Gitlab -- multiple vulnerabilities

Gitlab reports: Markdown DoS Information Disclosure Prometheus Metrics CSRF in System Hooks Persistent XSS Pipeline Tooltip Persistent XSS in Branch Name via Web IDE Persistent XSS in Branch Name via Web IDE...

@absinthe/graphiql-workspace (>=1.1.4, <=1.1.5), @agilys/custom-graphiql (>=2.0.0-beta1, <=2.0.3) +1307 more potentially affected by CVE-2017-16114 via marked (>=0.0.1, <=0.3.7)

marked NPM version =0.0.1, =1.1.4, =2.0.0-beta1, =1.0.1, =0.25.0, =0.0.0-development, =3.3.1, =0.0.1, =0.0.0, =0.0.3 and more Source cves: CVE-2017-16114 Source advisory: OSV:GHSA-X5PG-88WF-QQ4P...

Cross-site Scripting (XSS)

markdown-pdf is vulnerable to cross-site scripting XSS attacks. The application does not properly sanitize user input, allowing a malicious user can pass a markdown file to the application to inject and execute arbitrary HTML code...

CVE-2018-3770

A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...

Path traversal

A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...

CVE-2018-3770

A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...

CVE-2018-3770

markdown-pdf versions prior to 9.0.0 are vulnerable to path traversal and potential remote code execution due to insufficient sanitization of HTML in Markdown files. Concrete details across multiple connected documents show that injecting malicious HTML can lead to reading local files and, in som...

CVE-2018-3770

A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...

PT-2018-16188 · Npm · Markdown-Pdf

Name of the Vulnerable Software and Affected Versions: markdown-pdf versions prior to 9.0.0 Description: A path traversal issue in markdown-pdf allows users to insert malicious HTML code, potentially resulting in the reading of local files. The package fails to sanitize HTML code in markdown file...

GHSA-P6H9-GW49-RQM4 markdown2 is vulnerable to cross-site scripting

An issue was discovered in markdown2 aka python-markdown2 through 2.3.5. The safemode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final character from...

Design/Logic Flaw

Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element...

CVE-2018-13433

Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element...

CVE-2018-13433

Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element...

CVE-2018-13433

Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element...

CVE-2018-13433

CVE-2018-13433 affects Boostnote v0.11.7, where XSS is possible during Markdown highlighting, demonstrated via an onerror attribute on an IMG element. The connected sources confirm the vulnerability pattern but do not provide explicit exploit details, affected versions beyond v0.11.7, or remediat...

Cross-site Scripting (XSS)

joplin is vulnerable to cross-site scripting XSS attacks. The library does not sanitize input when converting markdown files to html, allowing a malicious user to inject and execute arbitrary Javascript...

CVE-2018-1000543

Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not validated that can result in XSS leading to abritrary code execution. This attack appear to be exploitable via The attacker tricks the victim into opening a...

Cross site scripting

Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not validated that can result in XSS leading to abritrary code execution. This attack appear to be exploitable via The attacker tricks the victim into opening a...

CVE-2018-1000543

Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not validated that can result in XSS leading to abritrary code execution. This attack appear to be exploitable via The attacker tricks the victim into opening a...

Marked Module Denial of Service Vulnerability

marked module is a Markdown compiler for browsers, servers and command line interfaces. A security vulnerability exists in the marked module. An attacker could exploit this vulnerability to cause a denial of service...