6650 matches found
CVE-2024-54138
CVE-2024-54138 describes an XSS vulnerability in NuGet Gallery’s Markdown autolinks handling. The issue stems from inadequate sanitization of autolinks (JavaScript in standard links is filtered, but autolinks aren’t), enabling potential cross-site scripting. The vulnerability has been fixed in ve...
CVE-2024-54138
NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight...
CVE-2024-54138 XSS Vulnerability in NuGetGallery's Markdown Autolinks Processing
NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight...
CVE-2024-54138: Improper Neutralization of Input During Web Page Generation
NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight...
NuGet Gallery Cross-Site Scripting Vulnerability
NuGet Gallery is a NuGet open source package repository that supports NuGet. A cross-site scripting vulnerability exists in NuGet Gallery v2024.05.28 and earlier versions, which stems from mishandling of automated links in Markdown content and is vulnerable to cross-site scripting attacks...
PT-2024-36066
Name of the Vulnerable Software and Affected Versions: NuGet Gallery versions prior to 2024.12.06 Description: The NuGet Gallery has a security issue related to its handling of autolinks in Markdown content. Although the platform properly filters out JavaScript from standard links, it does not...
Malicious code in symphony-markdown (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8ac47d747638835685ead66cf3fe6fc737f93e540093a4f94b0148b45db3c3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10913 Malicious code in symphony-markdown (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8ac47d747638835685ead66cf3fe6fc737f93e540093a4f94b0148b45db3c3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
K000148605: Highlight.js vulnerability CVE-2020-26237
Security Advisory Description Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during...
CVE-2024-49362 Remote Code Execution on click of <a> Link in markdown preview
Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This...
PT-2024-33486
Name of the Vulnerable Software and Affected Versions Joplin-desktop affected versions not specified Description The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid, allowing the execution of untrusted HTML content within the Electron window. This enables...
SUSE CVE-2024-51735
Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdow...
JetBrains YouTrack Markdown Parsing XSS
The vulnerability of the Markdown Parsing component in the JetBrains YouTrack project management and task management software is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow attackers to perform cross-site scripting attacks...
CVE-2024-51735 Stored Cross-site Scripting to RCE on Osmedeus Web Server
Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdow...
CVE-2024-51735
CVE-2024-51735 affects Osmedeus Web Server. The issue is a Stored XSS in the web UI when viewing workflow results, where unfiltered content in the generated HTML/Markdown reports can execute commands on the host. The root cause is improper filtering of file contents used in the report generation ...
CVE-2024-51735 Stored Cross-site Scripting to RCE on Osmedeus Web Server
Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdow...
GHSA-WVV7-WM5V-W2GV Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE
Summary XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. Details When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the...
Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE
Summary XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. Details When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the...
CVE-2024-51735: Improper Neutralization of Input During Web Page Generation
Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdow...
