46 matches found
com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2024-1899 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)
org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2024-1899 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-8685132...
Regular Expression Denial of Service (ReDoS)
Overview org.webjars:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the anchors subparser in anchors.js AKA links.js. PoC time node -e '/?:^|^\ ??:\n ?.?/g.test"".repeat9999' Details Denial...
Regular Expression Denial of Service (ReDoS)
Overview org.webjars.npm:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the anchors subparser in anchors.js AKA links.js. PoC time node -e '/?:^|^\ ??:\n ?.?/g.test"".repeat9999' Details...
Regular Expression Denial of Service (ReDoS)
Overview org.webjars.bower:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the anchors subparser in anchors.js AKA links.js. PoC time node -e '/?:^|^\ ??:\n ?.?/g.test"".repeat9999' Details...
GHSA-C33W-PM52-MQVF @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
Description Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in, and versions before 4.6.1 of the Dependency-Track frontend did n...
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
Description Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in, and versions before 4.6.1 of the Dependency-Track frontend did n...
CVE-2022-39350
@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...
Format string
@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...
Dependency-Track 安全漏洞
Dependency-Track is an intelligent supply chain component analysis platform for identifying third-party component risks. A security vulnerability exists in versions of Dependency-Track prior to 4.6.1 that stems from not coding or cleaning up the output of Showdown, which allows arbitrary JavaScri...
CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...
CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...
PT-2022-24919 · Unknown +1 · @Dependencytrack/Frontend +1
Name of the Vulnerable Software and Affected Versions: @dependencytrack/frontend versions prior to 4.6.1 Description: The Dependency-Track frontend is a Single Page Application SPA that renders vulnerability details using the JavaScript library Showdown. Since Showdown does not have any XSS...
CVE-2022-39350
CVE-2022-39350 affects @dependencytrack/frontend (Dependency-Track frontend). The issue arises because vulnerability details rendered with Showdown were not encoded/sanitized before version 4.6.1, allowing arbitrary JavaScript in vulnerability fields (Description, Details, Recommendation, Referen...
Groove Calls for Cyberattacks on US as REvil Payback
UPDATE: Subsequent reporting and disclosures show “Groove” was a hoax intended to lure media outlets into reporting on fake potential threats against U.S. government interests. Threatpost regrets falling for a troll. Lesson learned and apologies to our readers. Following the recent international...
@cloudmosaic/quickstarts (>=1.0.0-rc.0, <=1.0.0-rc.1), @cooptest/quickstarts (>=1.0.0, <=1.0.12) +113 more potentially affected by unknown CVE via showdown (>=1.0.0-alpha.2, <=1.9.0)
showdown NPM version =1.0.0-alpha.2, =1.0.0-rc.0, =1.0.0, =1.0.0-alpha.1, =2.0.0-beta.5, =0.4.0-1, =1.6.3, =5.2.1, =0.0.11, =0.0.9, =0.0.2, =1.0.0-rc.2, =1.0.1, =0.0.0-beta.1, =0.0.0-beta.24 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H6MQ-3CJ6-H738...
Reverse Tabnabbing in showdown
Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks. Recommendation Upgrade to version 1.9.1 or lat...
Trump's Ukraine Delusion, Tesla's Ford Showdown, and More News
Catch up on the most important news from today in two minutes or less...
Reverse Tabnabbing
showdown is vulnerable to reverse tabnabbing. The vulnerability exists due to a misconfiguration whereby the setting of rel="noopener noreferrer" is not set when openLinksInNewWindow is on...
Reverse Tabnabbing
Overview Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks. Recommendation Upgrade to version 1.9...
