CVE-2024-38354

CVE-2024-38354 affects CodiMD/HackMD.io notes, where the notebook feature allows rendering of iframe HTML tags with an improperly sanitized name attribute, enabling DOM clobbering-based XSS. The issue, fixed in version 2.5.4, impacts note collaboration environments that render untrusted HTML. No ...

Cross Site Scripting(XSS)

@zenuml/core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized Markdown comments in the file Comment.vue, allowing attackers to inject malicious JavaScript payloads...

CVE-2024-38527

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. The comment feature allows the use...

CVE-2024-38527

CVE-2024-38527 affects ZenUML, a JavaScript-based diagram tool that renders Markdown-inspired diagram definitions. The vulnerability arises from unsanitized Markdown comments in the ZenUML diagram syntax, allowing attacker-controlled comments to trigger Cross-site Scripting (XSS) when diagrams ar...

CVE-2024-38527

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. The comment feature allows the use...

CVE-2024-38527 Cross-site Scripting in ZenUML

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. The comment feature allows the use...

CVE-2024-38527 Cross-site Scripting in ZenUML

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. The comment feature allows the use...

Cross-site Scripting in ZenUML

Summary Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. Details The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdo...

GHSA-Q6XV-JM4V-349H Cross-site Scripting in ZenUML

Summary Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. Details The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdo...

PT-2024-28054

Name of the Vulnerable Software and Affected Versions ZenUML versions prior to 3.23.25 Description The comment feature in ZenUML diagram syntax is susceptible to Cross-site Scripting XSS due to the lack of sanitization of markdown text before rendering. This allows an attacker to enter a maliciou...

CVE-2024-38527: Improper Neutralization of Input During Web Page Generation

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. The comment feature allows the use...

ZenUML Security Vulnerabilities

ZenUML is a JavaScript-based charting tool open-sourced by ZenUML. A security vulnerability exists in ZenUML prior to version 3.23.25 that stems from Markdown text that is currently not cleaned up prior to rendering, allowing an attacker to enter a malicious load for annotations that could lead t...

Malicious code in MаrkdownSnіppets (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in MаrkdоwnSnірpets (NuGet)

--- -= Per source details. Do not edit below this line.=-...

org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0.m1, <=2.12.0), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0.m7, <=2.12.0) +5 more potentially affected by CVE-2024-27136 via org.apache.jspwiki:jspwiki-main (>=2.11.0.m1, <=2.12.1)

org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0.m1, =2.11.0.m1, =2.11.0.m7, =2.11.0.m7, =2.11.0, =2.11.0.m1, =2.11.0.m4, =2.11.0.m1, =2.12.1 Source cves: CVE-2024-27136 Source advisory: OSV:GHSA-36GF-VPJ2-J42W...

OPENSUSE-SU-2024:11237-1 python36-markdown2-2.4.0-2.4 on GA media

These are all security issues fixed in the python36-markdown2-2.4.0-2.4 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12772-1 python310-markdown-it-py-2.2.0-1.1 on GA media

These are all security issues fixed in the python310-markdown-it-py-2.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

Redmine Markdown XSS

The vulnerability of the Markdown component in the Redmine project and task management web application exists due to the lack of measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

CVE-2024-37304

NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight...

CVE-2024-37304 NuGetGallery's Markdown Autolinks Processing Vulnerable to Cross-site Scripting

NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight...