WS-2020-0090

ngx-md before 6.0.3 is vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution...

ng-alain (>=0.6.7, <=0.8.1), ng5-ui (>=1.0.6, <=3.0.1) +1 more potentially affected by unknown CVE via ngx-md (3.1.1)

ngx-md NPM version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on ngx-md and may be impacted: - ng-alain =0.6.7, =1.0.6, =0.0.0-alpha.4, =1.0.0-beta.0 Source cves: unknown CVE Source advisory: MEND:WS-2020-0090...

Cross-Site Scripting in ngx-md

Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript. Recommendation...

GHSA-XR53-M937-JR9C Cross-Site Scripting in ngx-md

Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript. Recommendation...

PT-2020-21595

Name of the Vulnerable Software and Affected Versions ngx-md versions prior to 6.0.3 Description The issue allows for Cross-Site Scripting due to improper restriction of links to http/https, which can contain JavaScript and lead to arbitrary code execution. For example, Markdown input such as Cli...

Cross-Site Scripting

Overview Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript...