98 matches found
[SECURITY] Fedora 34 Update: rubygem-kramdown-2.3.1-1.fc34
kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions...
CVE-2021-28834
A flaw was found in rubygem-kramdown. Rouge is a syntax highlighter used by kramdown. Restriction of the Rouge formatters to the Rouge::Formatters namespace does not occur when Ruby's constget method is called. This can lead to arbitrary classes being instantiated in situations where the...
Arbitrary Code Execution
kramdown is vulnerable to arbitrary code execution. The package does not restrict Rouge formatters to the Rouge::Formatters namespace and allows arbitrary classes to be instantiated...
Deserialization of Untrusted Data
Overview kramdown is a Yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Kramdown does not restrict Rouge formatters to the...
DEBIAN-CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
UBUNTU-CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
Design/Logic Flaw
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated...
CVE-2021-28834
Kramdown before 2.3.1 does not constrain Rouge formatters to Rouge::Formatters, allowing arbitrary class instantiation and potential code execution. Exploitation details are not provided in the documents; affected packages include kramdown/ruby-kramdown across Linux distros (e.g., Fedora, Debian,...
Thomas Leitner kramdown 安全漏洞
Thomas Leitner kramdown is Thomas Leitner an open source application . Provides a fast pure Ruby Markdown superset converter , using a strict syntax definition and support for several common extensions . Kramdown before 2.3.1 A security vulnerability exists because Kramdown does not restrict the...
GitLab 未授权RCE漏洞（CVE-2021-22192）
When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and pushing t...
GitLab: RCE via unsafe inline Kramdown options when rendering certain Wiki pages
Summary When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and...
PT-2021-5816
Name of the Vulnerable Software and Affected Versions Kramdown versions prior to 2.3.1 Description The issue is related to the lack of restriction of Rouge formatters to the Rouge::Formatters namespace, allowing arbitrary classes to be instantiated. This could potentially enable a remote attacker...
Ubuntu: Security Advisory (USN-4562-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 20.10 : kramdown vulnerability (USN-4562-2)
The remote Ubuntu 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4562-2 advisory. kramdown could be made to crash, run programs, or leak sensitive information if it opened a specially crafted file. Tenable has extracted the preceding description...
