CVE-2024-48910 DOMPurify vulnerable to tampering by prototype polution

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2...

CVE-2020-26303

A flaw was found in the insane package, a whitelist-oriented HTML sanitizer. Affected versions of this package contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. Mitigation Mitigation for this issue is either not available or the currently...

insane vulnerable to Regular Expression Denial of Service

insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no known patches are available...

GHSA-W455-MFQ9-HF74 insane vulnerable to Regular Expression Denial of Service

insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no known patches are available...

CVE-2020-26303 GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insane

insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no known patches are available...

CVE-2020-26303

The CVE-2020-26303 entry concerns the insane HTML sanitizer. Affected versions are 2.6.2 and earlier. The underlying issue is a Regular Expression Denial of Service (ReDoS) vulnerability in one or more regular expressions used by the sanitizer. Public documentation indicates that as of publicatio...

CVE-2020-26303 GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insane

insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no known patches are available...

PT-2024-10793 · Insane · Insane

Name of the Vulnerable Software and Affected Versions: insane versions 2.6.2 and prior Description: The issue concerns a whitelist-oriented HTML sanitizer that contains one or more regular expressions vulnerable to Regular Expression Denial of Service ReDoS. No known patches are available as of t...

Debian dsa-5790 : node-dompurify - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5790 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5790-1 [email protected] https://www.debian.org/security/ Moritz...

CVE-2024-47875 DOMPurify nesting-based mXSS

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3...

[SECURITY] [DLA 3902-1] ruby-rails-html-sanitizer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3902-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 28, 2024 https://wiki.debian.org/LTS -...

Debian dla-3902 : ruby-rails-html-sanitizer - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3902 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3902-1 [email protected]...

DLA-3902-1 ruby-rails-html-sanitizer - security update

Bulletin has no description...

FreeBSD : SnappyMail -- multiple mXSS in HTML sanitizer (bd940aba-7467-11ef-a5c4-08002784c58d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bd940aba-7467-11ef-a5c4-08002784c58d advisory. Oskar reports: SnappyMail uses the cleanHtml function to cleanup HTML and CSS in emails. Research...

SnappyMail -- multiple mXSS in HTML sanitizer

Oskar reports: SnappyMail uses the cleanHtml function to cleanup HTML and CSS in emails. Research discovered that the function has a few bugs which cause an mXSS exploit. Because the function allowed too many invalid HTML elements, it was possible with incorrect markup to trick the browser to "fi...

Fedora: Security Advisory (FEDORA-2023-91e69ea326)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-3856-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications stems from improper handling of input data during web page generation. This allows attackers to perform cross-site scripting attacks.

The vulnerability of the Rails Html Sanitizer configuration implementation relates to the embedding of content. If the application developer defines custom tags such as “math”, “style” or “svg” and “style”, this vulnerability can allow a remote attacker to perform cross-site scripting attacks...

The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications stems from improper handling of input data during web page generation. This allows attackers to perform cross-site scripting attacks.

The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications is related to the use of Rails in conjunction with Loofah. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

[SECURITY] [DLA 3856-1] python-html-sanitizer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3856-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 26, 2024 https://wiki.debian.org/LTS -...