CVE-2021-21306

Marked (npm package) contains a Regular Expression Denial of Service vulnerability in versions 1.1.1 up to before 2.0.0. The root cause is a REDoS condition when processing user-generated code through marked. Impact is denial of service; upgrade to version 2.0.0 or later to fix. If exploiting det...

CVE-2021-21306

Marked is an open-source markdown parser and compiler npm package "marked". In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is...

Debian: Security Advisory (DSA-4831-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vicent Martí Redcarpet Injection Vulnerability

Vicent Martí Redcarpet is a Rust-based codebase for parsing Markdown syntax by the individual developer Vicent Martí. An injection vulnerability exists in Redcarpet before version 3.5.1, which results from not performing HTML escaping when handling quotes...

md4c denial of service vulnerability (CNVD-2020-58044)

md4c Markdown for C is a personal developer's implementation of the Markdown parser in C. It is a parser that can be used in a variety of languages. A denial of service vulnerability exists in mdpushblockbytes in md4c.c in md4c 0.4.5. An attacker can trigger the use of uninitialized memory via a...

Denial Of Service (DoS)

markdown-it-toc-and-anchor is vulnerable to denial of service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop...

[SECURITY] Fedora 32 Update: rubygem-kramdown-2.1.0-3.fc32

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions...

Debian: Security Advisory (DSA-4743-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4743-1] ruby-kramdown security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4743-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2020 https://www.debian.org/security/faq -...

CVE-2020-15820

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

CVE-2020-15820

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

Design/Logic Flaw

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

CVE-2020-15820

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

CVE-2020-15820

The CVE-2020-15820 issue affects YouTrack (JetBrains) prior to version 2020.2.6881, where the Markdown parser could disclose the existence of a hidden file. The problem is documented in JetBrains’ Q2 2020 security bulletin, which notes that YouTrack was updated to resolve this vulnerability in 20...

Zulip server Markdown parser cross-site scripting vulnerability

Zulip server is an open source team chat application from Zulip Inc.Markdown parser is one of the Markdown markup language parser. A cross-site scripting vulnerability exists in the modallink function of Markdown parser in Zulip Server versions prior to 2.1.3. The vulnerability stems from a lack ...

Cross-site Scripting (XSS)

Overview written is a rich Markdown editor for the web. Note: This package is deprecated EOL Affected versions of this package are vulnerable to Cross-site Scripting XSS. When parsing and converting markdown into HTML, it is possible to inject malicious JavaScript elements that can result in XSS...

CVE-2019-16215

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...

CVE-2019-16215

CVE-2019-16215 affects the Zulip server before 2.0.5. The Markdown parser uses a regular expression vulnerable to exponential backtracking, allowing a logged-in user to craft a message that could cause the server to consume excessive CPU time and stall processing of subsequent messages. The Red H...

CVE-2019-16215

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...

PT-2019-14585 · Zulip · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip server versions prior to 2.0.5 Description: The issue concerns the Markdown parser in the Zulip server, which used a regular expression vulnerable to exponential backtracking. This could allow a logged-in user to send a crafted message,...