CVE-2021-26835

No filtering of cross-site scripting XSS payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file...

CVE-2021-26834

A cross-site scripting XSS vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode...

CVE-2021-26835

No filtering of cross-site scripting XSS payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file...

CVE-2021-26835

No filtering of cross-site scripting XSS payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file...

CVE-2021-26834

A cross-site scripting XSS vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode...

PT-2021-17158

Name of the Vulnerable Software and Affected Versions: Zettlr version 1.8.7 Description: The issue is related to the lack of filtering of cross-site scripting XSS payloads in the markdown-editor, allowing attackers to perform remote code execution via a crafted file. Recommendations: For Zettlr...

CVE-2021-26835: Improper Neutralization of Input During Web Page Generation

No filtering of cross-site scripting XSS payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file...

CVE-2021-26834: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode...

Zettlr 跨站脚本漏洞

Zettlr is one of the most comprehensive editors for professional editing of Markdown files. Zettlr 1.8.7 suffers from a cross-site scripting vulnerability that stems from the lack of cross-site scripting XSS payload filtering in the markdown editor. An attacker can exploit this vulnerability to...

PT-2021-17157

Name of the Vulnerable Software and Affected Versions: Znote version 0.5.2 Description: A cross-site scripting XSS vulnerability exists, allowing an attacker to insert payloads. The code execution will happen immediately on markdown view mode. Recommendations: For Znote version 0.5.2, at the...

Security update for htmldoc (important)

openSUSE Security Update: Security update for htmldoc Announcement ID: openSUSE-SU-2021:0895-1 Rating: important References: 1184424 Cross-References: CVE-2021-20308 CVSS scores: CVE-2021-20308 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20308 SUSE: 3.3...

OPENSUSE-SU-2021:0893-1 Security update for htmldoc

This update for htmldoc fixes the following issues: htmldoc was updated to version 1.9.12 Fixed buffer-overflow CVE-2021-20308 boo1184424 Fixed a crash bug with 'data:' URIs and EPUB output Fixed several other crash bugs Fixed JPEG error handling Fixed some minor issues Removed the bundled libjpe...

Security update for htmldoc (important)

openSUSE Security Update: Security update for htmldoc Announcement ID: openSUSE-SU-2021:0893-1 Rating: important References: 1184424 Cross-References: CVE-2021-20308 CVSS scores: CVE-2021-20308 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20308 SUSE: 3.3...

SUSE SLES11 Security Update : python-Jinja2 (SUSE-SU-2021:14644-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:14644-1 advisory. - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use ...

@backstage/plugin-api-docs (>=0.1.1-alpha.18, <=0.1.1), @backstage/plugin-catalog (>=0.0.0-nightly-202010102951, <=0.2.9) +20 more potentially affected by CVE-2021-32661 via @backstage/plugin-techdocs (>=0.0.0-nightly-20220708025041, <=0.5.8)

@backstage/plugin-techdocs NPM version =0.0.0-nightly-20220708025041, =0.1.1-alpha.18, =0.0.0-nightly-202010102951, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.17, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.9, =0.1.1-alpha.22, =0.1.1-alpha.13, =0.1.1-alpha.19, =0.0.0-nightly-20220504024625...

FreeBSD : Gitlab -- Multiple Vulnerabilities (5f52d646-c31f-11eb-8dcf-001b217b3468)

Gitlab reports : Stealing GitLab OAuth access tokens using XSLeaks in Safari Denial of service through recursive triggered pipelines Unauthenticated CI lint API may lead to information disclosure and SSRF Server-side DoS through rendering crafted Markdown documents Issue and merge request length...

GitLab: Stored XSS in Mermaid when viewing Markdown files

Summary GitLab's Mermaid configuration allows an attacker to inject HTML in the rendered Markdown. This can be combined with a CSP bypass using pipeline artifacts to achieve RCE. Steps to reproduce 1. Create a repository on GitLab.com 2. Add the following to .gitlab-ci.yml yaml --- job: script: -...

GitLab: Stored XSS in markdown via the DesignReferenceFilter

Summary When rendering markdown, links to designs are parsed using the following linkreferencepattern: https://gitlab.com/gitlab-org/gitlab/-/blob/v13.12.1-ee/app/models/designmanagement/design.rbL168 ruby def self.linkreferencepattern @linkreferencepattern ||= begin pathsegment =...

CloudBees Jenkins Markdown Formatter Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CVE-2021-21660

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...