Caret 跨站脚本漏洞

Caret is a software package for drawing classification and regression models. A security vulnerability exists in Caret, which stems from the fact that when it is enabled in preview mode, an attacker can implement cross-site scripting using a carefully crafted Markdown file to enable code executio...

PT-2023-14164 · Caret · Caret

Name of the Vulnerable Software and Affected Versions: Caret affected versions not specified Description: The issue is related to an XSS attack that occurs when a user opens a crafted Markdown file with preview mode enabled, leading to client-side code execution. Recommendations: At the moment,...

CVE-2022-42967 XSS in Caret markdown editor leads to remote code execution when viewing crafted Markdown files

Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution...

CVE-2022-42967 XSS in Caret markdown editor leads to remote code execution when viewing crafted Markdown files

Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution...

XSS via markdown syntax

Description Hi,Maintainer,thanks for reading.I am glad to report a secure problem to you. I found that your forum allows users to use markdown syntax to post articles and comments, but there is no corresponding protection means, which is unsafe. Any user can post dangerous content, like the...

CVE-2022-46603

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

CVE-2022-46603

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

Design/Logic Flaw

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

CVE-2022-46603

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

CVE-2022-46603

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

Inkdrop 跨站脚本漏洞

Inkdrop is a note-taking application with a powerful Markdown editor by the Japanese individual developer Takuya. A security vulnerability exists in Inkdrop version v5.4.1. An attacker can exploit this vulnerability to execute arbitrary commands by uploading specially crafted markdown files...

PT-2023-14962 · Inkdrop · Inkdrop

Name of the Vulnerable Software and Affected Versions: Inkdrop version 5.4.1 Description: An issue in Inkdrop allows attackers to execute arbitrary commands via uploading a crafted markdown file. Recommendations: For Inkdrop version 5.4.1, update to a version that contains a fix for this issue, a...

Regular Expression Denial Of Service (ReDoS)

markdown-it is vulnerable to regular expression denial of service DoS attacks. A malicious user is able to pass a crafted regex statement through the replace function in lib/common/htmlre.js, causing an application crash due to inefficient regular expression complexity...

Stored XSS by link markdown

Description The site allows link markdown but does not validate, resulting in XSS. Proof of Concept Create new memo with payload Click me! Hold Ctrl and click to Click me!, a alert with content is domain name appear...

Stored XSS via markdown link

Description Markdown editor doesn't sanitize user's input, leads to stored XSS Proof of Concept a Reproduce 1.Login to https://demo.usememos.com/ 2.Create new memo with content a 3.Ctrl+left click this link, javascript code has been executed...

GHSA-J5P7-JF4Q-742Q markdown-it vulnerable to Inefficient Regular Expression Complexity

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of t...

markdown-it vulnerable to Inefficient Regular Expression Complexity

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of t...

CVE-2015-10005

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of t...

Design/Logic Flaw

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of t...

UBUNTU-CVE-2015-10005

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of t...