6648 matches found
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2024-48463
Bruno IDE Desktop versions prior to 1.29.1 are vulnerable to a command injection vulnerability (CWE-78) and unvalidated URL handling. The root cause is the use of Electron's shell.openExternal function within the Markdown docs viewer without proper validation of http or https protocols. This allo...
CVE-2024-48463: URL Redirection to Untrusted Site
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
Bruno security vulnerabilities
Bruno is an open source IDE for exploring and testing Api from usebruno open source. A security vulnerability exists in Bruno version 1.29.1, which stems from Bruno's use of Electron shell.openExternal to open windows in the Markdown document viewer with no authentication...
WS-2023-0090
Comrak before 0.17.0 is vulnerable to production of excessive output when parsing Markdown. A large number of references in a markdown document can trigger an overly large response...
Cross-site Scripting (XSS)
Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS within the Markdown class in lib/markdown2.py, which insufficiently sanitizes attribute values. An attacker can exploit this by crafting...
Cross-site Scripting (XSS)
Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the dolinkpatterns method within the Markdown class in lib/markdown2.py file, which insufficiently sanitizes image URLs. An attacker can...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization in |markdown filter. An attacker to inject arbitrary JS into the page, by entering Markdown and then renders it with this filter. Note: Filters that use issafe need to make sure the...
JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2025-16703)
JetBrains YouTrack is a project management tool, developed by JetBrains, supporting cloud hosting and local deployment, providing task management, team collaboration, time tracking and other features for software development, human resources and other scenarios. JetBrains YouTrack suffers from a...
JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2025-16700)
JetBrains YouTrack is a project management tool, developed by JetBrains, supporting cloud hosting and local deployment, providing task management, team collaboration, time tracking and other features for software development, human resources and other scenarios. JetBrains YouTrack suffers from a...
CVE-2024-50582
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements...
CVE-2024-50580
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule...
CVE-2024-50580
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule...
CVE-2024-50582
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements...
CVE-2024-50580
JetBrains YouTrack is affected in versions before 2024.3.47707 due to insecure markdown parsing and a faulty rendering rule, enabling multiple cross-site scripting (XSS) vectors. The impact is limited to XSS as described in the vendor advisory; remediation is to upgrade to 2024.3.47707 or newer (...
CVE-2024-50580
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule...
CVE-2024-50580
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule...
CVE-2024-50580: Improper Neutralization of Input During Web Page Generation
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule...