OPENSUSE-SU-2021:0893-1 Security update for htmldoc

This update for htmldoc fixes the following issues: htmldoc was updated to version 1.9.12 Fixed buffer-overflow CVE-2021-20308 boo1184424 Fixed a crash bug with 'data:' URIs and EPUB output Fixed several other crash bugs Fixed JPEG error handling Fixed some minor issues Removed the bundled libjpe...

SUSE SLES11 Security Update : python-Jinja2 (SUSE-SU-2021:14644-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:14644-1 advisory. - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use ...

@backstage/plugin-api-docs (>=0.1.1-alpha.18, <=0.1.1), @backstage/plugin-catalog (>=0.0.0-nightly-202010102951, <=0.2.9) +20 more potentially affected by CVE-2021-32661 via @backstage/plugin-techdocs (>=0.0.0-nightly-20220708025041, <=0.5.8)

@backstage/plugin-techdocs NPM version =0.0.0-nightly-20220708025041, =0.1.1-alpha.18, =0.0.0-nightly-202010102951, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.17, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.9, =0.1.1-alpha.22, =0.1.1-alpha.13, =0.1.1-alpha.19, =0.0.0-nightly-20220504024625...

FreeBSD : Gitlab -- Multiple Vulnerabilities (5f52d646-c31f-11eb-8dcf-001b217b3468)

Gitlab reports : Stealing GitLab OAuth access tokens using XSLeaks in Safari Denial of service through recursive triggered pipelines Unauthenticated CI lint API may lead to information disclosure and SSRF Server-side DoS through rendering crafted Markdown documents Issue and merge request length...

GitLab: Stored XSS in Mermaid when viewing Markdown files

Summary GitLab's Mermaid configuration allows an attacker to inject HTML in the rendered Markdown. This can be combined with a CSP bypass using pipeline artifacts to achieve RCE. Steps to reproduce 1. Create a repository on GitLab.com 2. Add the following to .gitlab-ci.yml yaml --- job: script: -...

GitLab: Stored XSS in markdown via the DesignReferenceFilter

Summary When rendering markdown, links to designs are parsed using the following linkreferencepattern: https://gitlab.com/gitlab-org/gitlab/-/blob/v13.12.1-ee/app/models/designmanagement/design.rbL168 ruby def self.linkreferencepattern @linkreferencepattern ||= begin pathsegment =...

CloudBees Jenkins Markdown Formatter Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CVE-2021-21660

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...

CVE-2021-21660

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...

Cross site scripting

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...

CVE-2021-21660

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...

CVE-2021-21660

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...

CVE-2021-21660

The CVE-2021-21660 entry concerns Jenkins Markdown Formatter Plugin versions 0.1.0 and earlier. The vulnerability arises because the plugin does not sanitize crafted link target URLs, causing a stored cross-site scripting (XSS) flaw. Exploitation requires the attacker to have the ability to edit ...

PT-2021-14703 · Jenkins · Jenkins Markdown Formatter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Markdown Formatter Plugin versions 0.1.0 and earlier Description: The issue results from the plugin's failure to sanitize crafted link target URLs, leading to a stored cross-site scripting XSS vulnerability. This vulnerability can be...

XSS vulnerability in markdown-formatter

markdown-formatter 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup...

Jenkins 跨站脚本漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

Denial Of Service (DoS)

pandoc is vulnerable to denial of service. The table extension in GitHub Flavored Markdown takes On n time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service...

CVE-2021-29503

HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend...

cmark-gfm: Exponential time to parse certain inputs could lead to DoS

The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes On n time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project...

vmd 跨站脚本漏洞

vmd is a software application. Preview markdown files in a separate window A cross-site scripting vulnerability exists in vmd version 1.34.0 and earlier versions, which leaks div class="markdown-body"...