Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2014/05/13/1 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2014/05/15/2 | Mailing List Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3743 | Issue Tracking Third Party Advisory |
| https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities | Broken Link |
| http://www.openwall.com/lists/oss-security/2014/05/13/1 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2014/05/15/2 | Mailing List Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3743 | Issue Tracking Third Party Advisory |
| https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities | Broken Link |
Configurations
History
21 Nov 2024, 02:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2014/05/13/1 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2014/05/15/2 - Mailing List, Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3743 - Issue Tracking, Third Party Advisory | |
| References | () https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities - Broken Link |
Information
Published : 2020-01-06 20:15
Updated : 2024-11-21 02:08
NVD link : CVE-2014-3743
Mitre link : CVE-2014-3743
CVE.ORG link : CVE-2014-3743
JSON object : View
Products Affected
marked_project
- marked
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')