CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39703
https://notcve.org/view.php?id=CVE-2023-39703
01 Sep 2023 — A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en un componente del Editor de Markdown en Typora versión v1.6.7 permite a atacantes ejecutar código arbitrario cargando un archivo manipulado de Markdown. • https://c0olw.github.io/2023/07/31/Typora-XSS-Vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-2971 – Typora Local File Disclosure
https://notcve.org/view.php?id=CVE-2023-2971
19 Aug 2023 — Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora. El manejo inadecuado de rutas en Typora antes de 1.7.0-dev en Windows y Linux permite que una página web manipulada acceda a archivos locales y los exfiltre a servidor... • https://starlabs.sg/advisories/23/23-2971 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-2317 – Typora DOM-Based Cross-site Scripting leading to Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-2317
19 Aug 2023 — DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in <embed> tag. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora. • https://starlabs.sg/advisories/23/23-2317 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-2316 – Typora Local File Disclosure
https://notcve.org/view.php?id=CVE-2023-2316
19 Aug 2023 — Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora. • https://starlabs.sg/advisories/23/23-2316 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-1003 – Typora WSH JScript code injection
https://notcve.org/view.php?id=CVE-2023-1003
24 Feb 2023 — A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Handler. The manipulation leads to code injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. • https://github.com/typora/typora-issues/issues/5623 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40011
https://notcve.org/view.php?id=CVE-2022-40011
23 Dec 2022 — Cross Site Scripting (XSS) vulnerability in typora through 1.38 allows remote attackers to run arbitrary code via export from editor. Vulnerabilidad de Cross Site Scripting (XSS) en typora hasta 1.38 permite a atacantes remotos ejecutar código arbitrario mediante exportación desde el editor. • http://typora.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43668
https://notcve.org/view.php?id=CVE-2022-43668
07 Dec 2022 — Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product. Las versiones de Typora anteriores a la 1.4.4 no neutralizan adecuadamente el código JavaScript, lo que puede provocar la ejecución del código JavaScript contenido en el archivo al abrir un archivo con el producto afectado. • https://jvn.jp/en/jp/JVN26044739/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18221
https://notcve.org/view.php?id=CVE-2020-18221
26 May 2021 — Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a mathematical formula. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en Typora versión v0.9.65 y anteriores, permite a atacantes remotos ejecutar código arbitrario al inyectar comandos durante el renderizado de bloques de una fórmula matemática • https://github.com/typora/typora-issues/issues/2204 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 1%CPEs: 4EXPL: 0CVE-2019-20374
https://notcve.org/view.php?id=CVE-2019-20374
09 Jan 2020 — A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment. Un problema de mutación de tipo cross-site scripting (XSS) en Typora ve... • https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2019-12172
https://notcve.org/view.php?id=CVE-2019-12172
17 May 2019 — Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137. Typora 0.9.9.21.1 (1913) permite la ejecución de código arbitrario a través de un archivo modificado: sintaxis de URL en el atributo HREF de un elemento AREA, como lo demuestra el archivo: \\\ en macOS o Linux, o el archivo: // C | en Windows. Esto es diferente de CVE-2... • https://github.com/typora/typora-issues/issues/2166 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •