37 matches found
CVE-2026-104077
Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...
CVE-2026-104077
Obsidian Desktop versions before 1.14.0 are vulnerable to Remote Code Execution (RCE) via the Slides core plugin . The root cause is insufficient sanitization of the data-background-iframe attribute in Markdown notes, which allows attackers to bypass DOMPurify . This vulnerability is exploited wh...
EUVD-2026-95100
Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...
CVE-2026-104077 Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...
directus-preso
The reveal.js files for my presentation about my Directus bug...
CVE-2022-0776
Cross-site Scripting XSS - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0...
EUVD-2021-0976
Malware in sbrugna...
EUVD-2022-1442
Malicious code in bioql PyPI...
CVE-2020-8127
Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...
Yank Note 3.52.1 Arbitrary Code Execution
Exploit Title: Yank Note v3.52.1 Electron - Arbitrary Code Execution Date: 2023-04-27 Exploit Author: 8bitsec CVE: CVE-2023-31874 Vendor Homepage: yank-note.com Software Link: https://github.com/purocean/yn Version: 3.52.1 Tested on: Ubuntu 22.04 | Mac OS 13 Release Date: 2023-04-27 Product &...
Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Exploit Title: Yank Note v3.52.1 Electron - Arbitrary Code Execution Date: 2023-04-27 Exploit Author: 8bitsec CVE: CVE-2023-31874 Vendor Homepage: yank-note.com Software Link: https://github.com/purocean/yn Version: 3.52.1 Tested on: Ubuntu 22.04 | Mac OS 13 Release Date: 2023-04-27 Product &...
reveal.js Cross-Site Scripting Vulnerability (CNVD-2022-31829)
reveal.js is a framework for presentation building. reveal.js versions prior to 4.3.0 have a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output, which can be exploited by attackers to execute JavaScript code on the client side...
GHSA-HHQJ-CFJX-VJ25 Cross site scripting in reveal.js
The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute...
@asciidoctor/reveal.js (>=5.0.0-rc.1, <=5.0.1), hapi-reveal (4.0.0) +1 more potentially affected by CVE-2022-0776 via reveal.js (>=4.0.2, <=4.2.1)
reveal.js NPM version =4.0.2, =5.0.0-rc.1, =4.0.0-beta.0, =5.3.2 Source cves: CVE-2022-0776 Source advisory: OSV:GHSA-HHQJ-CFJX-VJ25...
Cross site scripting in reveal.js
The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute...
CVE-2022-0776
Cross-site Scripting XSS - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0...
CVE-2022-0776
Cross-site Scripting XSS - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0...
CVE-2022-0776 Cross-site Scripting (XSS) - DOM in hakimel/reveal.js
Cross-site Scripting XSS - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0...
CVE-2022-0776
The CVE-2022-0776 issue affects reveal.js prior to version 4.3.0 and is described as a DOM-based Cross-Site Scripting (XSS) vulnerability that can be exposed via postMessage handling. Multiple connected sources confirm the vulnerability stems from insufficient input validation/output in Reveal.js...
