CVE-2019-12184

CVE-2019-12184 affects BoostIO Boostnote 0.11.15. The vulnerability is an XSS in browser/components/MarkdownPreview.js triggered via a label named flowchart, sequence, gallery, or chart, demonstrated by a crafted SRC attribute of an IFRAME element. The connected Red Hat CVE-2019-12184 entry mirro...

CVE-2019-12136

BoostIO Boostnote 0.11.15 is affected by CVE-2019-12136. The vulnerability is an XSS in the UI when processing a label named mermaid, exploitable via a crafted SRC attribute of an IFRAME element. The issue originates from Boostnote’s rendering path for this label, enabling injection of malicious ...