdown notes...

PT-2018-5255

Name of the Vulnerable Software and Affected Versions Shiba markdown live preview app version 1.1.0 Description The issue allows for XSS, leading to code execution due to enabled node integration. Recommendations For version 1.1.0, disable node integration to prevent code execution until a patch ...

[SECURITY] Fedora 27 Update: python-mistune-0.8.3-1.fc27

The fastest markdown parser in pure Python, inspired by marked...

[SECURITY] Fedora 26 Update: python-mistune-0.8.3-1.fc26

The fastest markdown parser in pure Python, inspired by marked...

HackerOne: Markdown parsing issue enables insertion of malicious tags and event handlers

When markdown is being presented as HTML, there seems to be a strange interaction between and @ that lets an attacker insert malicious tags. Proof of Concept : hello is rendered converted to the following HTML: /http:hello As you can see, the output includes a /http:marquee tag that I can add...

Automattic: [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging Electron

Hi, A carefully crafted injection in the Markdown parser within Simplenote for Windows can be leveraged to achieve remote code execution via an external JavaScript file. The nature of Simplenote's content sharing system, which makes use of tags containing email addresses, means that an adversary...

Home Assistant Cross-Site Scripting Vulnerability

Home Assistant is an open source platform for automated management of home network devices. A cross-site scripting vulnerability exists in versions of Home Assistant prior to 0.57. A remote attacker can exploit this vulnerability to inject JavaScript code via specially crafted Markdown text...