4796 matches found
CVE-2017-11594
CVE-2017-11594 affects Loomio’s Markdown parser prior to version 1.8.0. The vulnerability is a cross-site scripting (XSS) flaw that lets remote attackers inject arbitrary web script or HTML through non-sanitized Markdown content in new threads or thread comments. The root cause is improper saniti...
CVE-2017-11593
Markdown Preview Plus (MPP) extension for Chrome is affected by a cross-site scripting (XSS) vulnerability in versions prior to 0.5.7. The issue arises when crafted text/markdown/rst files intended to be displayed as plain text are uploaded and then converted to HTML without proper sanitization, ...
CVE-2017-11594
Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...
CVE-2017-11593
Cross-site scripting XSS vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files that are designed to be viewed in the...
Markdown Preview Plus extension cross-site scripting vulnerability
Markdown Preview Plus MPP extension for Chrome is a markdown a markup language preview plugin for Chrome. A cross-site scripting vulnerability exists in versions of the MPP extension for Chrome platform prior to 0.5.7. A remote attacker can exploit this vulnerability to inject arbitrary web scrip...
Loomio Cross-Site Scripting Vulnerability
Loomio is a cross-platform team decision-making tool. markdown parser is one of the Markdown markup language parser. A cross-site scripting vulnerability exists in the Markdown parser in Loomio versions prior to 1.8.0. A remote attacker can exploit this vulnerability to inject arbitrary web scrip...
CVE-2017-1000054
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...
CVE-2017-1000054
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...
Design/Logic Flaw
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...
CVE-2017-1000054
Rocket.Chat 0.8.0 and newer is affected by an XSS in the markdown link parsing code for messages. The vulnerability enables injection of arbitrary JavaScript into a victim’s browser, with potential token/session theft and unauthorized actions if a user views the affected content. Multiple sources...
CVE-2017-1000054
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...
PT-2017-10764 · Rocket.Chat · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 0.8.0 and newer Description: The issue concerns an XSS vulnerability in the markdown link parsing code for messages. Recommendations: For Rocket.Chat versions 0.8.0 and newer, at the moment, there is no information about ...
Flexport year in Hackerone is report 6 an interesting vulnerability-vulnerability warning-the black bar safety net
! A year ago the Internet freight forwarders company Flexport in order to improve its customer data security, with our HackerOne platform to establish a cooperative relationship. HackerOne as a global well-known bug Bounty gold one, allowing all the security enthusiasts and professional penetrati...
CVE-2015-3295
markdown-it before 4.1.0 does not block data: URLs...
DEBIAN-CVE-2015-3295
markdown-it before 4.1.0 does not block data: URLs...
CVE-2015-3295
markdown-it before 4.1.0 does not block data: URLs...
CVE-2015-3295
markdown-it before 4.1.0 does not block data: URLs, enabling potential HTML injection when rendering user-provided content. Affected: markdown-it versions prior to 4.1.0. Root cause: failure to block data: URLs in the rendering process. Impact: authoring or rendering content could lead to uninten...
CVE-2015-3295
markdown-it before 4.1.0 does not block data: URLs...