CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

Design/Logic Flaw

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

CVE-2020-8548: Improper Neutralization of Input During Web Page Generation

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...

PT-2020-20201

Name of the Vulnerable Software and Affected Versions massCode version 1.0.0-alpha.6 Description The issue allows for XSS via crafted Markdown text, resulting in remote code execution because nodeIntegration in webPreferences is set to true. Recommendations For massCode version 1.0.0-alpha.6,...

Cross-Site Scripting

Overview All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Conside...

GitLab Resource Management Error Vulnerability (CNVD-2020-03053)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...

CVE-2019-15584

A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...

CVE-2019-15584

A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...

Input validation

A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...

CVE-2019-15584

A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...

CVE-2019-15584

A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...

CVE-2019-15584

GitLab DoS (CVE-2019-15584) affects GitLab releases < v12.3.2, < v12.2.6, and

CVE-2019-15584

Removed by vendor...

PT-2019-14295

Name of the Vulnerable Software and Affected Versions gitlab versions prior to 12.3.2 gitlab versions prior to 12.2.6 gitlab versions prior to 12.1.10 Description A denial of service issue exists that allows an attacker to bypass input validation in markdown fields, potentially taking down the...

Phabricator: Markdown parsing issue enables insertion of malicious tags

mongoose By exploiting the URL markdown an attacker is able to add tags to an anchor-element. This is less impactfull since the default csp policy blocks inline javascript execution, but an attacker could deface individual pages, bypass the rel="norefferrer" tag to perform tab nabbing or perform...

Documize Cross-Site Scripting Vulnerability

Documize is an open source document collaboration system built on Golang and EmberJS. A cross-site scripting vulnerability exists in the domain/section/markdown/markdown.go file in Documize versions prior to 3.5.1. The vulnerability stems from the lack of proper validation of client-side data by...