Archive
28 December 2020
Vulnerabilities first published on this day (UTC), newest first.
3 results · Clear filters · Feed
-
High 8.7
Stored XSS in mermaid diagrams
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most loc…
-
High 7.5
Arbitary file upload
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1…
-
High 7.5
Regular expression Denial of Service in date-and-time
date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.