Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored Cross-Site-Scripting (XSS) in Markdown Editor
Vulnerability Description
K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
K-Box 跨站脚本漏洞
Vulnerability Description
K-Box是一个基于 Web 的应用程序。用于管理文档、图像、视频和地理数据。 K-Box 中存在跨站脚本漏洞，该漏洞源于产品用户文档摘要和markdown文件预览的编辑器未对用户输入数据中的特殊字符做安全处理。攻击者可通过该漏洞执行客户端代码。以下产品及版本受到影响：K-Box 0.33.1 之前版本。
CVSS Information
N/A
Vulnerability Type
N/A