660 matches found
CVE-2021-43861 Incorrect sanitisation function leads to `XSS`
Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 t...
PT-2021-23984 · Mermaid · Mermaid
Name of the Vulnerable Software and Affected Versions: Mermaid versions prior to 8.13.8 Description: Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Malicious diagrams can run javascript...
Mermaid 安全漏洞
Mermaid is a software application. Create charts and visualizations using text and code. A security vulnerability exists in versions prior to Mermaid 8.13.8, which can be exploited by an attacker to run javascript code via a malicious chart on the machine reading the chart...
3d-emoji (>=2.1.0 <=2.3.0), 6thbridge-hexa-docs (=0.0.1) +3199 more potentially affected by CVE-2021-35513 via mermaid (>=0.2.16 <=8.10.1)
mermaid NPM version =0.2.16, =2.1.0, =0.1.0, =1.4.8, =0.1.0, =0.0.1, =0.18.0-beta.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =1.0.3, =2.13.43, =2.13.43, =2.13.94 and more Source cves: CVE-2021-35513 Source advisory: OSV:GHSA-4F6X-49G2-99FM...
Cross-site Scripting in Mermaid
Mermaid before 8.11.0 allows XSS when the antiscript feature is used...
GHSA-4F6X-49G2-99FM Cross-site Scripting in Mermaid
Mermaid before 8.11.0 allows XSS when the antiscript feature is used...
The vulnerability of Mermaid software for generating diagrams and block diagrams lies in the lack of measures taken to protect the structure of web pages, allowing attackers to compromise data integrity.
The vulnerability of Mermaid software for generating diagrams and block diagrams is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of data...
CVE-2021-22242
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
Cross site scripting
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
UBUNTU-CVE-2021-22242
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
CVE-2021-22242
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
CVE-2021-22242
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
CVE-2021-22242
Removed by vendor...
CVE-2021-22242
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...
CVE-2021-22242
CVE-2021-22242 affects GitLab CE/EE versions 11.4 and later, due to insufficient input sanitization in Mermaid markdown, enabling stored cross-site scripting when processing crafted Markdown. The issue is consistently documented across NVD, OSV, and vendor/Tenable reports (GitLab CVE entry and OS...
PT-2021-6533 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.4 and up Description: The issue is related to insufficient input sanitization in Mermaid markdown, allowing a remote attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown. Th...
GitLab 跨站脚本漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to view a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab CE/EE...
GitLab: Stored XSS via Mermaid Prototype Pollution vulnerability
Summary I am continue investigating 1106238 and found additional vector for prototype pollution and stored xss. Steps to reproduce 1. Create an issue in any repository 2. Create mermaid diagram with following payload: %%init: 'proto': 'template': '' %% %%init: 'proto': 'template': '' %%...
Mermaid Cross-Site Scripting Vulnerability
Mermaid is a Javascript-based drawing tool that uses a Markdown-like syntax to allow users to easily and quickly create diagrams from code.A cross-site scripting vulnerability exists in versions of Mermaid prior to 8.11.0 when using antiscript features. No details of the vulnerability are current...