PT-2023-29863 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.3 Discourse versions prior to 3.2.0.beta3 Description: Discourse is an open source platform for community discussion. The issue affects the availability of subsequent replies in a topic when users can add svgs...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Enterprise Edition EE and Community Edition CE. A malicious party could exploit vulnerabilities to bypass command measures, gain access to system data or cause a denial-of-service cause. Also included in this update are updates to several Third-party...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the insufficient input sanitization in Mermaid markdown of the library, allowing an attacker to inject and execute malicious javascript...

CVE-2020-21058

Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax...

CVE-2020-21058

Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax...

Cross site scripting

Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax...

CVE-2020-21058

Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax...

CVE-2020-21058

Typora v0.9.79 has a Cross‑Site Scripting (XSS) vulnerability that allows a remote attacker to execute arbitrary code via the mermaid syntax. The connected sources confirm Typora is affected, but do not provide exploitation details, affected versions beyond 0.9.79, or a remediation/patch. Informa...

Typora 跨站脚本漏洞

Typora is an editor. A security vulnerability exists in Typora version 0.9.79. An attacker can exploit the vulnerability to execute arbitrary code via mermaid syntax...

CVE-2020-21058

Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax...

Vulnerabilities fixed in Discourse

Vulnerabilities have been fixed in Discourse. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Access to system data When the "Mermaid" component is in use, there is also the possibility...

CVE-2022-46180

Discourse Mermaid discourse-mermaid-theme-component allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been...

Design/Logic Flaw

Discourse Mermaid discourse-mermaid-theme-component allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been...

CVE-2022-46180 Arbitrary HTML injection in discourse-mermaid-theme-component

Discourse Mermaid discourse-mermaid-theme-component allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been...

CVE-2022-46180 Arbitrary HTML injection in discourse-mermaid-theme-component

Discourse Mermaid discourse-mermaid-theme-component allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been...

CVE-2022-46180 Arbitrary HTML injection in discourse-mermaid-theme-component

Discourse Mermaid discourse-mermaid-theme-component allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been...

CVE-2022-46180

CVE-2022-46180 affects Discourse’s Mermaid-themed component: discourse-mermaid-theme-component v1.0.0 allows users who can create posts to inject arbitrary HTML into the post content due to the Mermaid integration. The issue has been fixed on the main branch, with 1.1.0 designated as the patched ...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A cross-site scripting vulnerability exists in Discourse discourse-mermaid-theme-component version 1.0.0, which can be exploited by an attacker to inject arbitrary HT...

PT-2023-14818 · Discourse · Discourse-Mermaid-Theme-Component +1

Name of the Vulnerable Software and Affected Versions: Discourse Mermaid discourse-mermaid-theme-component version 1.0.0 Description: The issue allows users who can create posts to inject arbitrary HTML on that post, using the Mermaid syntax in Discourse, open-source forum software...

Improper Control of Generation of Code ('Code Injection') in mdx-mermaid

Impact Arbitary javascript injection Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs + function // Put Javascript code here return '' + The block below shows a valid mermaid code block md mermaid graph TD; A--B; A--C;...