PT-2021-3541 · Redcarpet +1 · Redcarpet +1

Name of the Vulnerable Software and Affected Versions: Redcarpet versions prior to 3.5.1 Description: The issue is related to incorrect input sanitization in the Redcarpet library, which can enable a cross-site scripting attack. This is due to the lack of HTML escaping when processing quotes, eve...

CVE-2020-26298

CVE-2020-26298 affects the Redcarpet Ruby gem (rubygem-redcarpet) prior to 3.5.1, where HTML escaping was not performed for quotes, enabling a cross-site scripting (XSS) vector. The issue is fixed in version 3.5.1 (via the referenced commit); upgrading to 3.5.1 or newer mitigates the vulnerabilit...

CVE-2020-26298

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...

Cross-site Scripting (XSS)

redcarpet is vulnerable to cross-site scripting XSS. It does not prevent rewinding of content of a previous inline when autolinking is used, allowing an attacker to inject arbitrary script via untrusted markdown...

redcarpet Buffer Overflow vulnerability

Stack-based buffer overflow in the headeranchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

GHSA-7322-9MX6-5J2M redcarpet Buffer Overflow vulnerability

Stack-based buffer overflow in the headeranchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

roxysploit - Penetration Testing Suite

roxysploit is a community-supported, open-source and penetration testing suite that supports attacks for numerous scenarios. conducting attacks in the field. Some containing Plugins in roxysploit Scan is a automated Information gathering plugin it gives the user the ability to have a rest while t...

CVE-2015-5147

Stack-based buffer overflow in the headeranchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

CVE-2015-5147

Stack-based buffer overflow in the headeranchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

Stack overflow

Stack-based buffer overflow in the headeranchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

CVE-2015-5147

Stack-based buffer overflow in the headeranchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

CVE-2015-5147

The CVE covers Redcarpet’s HTML renderer, where the header_anchor function contains a stack-based buffer overflow introduced before version 3.3.2. This flaw can cause a crash (DoS) and may allow arbitrary code execution via unspecified vectors. The vulnerability affects the header_anchor path in ...

CVE-2015-5147

Stack-based buffer overflow in the headeranchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

redcarpet stack buffer overflow vulnerability

redcarpet is a Markdown a markup language that can be written in a normal text editor HTML parser developed by software developer Vicent Marti. A stack buffer overflow vulnerability exists in redcarpet. This could allow an attacker to execute arbitrary code within the context of the application o...

redcarpet Gem for Ruby html.c header_anchor() Function Stack Overflow

redcarpet Gem for Ruby contains a flaw that allows a stack overflow. This flaw exists because the headeranchor function in html.c uses variable length arrays VLA without any range checking. This may allow a remote attacker to execute arbitrary code...

FreeBSD : rubygem-redcarpet -- XSS vulnerability (c368155a-fa83-11e4-bc58-001e67150279)

Daniel LeCheminant reports : When markdown is being presented as HTML, there seems to be a strange interaction between and @ that lets an attacker insert malicious tags. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

MGASA-2015-0206 Updated ruby-redcarpet packages fix a security vulnerability

Updated ruby-redcarpet packages fix security vulnerability: Redcarpet allows for possible XSS of untrusted markdown if the autolink extension is enabled...

Updated ruby-redcarpet packages fix a security vulnerability

Updated ruby-redcarpet packages fix security vulnerability: Redcarpet allows for possible XSS of untrusted markdown if the autolink extension is enabled...

rubygem-redcarpet -- XSS vulnerability

Daniel LeCheminant reports: When markdown is being presented as HTML, there seems to be a strange interaction between and @ that lets an attacker insert malicious tags...

HackerOne: Improper filtering of classes used in codeblocks in Markdown

Redcarpet just uses the name of the language as the classname of the element. So if the classnames are of significance to the site, one can break the site using this. For instance, this report disables the topbar, and can trigger the user into opening a popup. Proof of concept: js-topbar i eat th...