Loomio Cross-Site Scripting Vulnerability

Loomio is a cross-platform team decision-making tool. markdown parser is one of the Markdown markup language parser. A cross-site scripting vulnerability exists in the Markdown parser in Loomio versions prior to 1.8.0. A remote attacker can exploit this vulnerability to inject arbitrary web scrip...

PT-2017-12128

Name of the Vulnerable Software and Affected Versions Loomio versions prior to 1.8.0 Description A cross-site scripting XSS issue exists in the Markdown parser, allowing remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

Markdown Preview Plus extension cross-site scripting vulnerability

Markdown Preview Plus MPP extension for Chrome is a markdown a markup language preview plugin for Chrome. A cross-site scripting vulnerability exists in versions of the MPP extension for Chrome platform prior to 0.5.7. A remote attacker can exploit this vulnerability to inject arbitrary web scrip...

CVE-2017-11594: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

CVE-2017-1000054

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...

CVE-2017-1000054

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...

Design/Logic Flaw

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...

CVE-2017-1000054: Improper Neutralization of Input During Web Page Generation

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...

CVE-2017-1000054

Rocket.Chat 0.8.0 and newer is affected by an XSS in the markdown link parsing code for messages. The vulnerability enables injection of arbitrary JavaScript into a victim’s browser, with potential token/session theft and unauthorized actions if a user views the affected content. Multiple sources...

CVE-2017-1000054

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...

CVE-2017-1000054

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages...

PT-2017-10764 · Rocket.Chat · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 0.8.0 and newer Description: The issue concerns an XSS vulnerability in the markdown link parsing code for messages. Recommendations: For Rocket.Chat versions 0.8.0 and newer, at the moment, there is no information about ...

Flexport year in Hackerone is report 6 an interesting vulnerability-vulnerability warning-the black bar safety net

! A year ago the Internet freight forwarders company Flexport in order to improve its customer data security, with our HackerOne platform to establish a cooperative relationship. HackerOne as a global well-known bug Bounty gold one, allowing all the security enthusiasts and professional penetrati...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

DEBIAN-CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs, enabling potential HTML injection when rendering user-provided content. Affected: markdown-it versions prior to 4.1.0. Root cause: failure to block data: URLs in the rendering process. Impact: authoring or rendering content could lead to uninten...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

PT-2017-6658

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 4.1.0 Description The issue concerns markdown-it not blocking data: URLs. Recommendations For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue...