DEBIAN-CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs, enabling potential HTML injection when rendering user-provided content. Affected: markdown-it versions prior to 4.1.0. Root cause: failure to block data: URLs in the rendering process. Impact: authoring or rendering content could lead to uninten...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

PT-2017-6658

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 4.1.0 Description The issue concerns markdown-it not blocking data: URLs. Recommendations For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue...

CVE-2015-3295: Improper Access Control

markdown-it before 4.1.0 does not block data: URLs...

Cross site scripting

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...

CVE-2017-9337

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...

CVE-2017-9337: Improper Neutralization of Input During Web Page Generation

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post...

PT-2017-18852

Name of the Vulnerable Software and Affected Versions Markdown on Save Improved plugin version 2.5 for WordPress Description The issue is related to a stored XSS vulnerability in the content of a post. Recommendations For Markdown on Save Improved plugin version 2.5, update to a newer version tha...

WordPress Markdown on Save Improved Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.Markdown on Save Improved is one of the editor plugin. A cross-site scripting vulnerability exists in the posting...

Cross-site Scripting (XSS)

github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The library does not sanitize markdown before rendering it, allowing an attacker to execute arbitrary code via markdown comments...

Cross-site Scripting (XSS)

github.com/koding/koding is susceptible to cross-site scripting XSS attacks. It happens because markdown display is not properly encoded to prevent XSS attack...

Dropbox: Dropbox Paper - Markdown XSS

Hello, Today I took a look at Dropbox Paper and noticed there is an option to export/download the project as a Markdown or word docx document. I noticed it doesn't filter any kind of Markdown escaping, meaning when parsed after download will let us execute client side code. equivallent to arbrita...

WordPress WP Markdown Editor Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in version 2.0.3 of WordPress's WP Markdown editor aka wp-markdown-editor, which...

WP Markdown Editor 2.3.0 - Authenticated "Self" Cross-Site Scripting (XSS)

An Author user could be exploited by use of "self" XSS. This usually requires social engineering and user interaction...

Epiceditor – Cross-Site Scripting（CVE-2017-6589）

EpicEditor Introduction EpicEditor is an embeddable JavaScript Markdown editor with split fullscreen editing, live previewing, automatic draft saving, offline support, and more. For developers, it offers a robust API, can be easily themed, and allows you to swap out the bundled Markdown parser wi...

Cross-site Scripting (XSS)

Overview marked is a markdown parser and compiler used for rendering markdown content to html. Affected versions of the package allowed the use of data: URIs for all mime types by default potentially opening a door for Cross-site Scripting XSS attacks. Data URIs enable embedding small files in li...

Discourse: XSS Vulnerability on Image link parser

I found a XSS Cross-Site Scripting vulnerability, and it is present in the markdown parser when it tries to parse an image URL. To reproduce the vulnerability you need to add a fake image url like: http://host/path/to/image'onerror=alert1;//.png As you can see, we have an invalid image URL which...

PT-2016-5526

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4, 12.1.0.1, and 12.1.0.2 Oracle Retail Xstore Point of Service versions 5.5, 6.0, 6.5, 7.0, 7.1, 15.0, and 16.0 Oracle Retail Warehouse Management System versions 14.04, 14.1.3, and 15.0.1 Oracle Retail...