Lucene search
K

Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

🗓️ 12 Mar 2024 15:39:46Reported by GitHub Advisory DatabaseType 
github
 github
🔗 github.com👁 13 Views

Cross-site Scripting (XSS) vulnerability in Phlex due to improper case-sensitivity in the code. Patched versions available on RubyGems for all 1.x minor versions. Workaround: Configure Content Security Policy to prevent exploitation.

Related
Detection
Refs
Vulners
Node
phlexphlexRange<1.0.1rubygems
OR
phlexphlexMatch1.1.0rubygems
OR
phlexphlexRange1.2.01.2.2rubygems
OR
phlexphlexRange1.3.01.3.3rubygems
OR
phlexphlexMatch1.4.0rubygems
OR
phlexphlexRange1.5.01.5.2rubygems
OR
phlexphlexRange1.6.01.6.2rubygems
OR
phlexphlexMatch1.7.0rubygems
OR
phlexphlexRange1.8.01.8.2rubygems
OR
phlexphlexMatch1.9.0rubygems

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

14 Mar 2024 21:40Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.16.1 - 7.1
EPSS0.01541
SSVC
13