Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
353 results · page 7 of 8
Aug 8, 2020In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.CVE-2020-15820 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 14, 2020In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS CVE-2020-11083 · Other software · October CMS · reported by GitHubLow 3.5
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 1, 2020The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs.CVE-2020-5238 · Other software · github · reported by GitHubMedium 6.5
The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2020In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor.CVE-2020-11051 · Other software · Requarks · reported by GitHubMedium 6.9
In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.
- Product
- Wiki.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2020setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock.CVE-2020-12267 · Other software · QT · reported by MITRECritical 9.8
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock.
- Product
- QT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgcodereview.qt-project.org
Apr 20, 2020Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.CVE-2020-9445 · Other software · Zulip · reported by MITREMedium 6.1
Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Apr 20, 2020Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.CVE-2020-9444 · Other software · Zulip · reported by MITREMedium 6.1
Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Apr 20, 2020Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.CVE-2020-10935 · Other software · Zulip · reported by MITREMedium 5.4
Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgcoresecurity.com
Apr 20, 2020python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds.CVE-2020-11888 · Other software · Python-markdown2 Project · reported by MITREMedium 6.1
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
- Product
- Python-markdown2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 2, 2020The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS.CVE-2018-19658 · Other software · Evernote · reported by MITREMedium 5.4
The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YXBJ, not a vulnerability in Evernote.
- Product
- Yinxiang Biji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyinxiang.comyinxiang.com
Feb 3, 2020massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).CVE-2020-8548 · Other software · Masscode · reported by MITREMedium 6.1
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).
- Product
- Masscode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.CVE-2009-3724 · Other software · python-markdown2 · reported by Red HatMedium 6.1
python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.
- Product
- python-markdown2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2019A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affecCVE-2019-15584 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 6.5
A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Dec 5, 2019domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content.CVE-2019-19619 · Other software · Documize · reported by MITREMedium 6.1
domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
- Product
- Documize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2019JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.CVE-2019-14954 · Other software · Jetbrains · reported by MITREMedium 5.9
JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
- Product
- Intellij Idea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Sep 18, 2019The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking.CVE-2019-16215 · Other software · Zulip · reported by MITREMedium 6.5
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orggithub.com
Jul 19, 2019interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.CVE-2019-13982 · Other software · Rangerstudio · reported by MITREMedium 5.3
interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.
- Product
- Directus 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2019GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields viaCVE-2018-19573 · Websites & servers · Gitlab · reported by MITREMedium 5.4
GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comabout.gitlab.com
Jul 10, 2019GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognizCVE-2018-19570 · Websites & servers · Gitlab · reported by MITREMedium 5.4
GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comabout.gitlab.com
May 19, 2019There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by CVE-2019-12184 · Other software · Boostio · reported by MITREMedium 5.4
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
- Product
- Boostnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 8, 2019simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.CVE-2019-9844 · Other software · Khanacademy · reported by MITREMedium 6.1
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
- Product
- Simple-markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 14, 2019gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require('child_prCVE-2019-9785 · Other software · Gitnoteapp · reported by MITREHigh 7.8
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require('child_process').execFile substring in the onerror attribute of an IMG element.
- Product
- Gitnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2019DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.CVE-2019-9736 · Other software · 1024tools · reported by MITREMedium 6.1
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
- Product
- 1024tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2019XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option.CVE-2019-6278 · Other software · Jpress · reported by MITREMedium 5.4
XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option.
- Product
- Jpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2018The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.CVE-2018-20351 · Other software · Evernote · reported by MITREMedium 6.1
The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyinxiang.comyinxiang.com
Dec 20, 2018PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted sCVE-2018-1000874 · Other software · Cebe · reported by MITREMedium 6.1
PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a three backtick wrapped payload with a character in front: L: "```<script>alert();</script>```". NOTE: This has been argued as a non-issue (see references) since it is not the parser's job to sanitize malicious code from a parsed document
- Product
- Markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2018A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.CVE-2018-3770 · Other software · HackerOne · reported by support@hackerone.comMedium 5.5
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
- Product
- markdown-pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jul 8, 2018Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.CVE-2018-13433 · Other software · Boostnote · reported by MITREMedium 6.1
Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.
- Product
- Boostnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2018The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) viaCVE-2018-12495 · Other software · Discount Project · reported by MITREMedium 5.5
The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
- Product
- Discount
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 4, 2018GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc).CVE-2017-16019 · Other software · HackerOne · reported by support@hackerone.comMedium 6.1
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
- Product
- gitbook node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Jun 4, 2018Remarkable is a markdown parser.CVE-2017-16006 · Other software · HackerOne · reported by support@hackerone.comMedium 6.1
Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.
- Product
- remarkable node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
May 31, 2018marked is an application that is meant to parse and compile markdown.CVE-2016-10531 · Other software · HackerOne · reported by support@hackerone.comMedium 6.1
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
- Product
- marked node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2018The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a cCVE-2018-11504 · Other software · Discount Project · reported by MITREMedium 5.5
The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
- Product
- Discount
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 26, 2018The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) viaCVE-2018-11503 · Other software · Discount Project · reported by MITREMedium 5.5
The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
- Product
- Discount
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 25, 2018The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) vCVE-2018-11468 · Other software · Discount Project · reported by MITREMedium 5.5
The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
- Product
- Discount
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Apr 18, 2018In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.CVE-2018-9986 · Other software · Zulip · reported by MITREMedium 6.1
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Jan 18, 2018An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5.CVE-2018-5773 · Other software · Python-markdown2 Project · reported by MITREMedium 6.1
An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.
- Product
- Python-markdown2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2018Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.CVE-2018-5216 · Other software · Radiantcms · reported by MITREMedium 5.4
Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.
- Product
- Radiant CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2018Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.CVE-2017-1000491 · Other software · Shiba Project · reported by MITREMedium 6.1
Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.
- Product
- Shiba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2018Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notesCVE-2017-1000459 · Other software · Leanote · reported by MITREMedium 6.1
Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes
- Product
- Leanote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2017In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS.CVE-2017-16782 · Other software · Home-assistant · reported by MITREMedium 6.1
In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS.
- Product
- Home-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2017A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.CVE-2017-15878 · Other software · Keystonejs · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
- Product
- Keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securelayer7.netsecurityfocus.com
Oct 17, 2017In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.CVE-2016-10515 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Aug 9, 2017Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdownCVE-2014-5144 · Other software · Telescopeapp · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown.
- Product
- Telescope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtelescopeapp.orgexploit-db.com
Jul 23, 2017Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-saCVE-2017-11594 · Other software · Loomio · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment.
- Product
- Loomio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2017Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script oCVE-2017-11593 · Other software · Ooso · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files that are designed to be viewed in the browser as plain text, but that will be converted to HTML without proper sanitization.
- Product
- Markdown Preview Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.CVE-2017-1000054 · Other software · Rocketchat · reported by MITREMedium 6.1
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtheblazehen.comtheblazehen.com
Jun 7, 2017markdown-it before 4.1.0 does not block data: URLs.CVE-2015-3295 · Other software · Markdown-it Project · reported by MITREMedium 5.3
markdown-it before 4.1.0 does not block data: URLs.
- Product
- Markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jun 1, 2017The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.CVE-2017-9337 · WordPress plugins & themes · reported by MITREMedium 6.1
The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.
- Affected
- 2.5 to 2.5
- What to do
- Affects 2.5 to 2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2017Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to injectCVE-2017-5553 · Other software · B2evolution · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL.
- Product
- B2evolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordb2evolution.netsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.