26 matches found
pytm
pytm：一个基于 Python 的威胁建模框架 简介 传统的威胁建模往往在开发后期才介入，有时甚至根本不做。此外，手动创建数据流和报告可能极其耗时。pytm 的目标是将威胁建模左移，使其更加自动化并以开发者为中心。 功能 根据您对架构设计的输入和定义，pytm 可以自动生成以下内容： 数据流图 DFD 序列图 与您的系统相关的威胁 要求 Linux/MacOS Python 3.11+ Graphviz 包 Java OpenJDK 10 或 11 plantuml.jar 快速开始 tm.py 是一个示例模型。您可以通过运行它来生成它引用的报告和图表图像文件： mkdir -p tm...
pytm
pytm: Pythonicな脅威モデリングフレームワーク はじめに 従来の脅威モデリングは、しばしば遅れて登場するか、まったく行われないことがあります。さらに、手動でデータフローやレポートを作成するのは非常に時間がかかります。pytmの目標は、脅威モデリングを左にシフトし、より自動化され、開発者中心のものにすることです。 機能 あなたの入力とアーキテクチャ設計の定義に基づいて、pytmは以下の項目を自動生成できます： データフロー図（DFD） シーケンス図 システムに関連する脅威 必要条件 Linux/MacOS Python 3.11+ Graphviz パッケージ Java...
pytm
pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
Impact @excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path. This is patched i...
Cross-Site Scripting (XSS)
Mermaid is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to user-supplied input for sequence diagram labels being passed to innerHTML during element size calculation, which allows an attacker to inject and execute malicious scripts...
Linux Distros Unpatched Vulnerability : CVE-2025-54881
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. I...
Cross-site Scripting (XSS)
Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the calculateMathMLDimensions function, which was introduced in 5c69e5f. An attacker can execute...
GHSA-7RQQ-PRVP-X9JH Mermaid improperly sanitizes sequence diagram labels leading to XSS
Summary In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS. Details Sequence diagram node labels with KaTeX delimiters are passed through calculateMathMLDimensions. This method pass...
CVE-2025-54881
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML duri...
UBUNTU-CVE-2025-54881
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML duri...
CVE-2025-54881
Technical details about CVE-2025-54881 are not publicly available in the provided connected documents. Monitor for updates.
CVE-2025-54881 Mermaid improperly sanitizes of sequence diagram labels leading to XSS
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML duri...
CVE-2025-54881 Mermaid improperly sanitizes of sequence diagram labels leading to XSS
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML duri...
Mermaid 跨站脚本漏洞
Mermaid is a mermaid-js open source application. Create charts and visualizations using text and code. A cross-site scripting vulnerability exists in Mermaid versions 10.9.0-rc.1 through 11.9.0, which stems from user-entered sequence diagram tags passed to innerHTML, potentially leading to...
CVE-2024-38527 Cross-site Scripting in ZenUML
ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting XSS. The comment feature allows the use...
[SECURITY] Fedora 40 Update: plantuml-1.2024.3-3.fc40
PlantUML is a program allowing to draw UML diagrams, using a simple and human readable text description. It is extremely useful for code documenting, sketching project architecture during team conversations and so on. PlantUML supports the following diagram types - sequence diagram - use case...
RTPEngine mr11.5.1.6 Denial Of Service
RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation - Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race - Vendor...
[SECURITY] Fedora 39 Update: plantuml-1.2023.11-1.fc39
PlantUML is a program allowing to draw UML diagrams, using a simple and human readable text description. It is extremely useful for code documenting, sketching project architecture during team conversations and so on. PlantUML supports the following diagram types - sequence diagram - use case...
Diagon Sequence::DrawText heap-based buffer overflow vulnerability
Talos Vulnerability Report TALOS-2023-1744 Diagon Sequence::DrawText heap-based buffer overflow vulnerability July 5, 2023 CVE Number CVE-2023-27390 SUMMARY A heap-based buffer overflow vulnerability exists in the Sequence::DrawText functionality of Diagon v1.0.139. A specially crafted markdown...
