6123 matches found
CVE-2019-9736
CVE-2019-9736 affects 1024Tools Markdown 1.0 with a DOM-based XSS vulnerability triggered by embedding an SVG data URL via the substring ‘<EMBED SRC="data:image/svg+xml'’. The NVD entries cite CVSS2/3 base scores of 4.3 (MEDIUM) and 6.1 (MEDIUM), respectively; attack vector is NETWORK (CVSS2) ...
PT-2019-19830
Name of the Vulnerable Software and Affected Versions 1024Tools Markdown version 1.0 Description A DOM-based XSS issue exists, which can be exploited via vectors involving the 'EMBED SRC="data:image/svg+xml' substring. Recommendations For version 1.0, update to a version that fixes this issue, as...
CVE-2019-9736: Improper Neutralization of Input During Web Page Generation
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '...
[SECURITY] Fedora 28 Update: php-erusev-parsedown-1.7.1-1.fc28
Markdown parser in PHP. Autoloader: /usr/share/php/erusev/parsedown/autoload.php...
[SECURITY] Fedora 29 Update: python-markdown2-2.3.7-1.fc29
Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...
Cross-site Scripting (XSS)
Overview @toast-ui/editor is a GFM Markdown Wysiwyg Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS. JavaScript inserted into the editor is not sanitized by the library. PoC " src=x onerror="alert1" alert1" alert1" alert1" Details Cross-site scripting or XSS i...
Vanilla: Stored XSS in vanilla
Summary: There is a stored XSS in the latest version 2.6.4 of vanilla. Attack with post privileges can trigger this. Description: This is a feature that user can post content in markdown format. And the content and format type is inserted into database without check the format param. So attack ca...
JPress Cross-Site Scripting Vulnerability (CNVD-2019-01670)
JPress is a set of blogging platform developed using the Java language. A cross-site scripting vulnerability exists in JPress version 1.0.4, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of Markdown input...
CVE-2019-6278
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...
CVE-2019-6278
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...
Cross site scripting
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...
CVE-2019-6278
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...
CVE-2019-6278
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...
CVE-2019-6278
CVE-2019-6278 is an XSS vulnerability in JPress v1.0.4 exploitable via Markdown input (and Markdown input with the code input option). Affected component: JPress Markdown processing. Root cause and exact exploit vector are not detailed across the provided documents beyond the XSS claim. Several s...
PT-2019-18068
Name of the Vulnerable Software and Affected Versions JPress version 1.0.4 Description The issue exists due to XSS in Markdown input, which can also be triggered when using the code input option. Recommendations For JPress version 1.0.4, consider disabling Markdown input or restricting the use of...
CVE-2019-6278: Improper Neutralization of Input During Web Page Generation
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option...
XSS vulnerability with unsafe link protocols
An XSS vulnerability CVE-2018-20583 has been identified in the following versions of this library: 0.15.6 0.15.7 0.16.0 0.17.0 0.17.1 0.17.2 0.17.3 0.17.4 0.17.5 0.18.0 It allows unsafe URLs to be added to links. The issue has been fixed in version 0.18.1. All users should upgrade to version 0.18...
JVN#96493183: GROWI vulnerable to cross-site scripting
GROWI provided by WESEEK, Inc. contains a cross-site scripting vulnerability CWE-79. The settings option for enabling and disabling the measures against cross-site scripting "Enable XSS prevention" option was introduced in v3.1.12. However, there was an issue with the implementation where the...