HackerOne: The possibility of disrupting the normal operation of frontend using markdown

Summary: Hi team, Our team noticed that using some string construction in markdown may cause it to fail and output error 502. Thus, disrupting the UI process. This may affect the work in places where there is a GraphQL attribute output. For example: User object in GraphQL : introhtml attribute...

Cross site scripting

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...

CVE-2021-22886

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...

CVE-2021-22886

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...

CVE-2021-22886: Improper Neutralization of Input During Web Page Generation

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...

PT-2021-15254

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 3.11 Rocket.Chat version 3.10.5 Rocket.Chat version 3.9.7 Rocket.Chat version 3.8.8 Description The issue allows a remote attacker to inject arbitrary JavaScript in a message using nested markdown tags, leading to...

OSCP-Exam-Report-Template-Markdown - Markdown Templates For Offensive Security OSCP, OSWE, OSCE, OSEE, OSWP Exam Report

I created an Offensive Security Exam Report Template in Markdown so LaTeX, Microsoft Office Word, LibreOffice Writer are no longer needed during your Offensive Security OSCP, OSWE, OSCE, OSEE, OSWP exam! Now you can be efficient and faster during your exam report redaction! Speed up writing , don...

FreeBSD : gitea -- quoting in markdown text (1431a25c-8a70-11eb-bd16-0800278d94f0)

The Gitea Team reports for release 1.13.5 : - Update to goldmark 1.3.3 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors Redistribution and use in source VuX...

OPENSUSE-SU-2021:0451-1 Security update for python-markdown2

This update for python-markdown2 fixes the following issues: Update to 2.4.0 boo1181270: - pull 377 Fixed bug breaking strings elements in metadata lists - pull 380 When rendering fenced code blocks, also add the language-LANG class - pull 387 Regex DoS fixes CVE-2021-26813, boo1183171 - Switch o...

Regular Expression Denial of Service (ReDoS) in Jinja2

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiti...

Cross-site Scripting (XSS)

Overview qiita-markdown is a Qiita-specified markdown processor. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Increments Qiita::Markdown allows XSS in transformers. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” ...

Cross-site Scripting (XSS)

qiita-markdown is vulnerable to cross-site scripting XSS. The vulnerability exists through the value of port in url where it allows strings like javascript://docs.google.com:80/%0d%0aalertdocument.domain to be executed...

gitea:fuzz_markdown_render_raw: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5667361895088128 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkdownrenderraw Job Type: libfuzzerasangitea Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

CVE-2021-28796

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...

CVE-2021-28796

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...

Cross site scripting

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...

CVE-2021-28796

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...

CVE-2021-28796

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...

CVE-2021-28796

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...

CVE-2021-28796

CVE-2021-28796 affects Qiita::Markdown (Ruby) prior to 0.33.0, allowing XSS via transformers. The issue is documented across multiple connected sources (e.g., Red Hat CVEs, OSV/GHSA advisories) as a failure to sanitize or neutralize user-controlled input in the transformer path, leading to cross-...