[SECURITY] Fedora 31 Update: rubygem-kramdown-1.17.0-6.fc31

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions...

Debian: Security Advisory (DSA-4743-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4743-1] ruby-kramdown security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4743-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4743-1] ruby-kramdown security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4743-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2020 https://www.debian.org/security/faq -...

CVE-2020-15820

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

CVE-2020-15820

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

Design/Logic Flaw

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

CVE-2020-15820

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

CVE-2020-15820

The CVE-2020-15820 issue affects YouTrack (JetBrains) prior to version 2020.2.6881, where the Markdown parser could disclose the existence of a hidden file. The problem is documented in JetBrains’ Q2 2020 security bulletin, which notes that YouTrack was updated to resolve this vulnerability in 20...

GHSA-W4PJ-7P68-3VGV Stored XSS in October

Impact A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. Patches Issue has been patched in Build 466 v1.0.466 & RainLab.Blog v1.4.1 by restricting the...

Telegram Message Client

This module can be used to send a document and/or message to multiple chats on telegram. Please refer to the module documentation for info on how to retrieve the bot token and corresponding chat ID values. Module Options msf use auxiliary/client/telegram/sendmessage msf auxiliarysendmessage show...

Arbitrary Code Execution

Overview shiba is a Live markdown previewer with linter Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad. Remediation There is no fixed version for shiba...

Marked-tree path traversal vulnerability

Marked-tree is a Markdown viewer. A path traversal vulnerability exists in fs.readFile in the index.js file in marked-tree all versions, which stems from the program's failure to clean up paths, and can be exploited by an attacker to gain unauthorized access and overwrite or read arbitrary files...

Quiver - Tool To Manage All Of Your Tools For Bug Bounty Hunting And Penetration Testing

Quiver is the tool to manage all of your tools. It's an opinionated and curated collection of commands, notes and scripts for bug bounty hunting and penetration testing. Features ZSH / Oh-My-ZSH shell plugin Tab auto-completion Global variables Prefills the command line, doesn't hide commands fro...

Cross-site Scripting (XSS)

docsify is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not validate fragment identifiers when loading resources from server-side markdown files...

CVE-2020-7680

docsify prior to 4.11.4 is susceptible to Cross-site Scripting XSS. Docsify.js uses fragment identifiers parameters after sign to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the // domain.com///attacker.com and render...

CVE-2020-11083

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users...

Cross site scripting

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users...

CVE-2020-11083 Stored XSS in October

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users...

PT-2020-12540 · October +1 · October Cms +1

Name of the Vulnerable Software and Affected Versions: October CMS versions 1.0.319 through 1.0.465 RainLab.Blog plugin versions prior to 1.4.1 Description: A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other...