CVE-2021-43308: Inefficient Regular Expression Complexity

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

CVE-2020-10935

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

Design/Logic Flaw

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

CVE-2020-10935: Improper Neutralization of Input During Web Page Generation

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

Rocket.Chat Cross-Site Scripting Vulnerability

Rocket.Chat is an open source built in JavaScript using the Meteor fullstack framework developed by the Web chat server . A cross-site scripting vulnerability exists in the markdown link parsing code used for messages in Rocket.Chat. A remote attacker can exploit this vulnerability to inject...

CVE-2017-1000054: Improper Neutralization of Input During Web Page Generation

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...

PT-2017-10764 · Rocket.Chat · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 0.8.0 and newer Description: The issue concerns an XSS vulnerability in the markdown link parsing code for messages. Recommendations: For Rocket.Chat versions 0.8.0 and newer, at the moment, there is no information about ...