typora Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/typora/ Sun, 26 Feb 2023 06:32:23 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png typora Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/typora/ 32 32 CVE-2019-20374 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-20374/ Sun, 26 Feb 2023 06:32:23 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-20374/ A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on […]

The post CVE-2019-20374 appeared first on CVE Vulnerability.

]]> A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

The post CVE-2019-20374 appeared first on CVE Vulnerability.

]]> CVE-2019-12172 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-12172/ Sun, 26 Feb 2023 06:29:47 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-12172/ Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.

The post CVE-2019-12172 appeared first on CVE Vulnerability.

]]> Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.

The post CVE-2019-12172 appeared first on CVE Vulnerability.

]]> CVE-2019-12137 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-12137/ Sun, 26 Feb 2023 06:29:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-12137/ Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.

The post CVE-2019-12137 appeared first on CVE Vulnerability.

]]> Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.

The post CVE-2019-12137 appeared first on CVE Vulnerability.

]]>