4830 matches found
CVE-2021-28796
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...
CVE-2021-28796
CVE-2021-28796 affects Qiita::Markdown (Ruby) prior to 0.33.0, allowing XSS via transformers. The issue is documented across multiple connected sources (e.g., Red Hat CVEs, OSV/GHSA advisories) as a failure to sanitize or neutralize user-controlled input in the transformer path, leading to cross-...
Getty104 qiita-markdown 跨站脚本漏洞
Getty104 qiita-markdown is Getty104 an open source application . It provides an editor function. A cross-site scripting vulnerability exists in Qiita Markdown before 0.33.0, which originates from transformer...
Gitlab -- Multiple vulnerabilities
Gigtlab reports: Remote code execution via unsafe user-controlled markdown rendering options...
Fedora 33 : mingw-python-jinja2 (2021-2ab8ebcabc)
The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-2ab8ebcabc advisory. - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use of...
GitLab: RCE via unsafe inline Kramdown options when rendering certain Wiki pages
Summary When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and...
Writehat - A Pentest Reporting Tool Written In Python
WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...
CVE-2021-27907
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
CVE-2021-27907
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
PYSEC-2021-127
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
PYSEC-2021-127
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
Cross site scripting
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
CVE-2021-27907
CVE-2021-27907 affects Apache Superset up to version 0.38.0. A vulnerability exists where a Markdown component on a Dashboard page can be abused to inject JavaScript that is executed in the context of a user’s browser (Stored XSS). The underlying issue is the ability to create a div containing an...
CVE-2021-27907 Apache Superset stored XSS on Dashboard markdown
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
PT-2021-17661 · Apache · Apache Superset
Name of the Vulnerable Software and Affected Versions: Apache Superset versions up to and including 0.38.0 Description: The issue allows a malicious user to inject javascript code, executing unwanted actions in the context of the user's browser, by creating a Markdown component on a Dashboard pag...
PYSEC-2021-20
markdown2 =1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time...
UBUNTU-CVE-2021-26813
markdown2 =1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time...
OSV-2021-446 Global-buffer-overflow in AK::StringView::operator==
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31351 Crash type: Global-buffer-overflow READ 1 Crash state: AK::StringView::operator== Markdown::CodeBlock::parse bool Markdown::helper...
OSV-2021-445 Global-buffer-overflow in AK::StringView::operator==
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31338 Crash type: Global-buffer-overflow READ 1 Crash state: AK::StringView::operator== = Markdown::Table::parse...