CVE-2015-1370: XSS
Published Jan 27, 2015
·Updated
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Affected Software
1 affected component
Marked Project Marked<=0.3.2
Event History
Jan 27, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1370?
The severity of CVE-2015-1370 is considered moderate due to its potential for XSS attacks.
2
How do I fix CVE-2015-1370?
To fix CVE-2015-1370, upgrade to marked version 0.3.3 or later.
3
What types of attacks are possible with CVE-2015-1370?
CVE-2015-1370 allows remote attackers to conduct cross-site scripting (XSS) attacks.
4
Which versions of marked are affected by CVE-2015-1370?
Marked versions 0.3.2 and earlier are affected by CVE-2015-1370.
5
Can I use marked without exposing my application to CVE-2015-1370?
Yes, you can use marked safely by ensuring you are running version 0.3.3 or later.