UBUNTU-CVE-2024-21535

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

CVE-2024-21535

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

CVE-2024-21535

Technical details about CVE-2024-21535 are not provided in the connected documents. Monitoring for updates is advised.

CVE-2024-21535

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

CVE-2024-21535

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

CVE-2024-21535

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

markdown-to-jsx 安全漏洞

markdown-to-jsx is one of the lightest, customizable React markdown components by Evan Jacobs Personal Developer. A security vulnerability exists in markdown-to-jsx prior to version 7.4.0 that stems from improper input cleanup...

CVE-2024-21535: Improper Neutralization of Input During Web Page Generation

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

Exploit for Cross-site Scripting in Html-Js Doracms

CVE-2024-28715 CVE ID CVE-2024-28715 PRODUCT Do...

@apolitical/component-library (>=1.7.0-beta.1, <=10.5.2), @apolitical/styleguide2 (>=3.17.0-rc.1, <=7.8.1) +60 more potentially affected by CVE-2024-21535 via markdown-to-jsx (>=7.0.0, <=7.3.2)

markdown-to-jsx NPM version =7.0.0, =1.7.0-beta.1, =3.17.0-rc.1, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =6.1.1, =7.3.2, =0.1.0, =0.9.1, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =0.1.0-alpha.39, =1.1.1-beta.3, =1.2.2 and more Source cves: CVE-2024-21535 Source advisory:...

Cross-site Scripting (XSS)

Overview markdown-to-jsx is a lightweight, customizable React markdown component. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in...

CVE-2023-29206 org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins

XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a...

Chinese Hackers Targeting European Entities with New MQsTTang Backdoor

The China-aligned Mustang Panda actor has been observed using a hitherto unseen custom backdoor called MQsTTang as part of an ongoing social engineering campaign that commenced in January 2023. "Unlike most of the group's malware, MQsTTang doesn't seem to be based on existing families or publicly...

Mermaid 代码注入漏洞

Mermaid is a software application. Create charts and visualizations using text and code. A code injection vulnerability exists in Mermaid versions prior to 1.3.0, prior to 2.0.0-rc1, which can be exploited by an attacker to modify any mermaid block of code with arbitrary code, which will be...

Malicious code in babel-pugif-sntax-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8334b8dba28e26fe0cff3cd0c257928e82354f069e0e629614f643bbc4878373 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1414 Malicious code in babel-pugif-sntax-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8334b8dba28e26fe0cff3cd0c257928e82354f069e0e629614f643bbc4878373 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1435 Malicious code in babelpugintransformreactjsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c5382dcc5be3a730f882330e09a06e62a180f32a8cb289d9f1dcd438ca6e2d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babelpugintransformreactjsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c5382dcc5be3a730f882330e09a06e62a180f32a8cb289d9f1dcd438ca6e2d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview babel-plugin-remove-jsx-empty-expression is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...

Malicious code in mock-jsx-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3846ce818a5ea566ec12c033e1f4f1a7134d764202d460422994201da41de81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...