6114 matches found
md4c 安全漏洞
md4c Markdown for C is an individual developer's implementation of the Markdown parser in C. A security vulnerability exists in md4c 0.4.7 that allows an attacker to exploit the vulnerability to trigger the use of uninitialized memory and cause a denial of service via a malformed Markdown documen...
CVE-2021-21391: Uncontrolled Resource Consumption
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular...
md4c -- DoS attack
[email protected] reports: mdanalyzeline in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document...
CVE-2021-29474
HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker can read arbitrary .md files from the server's filesystem due to an improper input validation, which results in the ability to perform a relative path traversal. To verify if you are affected, you can t...
Path traversal
HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker can read arbitrary .md files from the server's filesystem due to an improper input validation, which results in the ability to perform a relative path traversal. To verify if you are affected, you can t...
CVE-2021-29474 Relative Path Traversal Attack on note creation
HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker can read arbitrary .md files from the server's filesystem due to an improper input validation, which results in the ability to perform a relative path traversal. To verify if you are affected, you can t...
PT-2021-18238 · Hedgedoc · Hedgedoc
Name of the Vulnerable Software and Affected Versions: HedgeDoc affected versions not specified Description: The issue is related to an improper input validation in HedgeDoc, allowing an attacker to perform a relative path traversal and read arbitrary .md files from the server's filesystem. This...
CVE-2021-29474: Improper Input Validation
HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker can read arbitrary .md files from the server's filesystem due to an improper input validation, which results in the ability to perform a relative path traversal. To verify if you are affected, you can t...
HedgeDoc 路径遍历漏洞
HedgeDoc is a Javascript-based real-time editing and sharing platform for Markdown documents from the HedgeDoc team. A path traversal vulnerability exists in HedgeDoc, which allows an attacker to read an arbitrary .md file from the server's filesystem to perform relative path traversal...
GO-2021-0086 Cross-site scripting in github.com/documize/community
HTML content in markdown is not sanitized during rendering, possibly allowing XSS if used to render untrusted user input...
GHSA-GCM9-CC3R-C6VJ Cross-site Scripting (XSS) in Eclipse Theia
In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview @theia/preview, can be exploited to execute arbitrary code...
Cross-site Scripting (XSS) in Eclipse Theia
In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview @theia/preview, can be exploited to execute arbitrary code...
Cross-site Scripting (XSS)
Overview ngx-markdown-editor is an Angular markdown editor based on ace editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The vulnerability can be exploited when previewing the Markdown content. Details Cross-site scripting or XSS is a code vulnerability that...
gitea:fuzz_markdown_render_raw: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5726263340826624 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkdownrenderraw Job Type: libfuzzerasangitea Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffffffffffff Crash State: NULL Sanitizer: address ASAN...
PT-2021-14470
Name of the Vulnerable Software and Affected Versions CKEditor 5 versions = 26.0.0 Description A regular expression denial of service ReDoS vulnerability has been discovered in multiple CKEditor 5 packages, including ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list,...
CVE-2021-29996
Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution RCE by opening .md files containing a mutation Cross Site Scripting XSS payload...
Mark Text 跨站脚本漏洞
Mark Text is a high-performance Markdown editor, built on Electron and running on Mac, Windows and Linux platforms, with a clean look and a focus on speed and usability. A cross-site scripting vulnerability exists in Mark Text in version 0.16.3 and earlier, which is related to the failure of the...
Fedora: Security Advisory for rubygem-kramdown (FEDORA-2021-edc673e864)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
