cmark-gfm input validation error vulnerability

cmark-gfm is an extended version of the C-reference implementation of CommonMark, a rationalized version with canonical Markdown syntax. cmark-gfm suffers from an input validation error vulnerability that could be exploited by an attacker to cause remote code execution in applications using the...

CVE-2022-24724

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:rowfromstring may lead to heap memory corruption when parsing tables who's marker rows contain mor...

CVE-2022-24724

CVE-2022-24724 affects cmark-gfm, GitHub’s extended CommonMark reference implementation. A heap memory overflow in table.c:row_from_string can occur when parsing table rows with more than UINT16_MAX columns, leading to information disclosure or arbitrary code execution depending on usage. Affecte...

CVE-2022-24724

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:rowfromstring may lead to heap memory corruption when parsing tables who's marker rows contain mor...

[SECURITY] Fedora 34 Update: rust-pulldown-cmark-0.8.0-4.fc34

Pull parser for CommonMark...

Moderate severity vulnerability that affects league/commonmark

CVE-2019-10010 Impact In league/commonmark 0.18.2 and below, malicious users can insert double-encoded HTML entities into their Markdown like this: md XSS This library would correctly unescape the & entity to & during the parsing step. However, the renderer step would fail to properly re-escape t...

GHSA-3V43-877X-QGMQ Moderate severity vulnerability that affects league/commonmark

CVE-2019-10010 Impact In league/commonmark 0.18.2 and below, malicious users can insert double-encoded HTML entities into their Markdown like this: md XSS This library would correctly unescape the & entity to & during the parsing step. However, the renderer step would fail to properly re-escape t...

Cross-Site Scripting (XSS)

league/commonmark is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via unsafe links using double-encoded HTML entities to steal session tokens or perform unwanted actions on behalf of the user...

PHP League CommonMark library cross-site scripting vulnerability

PHP League CommonMark library is a PHP-based Markdown parser from the Extraordinary Packages consortium. A cross-site scripting vulnerability exists in PHP League CommonMark library versions prior to 0.18.3, which stems from the program failing to properly escape double-encoded HTML entities. A...

CVE-2019-10010

Cross-site scripting XSS vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583...

Cross site scripting

Cross-site scripting XSS vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583...

CVE-2019-10010

Cross-site scripting XSS vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583...

CVE-2019-10010

Cross-site scripting XSS vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583...

CVE-2019-10010

CVE-2019-10010 affects the PHP League CommonMark library (versions up to and including 0.18.2). The vulnerability arises in the renderer when double-encoded HTML entities are not properly escaped, allowing an attacker to craft links that execute unsafe code (XSS). The issue is fixed in 0.18.3, wh...

CVE-2019-10010

Cross-site scripting XSS vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583...

CVE-2019-10010

Cross-site scripting XSS vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583...

CVE-2019-10010: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583...

PT-2019-11282

Name of the Vulnerable Software and Affected Versions: PHP League CommonMark library versions prior to 0.18.3 Description: The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to insert unsafe links into HTML. This is achieved by using double-encoded HTML...

Recaf - A Modern Java Bytecode Editor

Recaf is an open-source Java bytecode editor built on top of Objectweb's ASM. ASM is a bytecode manipulation library that abstracts away the constant pool and a few other class-file attributes. Since keeping track of the constant pool and managing proper stackframes are no longer necessary, compl...

commonmark cross-site scripting vulnerability

PHP League CommonMark library is a PHP-based Markdown parser. A cross-site scripting vulnerability exists in PHP League CommonMark library versions 0.15.6 through 0.18.1 and earlier. A remote attacker can exploit this vulnerability by injecting insecure URLs into HTML using line breaks...