Design/Logic Flaw

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

CVE-2018-20351

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

CVE-2018-20351

CVE-2018-20351 affects Evernote for macOS (Chinese) prior to version 8.3.2, where the Markdown component allows stored XSS (MAC-832). Root cause: insecure handling in the Markdown rendering path leading to script execution in stored content. Impact: potential user-visible script execution within ...

CVE-2018-20351: Improper Neutralization of Input During Web Page Generation

The Markdown component in Evernote Chinese before 8.3.2 on macOS allows stored XSS, aka MAC-832...

Cross-site Scripting (XSS)

cebe/markdown is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the inconsistent behavior of multiple backticks, causing code to be interpreted incorrectly. Update: This CVE has been disputed as it is not the parser's job to sanitize malicious code from a parsed...

CVE-2018-1000874

DISPUTED PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by...

CVE-2018-1000874

PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...

CVE-2018-1000874

PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...

CVE-2018-1000874

PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...

CVE-2018-1000874

The CVE-2018-1000874 entry concerns the cebe/markdown parser (versions 1.2.0 and earlier) with a Cross-Site Scripting (XSS) vulnerability caused by the parser’s handling of a three-backtick payload that can precede a script tag (for example, ). This could allow execution of malicious code in vuln...

CVE-2018-1000874

PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...

PT-2018-9595 · Cebe · Cebe Markdown Parser

Name of the Vulnerable Software and Affected Versions: cebe markdown parser versions 1.2.0 and earlier Description: The issue allows a maliciously crafted script to be executed, potentially resulting in the loss of user data and sensitive user information. This can be exploited by crafting a thre...

CVE-2018-1000874: Improper Neutralization of Input During Web Page Generation

PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a...

GitLab: DoS on the Issue page by exploiting Mermaid.

Summary: An attacker could exploit Mermaid available in Markdown and cause DoS. Description: Markdown supported by GitLab can generate diagrams and flowcharts from text using Mermaid. An Attacker can exploit this function to prevent users from successfully accessing some functions. For example, y...

Cross-site Scripting (XSS)

jingo is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of proper defaults, allowing all HTML to be rendered in markdown by default, causing XSS attacks...

Denial of Service

Overview All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

GitLab CE/EE Information Disclosure Vulnerability (CNVD-2018-26954)

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing a project's file contents, commit history, bug lists, and more. An information disclosure...

Design/Logic Flaw

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

CVE-2018-17975

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

CVE-2018-17975

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...