6299 matches found
CVE-2021-22886
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...
Cross site scripting
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...
CVE-2021-22886
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...
CVE-2021-22886: Improper Neutralization of Input During Web Page Generation
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...
PT-2021-15254
Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 3.11 Rocket.Chat version 3.10.5 Rocket.Chat version 3.9.7 Rocket.Chat version 3.8.8 Description The issue allows a remote attacker to inject arbitrary JavaScript in a message using nested markdown tags, leading to...
OSCP-Exam-Report-Template-Markdown - Markdown Templates For Offensive Security OSCP, OSWE, OSCE, OSEE, OSWP Exam Report
I created an Offensive Security Exam Report Template in Markdown so LaTeX, Microsoft Office Word, LibreOffice Writer are no longer needed during your Offensive Security OSCP, OSWE, OSCE, OSEE, OSWP exam! Now you can be efficient and faster during your exam report redaction! Speed up writing , don...
FreeBSD : gitea -- quoting in markdown text (1431a25c-8a70-11eb-bd16-0800278d94f0)
The Gitea Team reports for release 1.13.5 : - Update to goldmark 1.3.3 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors Redistribution and use in source VuX...
OPENSUSE-SU-2021:0451-1 Security update for python-markdown2
This update for python-markdown2 fixes the following issues: Update to 2.4.0 boo1181270: - pull 377 Fixed bug breaking strings elements in metadata lists - pull 380 When rendering fenced code blocks, also add the language-LANG class - pull 387 Regex DoS fixes CVE-2021-26813, boo1183171 - Switch o...
Regular Expression Denial of Service (ReDoS) in Jinja2
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiti...
Cross-site Scripting (XSS)
Overview qiita-markdown is a Qiita-specified markdown processor. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Increments Qiita::Markdown allows XSS in transformers. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” ...
Cross-site Scripting (XSS)
qiita-markdown is vulnerable to cross-site scripting XSS. The vulnerability exists through the value of port in url where it allows strings like javascript://docs.google.com:80/%0d%0aalertdocument.domain to be executed...
gitea:fuzz_markdown_render_raw: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=5667361895088128 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkdownrenderraw Job Type: libfuzzerasangitea Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...
CVE-2021-28796
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...
CVE-2021-28796
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...
Cross site scripting
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...
CVE-2021-28796
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...
CVE-2021-28796
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...
CVE-2021-28796
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...
CVE-2021-28796
CVE-2021-28796 affects Qiita::Markdown (Ruby) prior to 0.33.0, allowing XSS via transformers. The issue is documented across multiple connected sources (e.g., Red Hat CVEs, OSV/GHSA advisories) as a failure to sanitize or neutralize user-controlled input in the transformer path, leading to cross-...