6291 matches found
Caret Editor Input Validation Error Vulnerability
Caret Editor is a Markdown file editor from Caret. Caret Editor before 4.0.0-rc22 suffers from an input validation error vulnerability that stems from a specially crafted Markdown document that could lead to the execution of malicious JavaScript code in the insertion symbol editor...
CVE-2020-20269
A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22...
CVE-2020-20269
Caret Editor (pre-4.0.0-rc22) is affected by CVE-2020-20269 due to a crafted Markdown document that can trigger execution of malicious JavaScript. The vulnerability, scored high (CRITICAL) with CVSSv3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), suggests a remote-like attack vector via a Markdown payl...
CVE-2020-20269: Undefined Security Weakness
A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22...
PT-2021-10470
Name of the Vulnerable Software and Affected Versions: Caret Editor versions prior to 4.0.0-rc22 Description: A specially crafted Markdown document could cause the execution of malicious JavaScript code. Recommendations: For versions prior to 4.0.0-rc22, update to version 4.0.0-rc22 or later to...
Debian: Security Advisory (DSA-4831-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Anchor CMS 'markdown' cross-site scripting vulnerability
Anchor CMS is a lightweight CMS builder. A cross-site scripting vulnerability exists in Anchor CMS 'markdown', which can be exploited by attackers to obtain sensitive information such as user cookies...
DEBIAN-CVE-2020-26298
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
CVE-2020-26298
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
CVE-2020-26298
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
Cross site scripting
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
CVE-2020-26298 Injection in Redcarpet
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
Vicent Martí Redcarpet Injection Vulnerability
Vicent Martí Redcarpet is a Rust-based codebase for parsing Markdown syntax by the individual developer Vicent Martí. An injection vulnerability exists in Redcarpet before version 3.5.1, which results from not performing HTML escaping when handling quotes...
CVE-2020-26298: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
CVE-2020-26298
CVE-2020-26298 affects the Redcarpet Ruby gem (rubygem-redcarpet) prior to 3.5.1, where HTML escaping was not performed for quotes, enabling a cross-site scripting (XSS) vector. The issue is fixed in version 3.5.1 (via the referenced commit); upgrading to 3.5.1 or newer mitigates the vulnerabilit...
Injection/XSS in Redcarpet
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
Zonetti Zonote Cross-Site Scripting Vulnerability
Zonetti Zonote is Zonetti individual developers of a Javascript-based language development for the provision of Markdown format note-taking capabilities . A cross-site scripting vulnerability exists in zonote version 0.4.0 and prior versions, which allows remote code execution as the node...
Gotenberg Directory Traversal Vulnerability (CNVD-2021-03336)
Gotenberg is a Docker-powered stateless API for converting HTML, Markdown and Office documents to PDF. A directory traversal vulnerability exists in Gotenberg 6.2.1 and earlier versions of the Markdown engine. An attacker can exploit this vulnerability to read any container file...
