CVE-2022-23517: Inefficient Regular Expression Complexity

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

CVE-2022-23518: Improper Neutralization of Input During Web Page Generation

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions = 1.0.3, = 2.1.0. This issue is patched in version 1.4.4...

CVE-2022-23519: Improper Neutralization of Input During Web Page Generation

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's...

Rails 跨站脚本漏洞

Rails is a Ruby-based open source web application framework from the Rails team. A cross-site scripting vulnerability exists in Rails rails-html-sanitizer versions 1.0.3 through 1.4.4, which stems from the vulnerability to cross-site scripting attacks via data URIs when used in conjunction with...

CVE-2022-23499

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the...

Cross site scripting

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the...

CVE-2022-23499

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the...

CVE-2022-23499 Cross-Site Scripting Protection bypass in HTML Sanitizer

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the...

CVE-2022-23499

CVE-2022-23499 describes a cross-site scripting protection bypass in TYPO3’s HTML sanitizer. The root cause is a parsing issue in the upstream masterminds/html5 library, which allows certain HTML CDATA sequences and raw text elements (script, style, noframes, noembed, iframe) to bypass the saniti...

CVE-2022-23499 Cross-Site Scripting Protection bypass in HTML Sanitizer

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the...

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 Impact A possible XSS vulnerability with certain configurations of...

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 Impact A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject...

GHSA-9H9G-93GC-623H Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 Impact A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to certain configurations of rails::Html::Sanitizer which allow attackers to inject content if the application developer have overridden the sanitizer's allowed tags in either of the following ways: 1 allow...

Improper neutralization of data URIs may allow XSS in rails-html-sanitizer

Summary rails-html-sanitizer = 1.0.3, = 2.1.0. Mitigation Upgrade to rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type...

GHSA-MCVF-2Q2M-X72M Improper neutralization of data URIs may allow XSS in rails-html-sanitizer

Summary rails-html-sanitizer = 1.0.3, = 2.1.0. Mitigation Upgrade to rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type...

Inefficient Regular Expression Complexity in rails-html-sanitizer

Summary Certain configurations of rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly...

GHSA-5X79-W82F-GW8W Inefficient Regular Expression Complexity in rails-html-sanitizer

Summary Certain configurations of rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly...

TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting

Problem Due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Besides that, the upstream package...

GHSA-HVWX-QH2H-XCFJ TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting

Problem Due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Besides that, the upstream package...