CVE-2015-1370
CVE-2015-1370
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
EPSS 2.0% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
node-marked Debian:12
- Affected ranges
- ECOSYSTEM: < 0.3.6+dfsg-1
Update to 0.3.6+dfsg-1
node-marked Debian:13
- Affected ranges
- ECOSYSTEM: < 0.3.6+dfsg-1
Update to 0.3.6+dfsg-1
node-marked Debian:14
- Affected ranges
- ECOSYSTEM: < 0.3.6+dfsg-1
Update to 0.3.6+dfsg-1
marked npm
- Affected ranges
- SEMVER: < 0.3.3
Update to 0.3.3
node-marked Ubuntu:16.04:LTS
- Versions
- 0.3.2+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published