CVE-2015-1370

Published: Jan 27, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.

Affected (1)

Products: Marked Project: Marked

Marked Project

1 product

Marked

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Marked Project Marked	Up to 0.3.2

References (8)

http://www.openwall.com/lists/oss-security/2015/01/23/2

Source: secalert@redhat.com

https://github.com/chjj/marked/issues/492

Source: secalert@redhat.com

Exploit

https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba

Source: secalert@redhat.com

https://nodesecurity.io/advisories/marked_vbscript_injection

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2015/01/23/2

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/chjj/marked/issues/492

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba

Source: af854a3a-2127-422b-91ae-364da2661108

https://nodesecurity.io/advisories/marked_vbscript_injection

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.