CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11888
https://notcve.org/view.php?id=CVE-2020-11888
20 Apr 2020 — python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute. python-markdown2 versiones hasta 2.3.8, permite un ataque de tipo XSS porque los nombres de los elementos se manejan inapropiadamente a menos que una coincidencia de \w+ tenga éxito. Por ejemplo, un ataque podría usar elementname@ o elementname- con un atributo onclick. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00031.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2009-3724
https://notcve.org/view.php?id=CVE-2009-3724
15 Jan 2020 — python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues. python-markdown2 versiones anteriores a la versión 1.0.1.14, tiene múltiples problemas de tipo cross-site scripting (XSS) . • https://snyk.io/vuln/SNYK-PYTHON-PYRAD-40000 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5773
https://notcve.org/view.php?id=CVE-2018-5773
18 Jan 2018 — An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag. Se ha descubierto un problema en markdown2 (también conocido como python-markdown2) hasta la versión 2.3.5. La característica safe_mode, que se supone que sanear entradas contra XSS, tiene errore... • https://github.com/trentm/python-markdown2/issues/285 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •