JPress Cross-Site Scripting Vulnerability (CNVD-2019-01670)

JPress is a set of blogging platform developed using the Java language. A cross-site scripting vulnerability exists in JPress version 1.0.4, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of Markdown input...

Cross site scripting

XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...

CVE-2019-6278

XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...

CVE-2019-6278

XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...

CVE-2019-6278

CVE-2019-6278 is an XSS vulnerability in JPress v1.0.4 exploitable via Markdown input (and Markdown input with the code input option). Affected component: JPress Markdown processing. Root cause and exact exploit vector are not detailed across the provided documents beyond the XSS claim. Several s...

CVE-2019-6278

XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...

CVE-2019-6278

XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...

PT-2019-18068

Name of the Vulnerable Software and Affected Versions JPress version 1.0.4 Description The issue exists due to XSS in Markdown input, which can also be triggered when using the code input option. Recommendations For JPress version 1.0.4, consider disabling Markdown input or restricting the use of...

CVE-2019-6278: Improper Neutralization of Input During Web Page Generation

XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...

XSS vulnerability with unsafe link protocols

An XSS vulnerability CVE-2018-20583 has been identified in the following versions of this library: 0.15.6 0.15.7 0.16.0 0.17.0 0.17.1 0.17.2 0.17.3 0.17.4 0.17.5 0.18.0 It allows unsafe URLs to be added to links. The issue has been fixed in version 0.18.1. All users should upgrade to version 0.18...

JVN#96493183: GROWI vulnerable to cross-site scripting

GROWI provided by WESEEK, Inc. contains a cross-site scripting vulnerability CWE-79. The settings option for enabling and disabling the measures against cross-site scripting "Enable XSS prevention" option was introduced in v3.1.12. However, there was an issue with the implementation where the...

CVE-2018-20351

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

Design/Logic Flaw

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

CVE-2018-20351

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

CVE-2018-20351

CVE-2018-20351 affects Evernote for macOS (Chinese) prior to version 8.3.2, where the Markdown component allows stored XSS (MAC-832). Root cause: insecure handling in the Markdown rendering path leading to script execution in stored content. Impact: potential user-visible script execution within ...

CVE-2018-20351

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

CVE-2018-20351: Improper Neutralization of Input During Web Page Generation

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

Cross-site Scripting (XSS)

cebe/markdown is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the inconsistent behavior of multiple backticks, causing code to be interpreted incorrectly. Update: This CVE has been disputed as it is not the parser's job to sanitize malicious code from a parsed...

CVE-2018-1000874

DISPUTED PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by...

CVE-2018-1000874

PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...