6124 matches found
Cross-Site Scripting (XSS)
simple-markdown is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via Data or Vbscript URIs, e.g data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGknKTwvc2NyaXB0Pg==...
CVE-2019-9844
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
CVE-2019-9844
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
[SECURITY] Fedora 30 Update: nodejs-simple-markdown-0.4.4-1.fc30
simple-markdown is a markdown-like parser designed for simplicity and extensibility...
GitLab: Stored XSS in Wiki pages
Summary I found Stored XSS using Wiki-specific Hierarchical link Markdown in Wiki pages. Steps to reproduce 1. Sign in to GitLab. 2. Open a Project page that you have permission to edit Wiki pages. 3. Open Wiki page. 4. Click "New page" button. 5. Fill out "Page slug" form with javascript:. 6...
Mail.ru: LRF on shared.mail.ru due to "markdown" plugin
Markdown plugin in Atlassian Jira instance for external contractors was vulnerable to LFR vulnerability...
simple-markdown cross-site scripting vulnerability
simple-markdown is a simple, extensible Markdown-like parser . A cross-site scripting vulnerability exists in simple-markdown.js in Khan Academy simple-markdown versions prior to 0.4.4. The vulnerability can be exploited to conduct cross-site scripting attacks via the data: or vbscript: URI...
CVE-2019-9844
CVE-2019-9844 affects the Node package simple-markdown (Khan Academy’s simple-markdown) up to version 0.4.3. The vulnerability is a Cross‑Site Scripting (XSS) flaw caused by insufficient input sanitization in links, enabling execution of malicious JavaScript via data: or VBScript: URIs. The issue...
CVE-2019-9844
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...
PT-2019-19892
Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.4.4 Description The issue is related to insufficient input sanitization, which allows Cross-Site Scripting XSS attacks. This can be exploited through input of links containing data or vbscript URIs and a...
CVE-2019-9785
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...
Design/Logic Flaw
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...
CVE-2019-9785
CVE-2019-9785 affects gitnote 3.1.0. A crafted Markdown file can cause remote code execution via a malicious onerror attribute in an IMG element that invokes javascript:window.parent.top.require('child_process').execFile. This exposes arbitrary code execution if a renderer processes the Markdown ...
CVE-2019-9785
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...
CVE-2019-9785: Improper Neutralization of Special Elements used in an OS Command
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...
PT-2019-19871
Name of the Vulnerable Software and Affected Versions gitnote version 3.1.0 Description The issue allows remote attackers to execute arbitrary code via a crafted Markdown file. This can be achieved by including a specific substring in the onerror attribute of an IMG element, such as...
CVE-2019-9736
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...
Default credentials
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...
