PT-2021-6534 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.11 and up Description: The issue is related to insufficient input sanitization in markdown, allowing an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown. This can be exploited...

CVE-2021-22225: Improper Neutralization of Input During Web Page Generation

Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...

Cross-site Scripting in Gogs

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...

GHSA-9HX4-QM7H-X84J Cross-site Scripting in Gogs

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...

Mermaid Cross-Site Scripting Vulnerability

Mermaid is a Javascript-based drawing tool that uses a Markdown-like syntax to allow users to easily and quickly create diagrams from code.A cross-site scripting vulnerability exists in versions of Mermaid prior to 8.11.0 when using antiscript features. No details of the vulnerability are current...

JVN#29949691: Inkdrop vulnerable to OS command injection

Inkdrop provided by Takuya Matsuyama is a Markdown editor. Inkdrop contains an OS command injection vulnerability CWE-78. Impact If a file or code snippet containing an invalid iframe is loaded into Inkdrop, an arbitrary OS command may be executed on the system where it runs. Solution Update the...

Cross-site Scripting (XSS)

Overview qiita-markdown is a Qiita-specified markdown processor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a crafted gist link, a different vulnerability than CVE-2021-28796. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...

CVE-2021-28833

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...

CVE-2021-28833

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...

Design/Logic Flaw

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...

CVE-2021-28833

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...

CVE-2021-28833

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...

CVE-2021-28833

Qiita-Markdown (Ruby gem) up to versions before 0.34.0 is vulnerable to cross-site scripting via crafted gist links (CVE-2021-28833). Red Hat advisories and RubySec confirm this as a separate issue from CVE-2021-28796 and describe the same general class of XSS in the transformer/gist handling pat...

CVE-2021-28833

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...

CVE-2021-28833: Improper Neutralization of Input During Web Page Generation

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796...

PT-2021-17953

Name of the Vulnerable Software and Affected Versions: Qiita::Markdown versions prior to 0.34.0 Description: The issue allows for XSS attacks via a crafted gist link. Recommendations: For versions prior to 0.34.0, update to version 0.34.0 or later to resolve the issue...

Getty104 Qiita::Markdown 跨站脚本漏洞

Getty104 qiita-markdown is Getty104 an open source application . Provides an editor function. A cross-site scripting vulnerability exists in versions prior to Qiita::Markdown 0.34.0, which stems from the program allowing XSS via a crafted gist link...

OPENSUSE-SU-2021:0895-1 Security update for htmldoc

This update for htmldoc fixes the following issues: Update to version 1.9.12 Fixed buffer-overflow CVE-2021-20308 boo1184424 Fixed a crash bug with 'data:' URIs and EPUB output Fixed several other crash bugs Fixed JPEG error handling Fixed some minor issues Removed the bundled libjpeg, libpng, an...

CVE-2021-26834

A cross-site scripting XSS vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode...

Cross site scripting

A cross-site scripting XSS vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode...