6132 matches found
HTML Injection
marky-markdown is vulnerable to HTML Injection. The vulnerability exists as it improperly validates youtube.com as the source value of the iframes. An attacker is able to pass in a value such as youtube.com.evil.com and bypass the validation...
HTML Injection
Overview All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This...
HTML Injection
Overview All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgra...
Cross-site Scripting (XSS)
Overview written is a rich Markdown editor for the web. Note: This package is deprecated EOL Affected versions of this package are vulnerable to Cross-site Scripting XSS. When parsing and converting markdown into HTML, it is possible to inject malicious JavaScript elements that can result in XSS...
CVE-2020-8548
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...
CVE-2020-8548
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...
CVE-2020-8548
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...
Design/Logic Flaw
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...
CVE-2020-8548
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...
CVE-2020-8548
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...
CVE-2020-8548: Improper Neutralization of Input During Web Page Generation
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution because nodeIntegration in webPreferences is true...
PT-2020-20201
Name of the Vulnerable Software and Affected Versions massCode version 1.0.0-alpha.6 Description The issue allows for XSS via crafted Markdown text, resulting in remote code execution because nodeIntegration in webPreferences is set to true. Recommendations For massCode version 1.0.0-alpha.6,...
Cross-Site Scripting
Overview All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Conside...
GitLab Resource Management Error Vulnerability (CNVD-2020-03053)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...
CVE-2019-15584
A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...
CVE-2019-15584
A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...
Input validation
A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...
CVE-2019-15584
A denial of service exists in gitlab v12.3.2, v12.2.6, and v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page...
