CVE-2024-22370

In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible...

JetBrains YouTrack Security Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack versions prior to 2023.3.22666, which...

CVE-2023-26485 Quadratic complexity may lead to a denial of service in cmark-gfm

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads...

GHSA-GPVJ-GP8C-C7P2 Regular Expression Denial of Service in simple-markdown

A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. Upgrading to...

UBUNTU-CVE-2023-22485

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the validateprotocol function. We believe this bug is harmless in practice, because the out-of-bounds...

PT-2023-18536 · Cmark-Gfm +1 · Cmark-Gfm +1

Name of the Vulnerable Software and Affected Versions: cmark-gfm versions prior to 0.29.0.gfm.7 Description: The issue is related to a crafted markdown document that can trigger an out-of-bounds read in the validate protocol function. This bug is believed to be harmless in practice because the...

Markdownify 安全漏洞

Markdownify is a minimal Markdown Editor desktop application built on Electron by the individual developer Amit Merchant. A security vulnerability exists in Markdownify version 1.4.1 that stems from the application not having a CSP policy to properly validate markdown files before rendering their...

CVE-2022-25849 Cross-site Scripting (XSS)

The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting XSS because the module of parse markdown does not filter the href attribute very well...

md2roff 缓冲区错误漏洞

md2roff is a personal developer by Nicholas Christopoulos that converts markdown to groff / troff man, mdoc, mm, mom documents. A buffer error vulnerability exists in md2roff version 1.7, which is caused by a stack-based buffer overflow in Markdown files containing a large number of consecutive...

JetBrains YouTrack 跨站脚本漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. The software features bug tracking, creating workflows and monitoring project progress.JetBrains YouTrack 2022.1.43700 previously contained a security vulnerability that could be...

UBUNTU-CVE-2022-21681

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service DoS. Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a...

CVE-2021-22225

Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...

Cross-site Scripting (XSS)

Overview @stoplight/markdown is an Useful functions when working with Markdown. Leverages the Unified / Remark ecosystem under the hood. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to inject malicious JavaScript as part of the markdown feature of...

DEBIAN-CVE-2020-8031

A Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prio...

UBUNTU-CVE-2020-8031

A Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prio...

Anchor CMS 'markdown' cross-site scripting vulnerability

Anchor CMS is a lightweight CMS builder. A cross-site scripting vulnerability exists in Anchor CMS 'markdown', which can be exploited by attackers to obtain sensitive information such as user cookies...

Notable Cross-Site Scripting Vulnerability

Notable is a Markdown-based note-taking software with cross-platform support from the individual developer of Notable. A cross-site scripting vulnerability exists in Notable version 1.8.4, where an attacker could execute a cross-site scripting attack via crafted Markdown text...

Null pointer dereference

peg-markdown 0.4.14 has a NULL pointer dereference in processrawblocks in markdownlib.c. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

GitLab: Uncontrolled Resource Consumption in any Markdown field using Mermaid

Summary I found a bypass for the mitigation of DoS via Mermaid CVE-2019-9220. As the mitigation for CVE-2019-9220, the input limit of 5000 characters is currently applied to a Mermaid code block, but it can be bypassed by simply splitting the longer payload to many code blocks. Steps to reproduce...

GitLab CE/EE Cross-Site Scripting Vulnerability (CNVD-2019-23576)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A cross-si...